fix: exclude PetalFlow examples from gosec scan #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| jobs: | |
| test: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| steps: | |
| - name: Configure git line endings | |
| run: git config --global core.autocrlf false | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.24.2" | |
| cache: true | |
| - name: Install SQLite (Windows) | |
| if: matrix.os == 'windows-latest' | |
| shell: powershell | |
| run: | | |
| # Download and extract SQLite amalgamation (includes sqlite3.h) | |
| $sqliteVersion = "3490100" | |
| $sqliteUrl = "https://www.sqlite.org/2025/sqlite-amalgamation-$sqliteVersion.zip" | |
| Invoke-WebRequest -Uri $sqliteUrl -OutFile sqlite-amalgamation.zip | |
| Expand-Archive -Path sqlite-amalgamation.zip -DestinationPath . | |
| # Set CGO_CFLAGS for the build | |
| echo "CGO_CFLAGS=-I$PWD/sqlite-amalgamation-$sqliteVersion" >> $env:GITHUB_ENV | |
| - name: Build | |
| run: go build ./... | |
| - name: Test | |
| if: matrix.os != 'ubuntu-latest' | |
| run: go test ./... | |
| - name: Test with coverage | |
| if: matrix.os == 'ubuntu-latest' | |
| run: go test -race -coverprofile=coverage.out -covermode=atomic ./... | |
| - name: Upload coverage artifact | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage.out | |
| path: coverage.out | |
| if-no-files-found: error | |
| - name: Upload coverage to Codecov | |
| if: matrix.os == 'ubuntu-latest' && env.CODECOV_TOKEN != '' | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| token: ${{ env.CODECOV_TOKEN }} | |
| files: ./coverage.out | |
| fail_ci_if_error: false | |
| verbose: true | |
| - name: Vet | |
| run: go vet ./... | |
| - name: Format check | |
| shell: bash | |
| run: | | |
| if [ -n "$(gofmt -l .)" ]; then | |
| echo "The following files are not formatted:" | |
| gofmt -l . | |
| exit 1 | |
| fi | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.24.2" | |
| cache: true | |
| - name: golangci-lint | |
| uses: golangci/golangci-lint-action@v7 | |
| with: | |
| version: v2.1.6 | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.24.2" | |
| cache: true | |
| - name: Run gosec | |
| uses: securego/gosec@v2.22.11 | |
| with: | |
| args: -exclude=G101,G104,G201,G202,G301,G304,G306,G404,G602,G704 -exclude-dir=.git -exclude-dir=vendor -exclude-dir=examples/petalflow-research-agent -exclude-dir=examples/petalflow-graph ./... | |
| build: | |
| name: Build Binary | |
| runs-on: ubuntu-latest | |
| needs: [test, lint] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.24.2" | |
| cache: true | |
| - name: Build | |
| run: go build -o cortex ./cmd/cortex |