cli/.github/workflows/cli-go-ci.yml at develop · supabase/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: CI

on:
  pull_request:
    paths:
      - apps/cli-go/**
  merge_group:
  push:
    branches:
      - develop
    paths:
      - apps/cli-go/**

permissions:
  contents: read

jobs:
  test:
    name: Test
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: apps/cli-go/go.mod
          cache: true

      # Required by: internal/utils/credentials/keyring_test.go
      - uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # v1.2.0
      - run: |
          pkgs=$(go list ./pkg/... | grep -Ev 'pkg/api' | paste -sd ',' -)
          go tool gotestsum -- -race -v -count=1 ./... \
          -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out

      # internal/start (docker-compose/v2, buildx, moby/buildkit, k8s client-go,
      # aws-sdk-go-v2, notary, secret-detector) was deleted outright as
      # unreachable (CLI-1966) -- this guards against silently reintroducing
      # that dependency tree via some other package, since nothing else checks
      # the shipped binary's size on every change.
      - name: Verify the heavy orchestration dependency tree stays out of the module
        run: |
          set -euo pipefail
          go list -deps . > /tmp/deps.txt
          ! grep -Eq \
            'docker/compose|docker/buildx|moby/buildkit|k8s\.io/client-go|aws-sdk-go-v2' \
            /tmp/deps.txt

      - name: Check existing coverage cache
        id: coverage-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: apps/cli-go/coverage.out
          key: cli-go-coverage-${{ github.run_id }}-v1
          lookup-only: true

      - name: Save coverage cache
        if: steps.coverage-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: apps/cli-go/coverage.out
          key: cli-go-coverage-${{ github.run_id }}-v1

  coverage:
    name: Coverage
    needs:
      - test
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Restore coverage cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: apps/cli-go/coverage.out
          key: cli-go-coverage-${{ github.run_id }}-v1
          fail-on-cache-miss: true
      - name: Move coverage report
        run: cp apps/cli-go/coverage.out coverage.out
        working-directory: .
      - uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
        with:
          file: coverage.out
          format: golang

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.9.0
          install: true
          install_args: >-
            go
            golangci-lint

      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          args: --timeout 5m --verbose
          install-mode: none
          only-new-issues: true
          working-directory: apps/cli-go

  codegen:
    name: Codegen
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: apps/cli-go/go.mod
          cache: true

      # Regenerates from the committed api/v1-openapi.yaml snapshot, so this
      # check is hermetic: it fails only when a pull request leaves pkg/api out
      # of sync with the snapshot it was generated from. It deliberately does
      # not compare against the live upstream spec -- doing so made unrelated
      # pull requests fail together whenever staging drifted ahead of the
      # committed snapshot. That drift is the API Sync workflow's job.
      - run: go generate
      - run: |
          if ! git diff --ignore-space-at-eol --exit-code --quiet pkg; then
            echo "Detected uncommitted changes after codegen. See status below:"
            git diff
            exit 1
          fi
defaults:
  run:
    working-directory: apps/cli-go