feat(codegen): honor OpenAPI deprecated on generated flags (PRINFRA-5… #1099
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| strategy: | |
| matrix: | |
| platform: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - name: Set git to use LF | |
| run: git config --global core.autocrlf false | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.25.12" | |
| - name: Build | |
| run: make build | |
| - name: Test | |
| run: make test | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.25.12" | |
| - uses: golangci/golangci-lint-action@v9 | |
| with: | |
| version: v2.11.4 | |
| pr-template: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Validate PR template | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: pip install requests && python .github/scripts/check_pr_template.py | |
| secrets: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| run: | | |
| GITLEAKS_VERSION="8.28.0" | |
| cd /tmp | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz | |
| tar xzf gitleaks.tar.gz gitleaks | |
| sudo mv gitleaks /usr/local/bin/ | |
| rm -f gitleaks.tar.gz | |
| - name: Run gitleaks | |
| run: gitleaks detect --source . --redact=10 --verbose | |
| govulncheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.25.12" | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 | |
| - name: Run govulncheck | |
| # Allowlist GO-2026-5932 ONLY: golang.org/x/crypto/openpgp is unmaintained | |
| # ("Fixed in: N/A") and pulled in transitively by go-selfupdate for a PGP | |
| # validator the CLI does not use — the updater verifies SHA256 checksums | |
| # (ChecksumValidator), not PGP, so openpgp is never reached with untrusted | |
| # input. Any OTHER advisory still fails this job. Removal tracked in API-566. | |
| run: | | |
| out=$(govulncheck ./... 2>&1) && rc=0 || rc=$? | |
| echo "$out" | |
| if [ "$rc" -eq 0 ]; then | |
| exit 0 | |
| fi | |
| # govulncheck exits 3 when vulnerabilities are found; any other non-zero | |
| # code is a tool/build failure and must not be swallowed by the allowlist. | |
| if [ "$rc" -ne 3 ]; then | |
| echo "::error::govulncheck failed to run (exit $rc)" | |
| exit 1 | |
| fi | |
| ids=$(printf '%s\n' "$out" | grep -oE 'GO-[0-9]{4}-[0-9]+' | sort -u) | |
| others=$(printf '%s\n' "$ids" | grep -vx 'GO-2026-5932' || true) | |
| if [ -z "$ids" ] || [ -n "$others" ]; then | |
| echo "::error::Unallowlisted or unrecognized govulncheck result (ids: ${ids:-none})" | |
| exit 1 | |
| fi | |
| echo "Only the allowlisted advisory GO-2026-5932 is present; passing." | |
| goreleaser-check: | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.25.12" | |
| - uses: goreleaser/goreleaser-action@v7 | |
| with: | |
| version: "~> v2" | |
| args: check |