chore: update CI workflows and SonarCloud configuration for improved analysis and coverage reporting
- Unified CI workflow with fail-fast behavior, streamlining stages for formatting, linting, testing, and SonarCloud analysis. - Enhanced SonarCloud configuration to exclude test files and improve security hotspot analysis. - Removed outdated coverage and lint workflows, consolidating functionality into the main CI pipeline. - Updated README to reflect changes in CI structure and added details on workflow stages and requirements.
This commit is contained in:
0x524a
+94
-38
@@ -4,20 +4,40 @@ This directory contains all CI/CD workflows for the ONVIF Go library.
|
||||
|
||||
## Workflows
|
||||
|
||||
### 🔄 CI (`ci.yml`)
|
||||
Main continuous integration workflow that runs on every push and pull request.
|
||||
### 🔄 CI (`ci.yml`) - Main Pipeline
|
||||
**Unified continuous integration workflow with fail-fast behavior.**
|
||||
|
||||
**Jobs:**
|
||||
- **validate** - Quick validation (formatting, vet, lint)
|
||||
- **test** - Run tests with coverage on Go 1.23
|
||||
- **test-matrix** - Test on multiple Go versions (1.21, 1.22, 1.23) and platforms (Linux, macOS, Windows)
|
||||
- **build** - Build verification for all packages and examples
|
||||
- **sonarcloud** - Code quality analysis (runs on master/main only)
|
||||
The CI pipeline runs sequentially - if any stage fails, subsequent stages are skipped:
|
||||
|
||||
```
|
||||
fmt → lint → test → sonarcloud
|
||||
↘ build
|
||||
```
|
||||
|
||||
**Stages:**
|
||||
|
||||
| Stage | Description | Depends On |
|
||||
|-------|-------------|------------|
|
||||
| **fmt** | Format check using `gofmt -s` | - |
|
||||
| **lint** | Static analysis with `go vet` and `golangci-lint` | fmt |
|
||||
| **test** | Unit tests with race detector + coverage | lint |
|
||||
| **sonarcloud** | Code quality & security analysis | test |
|
||||
| **build** | Build verification for all packages | test |
|
||||
| **ci-success** | Final status check | all |
|
||||
|
||||
**Features:**
|
||||
- ✅ Fail-fast: stops immediately if any check fails
|
||||
- ✅ Codecov integration for coverage reporting
|
||||
- ✅ SonarCloud integration for code quality
|
||||
- ✅ Go module caching for faster builds
|
||||
- ✅ Concurrency control (cancels in-progress runs)
|
||||
|
||||
**Triggers:**
|
||||
- Push to `master`, `main`, `develop`
|
||||
- Pull requests to `master`, `main`, `develop`
|
||||
|
||||
---
|
||||
|
||||
### 🧪 Extended Tests (`test.yml`)
|
||||
Extended testing workflow for comprehensive test coverage.
|
||||
|
||||
@@ -31,14 +51,7 @@ Extended testing workflow for comprehensive test coverage.
|
||||
- Weekly schedule (Sunday 2 AM UTC)
|
||||
- Push to `master`/`main` when Go files change
|
||||
|
||||
### 📊 Coverage Analysis (`coverage.yml`)
|
||||
Post-CI coverage analysis and reporting.
|
||||
|
||||
**Jobs:**
|
||||
- **coverage-analysis** - Detailed coverage analysis with package breakdown
|
||||
|
||||
**Triggers:**
|
||||
- After successful CI workflow on `master`/`main`
|
||||
---
|
||||
|
||||
### 🚀 Release (`release.yml`)
|
||||
Automated release workflow for creating GitHub releases.
|
||||
@@ -52,12 +65,7 @@ Automated release workflow for creating GitHub releases.
|
||||
- Push tags matching `v*.*.*`
|
||||
- Manual dispatch with version input
|
||||
|
||||
### 🔍 Lint (`lint.yml`)
|
||||
Dedicated linting workflow.
|
||||
|
||||
**Triggers:**
|
||||
- Push to `master`, `main`, `develop`
|
||||
- Pull requests
|
||||
---
|
||||
|
||||
### 🔒 Security (`security.yml`)
|
||||
Security scanning workflow.
|
||||
@@ -71,6 +79,8 @@ Security scanning workflow.
|
||||
- Pull requests
|
||||
- Weekly schedule
|
||||
|
||||
---
|
||||
|
||||
### 📚 Documentation (`docs.yml`)
|
||||
Documentation validation workflow.
|
||||
|
||||
@@ -78,32 +88,78 @@ Documentation validation workflow.
|
||||
- Push to `master`/`main` when docs change
|
||||
- Manual dispatch
|
||||
|
||||
---
|
||||
|
||||
### 🔐 Dependency Review (`dependency-review.yml`)
|
||||
Dependency vulnerability review.
|
||||
|
||||
**Triggers:**
|
||||
- Pull requests
|
||||
|
||||
## Workflow Status
|
||||
---
|
||||
|
||||
All workflows use:
|
||||
- ✅ Latest action versions
|
||||
- ✅ Go 1.23 as primary version
|
||||
- ✅ Caching for faster builds
|
||||
- ✅ Matrix builds for multiple platforms
|
||||
- ✅ Artifact uploads for coverage and releases
|
||||
## CI Pipeline Flow
|
||||
|
||||
## Required Secrets
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────────────┐
|
||||
│ CI PIPELINE │
|
||||
├─────────────────────────────────────────────────────────────────┤
|
||||
│ │
|
||||
│ ┌─────────┐ ┌─────────┐ ┌─────────────────────────┐ │
|
||||
│ │ FMT │────▶│ LINT │────▶│ TEST + COVERAGE │ │
|
||||
│ └─────────┘ └─────────┘ └───────────┬─────────────┘ │
|
||||
│ │ │
|
||||
│ ┌─────────┴─────────┐ │
|
||||
│ ▼ ▼ │
|
||||
│ ┌────────────┐ ┌───────────┐ │
|
||||
│ │ SONARCLOUD │ │ BUILD │ │
|
||||
│ └────────────┘ └───────────┘ │
|
||||
│ │ │ │
|
||||
│ └─────────┬─────────┘ │
|
||||
│ ▼ │
|
||||
│ ┌─────────────────┐ │
|
||||
│ │ CI SUCCESS │ │
|
||||
│ └─────────────────┘ │
|
||||
│ │
|
||||
└─────────────────────────────────────────────────────────────────┘
|
||||
|
||||
- `CODECOV_TOKEN` - For coverage reporting (optional)
|
||||
- `SONAR_TOKEN` - For SonarCloud analysis (optional)
|
||||
- `DOCKERHUB_USERNAME` / `DOCKERHUB_TOKEN` - For Docker Hub (optional)
|
||||
|
||||
## Concurrency
|
||||
|
||||
Workflows use concurrency groups to cancel in-progress runs when new commits are pushed, saving CI resources.
|
||||
❌ If any stage fails, the pipeline stops immediately (fail-fast)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
*Last Updated: December 2, 2025*
|
||||
## SonarCloud Configuration
|
||||
|
||||
Security Hotspot analysis excludes:
|
||||
- Test files (`**/*_test.go`)
|
||||
- CI configuration (`**/.github/**`)
|
||||
- Test utilities (`**/testing/**`, `**/testdata/**`)
|
||||
- Example code (`**/examples/**`)
|
||||
- CLI tools (`**/cmd/**`)
|
||||
|
||||
This ensures security analysis focuses on production library code.
|
||||
|
||||
---
|
||||
|
||||
## Required Secrets
|
||||
|
||||
| Secret | Required | Description |
|
||||
|--------|----------|-------------|
|
||||
| `CODECOV_TOKEN` | Yes | Coverage reporting to Codecov |
|
||||
| `SONAR_TOKEN` | Yes | SonarCloud code analysis |
|
||||
| `DOCKERHUB_USERNAME` | No | Docker Hub releases |
|
||||
| `DOCKERHUB_TOKEN` | No | Docker Hub releases |
|
||||
|
||||
---
|
||||
|
||||
## Workflow Status
|
||||
|
||||
- ✅ Go 1.24 as primary version
|
||||
- ✅ Unified fail-fast CI pipeline
|
||||
- ✅ Go module caching for faster builds
|
||||
- ✅ Artifact uploads for coverage and releases
|
||||
- ✅ Concurrency control
|
||||
|
||||
---
|
||||
|
||||
*Last Updated: December 3, 2025*
|
||||
|
||||
+216
-197
@@ -2,9 +2,9 @@ name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ master, main, develop ]
|
||||
branches: [master, main, develop]
|
||||
pull_request:
|
||||
branches: [ master, main, develop ]
|
||||
branches: [master, main, develop]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
@@ -15,213 +15,232 @@ concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
GO_VERSION: '1.24'
|
||||
|
||||
jobs:
|
||||
# Quick validation - fail fast on obvious issues
|
||||
validate:
|
||||
name: Quick Validation
|
||||
# Stage 1: Format Check (fastest - fail immediately if code isn't formatted)
|
||||
fmt:
|
||||
name: Format Check
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '1.24'
|
||||
|
||||
- name: Cache Go modules
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cache/go-build
|
||||
~/go/pkg/mod
|
||||
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-go-
|
||||
|
||||
- name: Download dependencies
|
||||
run: go mod download && go mod verify
|
||||
|
||||
- name: Check formatting
|
||||
run: |
|
||||
if [ "$(gofmt -s -l . | grep -v vendor | wc -l)" -gt 0 ]; then
|
||||
echo "❌ Code formatting issues found:"
|
||||
gofmt -s -d . | grep -v vendor
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Code formatting is correct"
|
||||
|
||||
- name: Run go vet
|
||||
run: go vet ./...
|
||||
|
||||
- name: Lint with golangci-lint
|
||||
uses: golangci/golangci-lint-action@v6
|
||||
with:
|
||||
version: latest
|
||||
args: --timeout=5m
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# Test on primary Go version with coverage
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
|
||||
- name: Check formatting
|
||||
run: |
|
||||
unformatted=$(gofmt -s -l . | grep -v vendor || true)
|
||||
if [ -n "$unformatted" ]; then
|
||||
echo "❌ The following files are not properly formatted:"
|
||||
echo "$unformatted"
|
||||
echo ""
|
||||
echo "Run 'gofmt -s -w .' to fix formatting issues"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ All files are properly formatted"
|
||||
|
||||
# Stage 2: Lint (depends on fmt)
|
||||
lint:
|
||||
name: Lint
|
||||
runs-on: ubuntu-latest
|
||||
needs: fmt
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
|
||||
- name: Cache Go modules
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cache/go-build
|
||||
~/go/pkg/mod
|
||||
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-go-${{ env.GO_VERSION }}-
|
||||
|
||||
- name: Download dependencies
|
||||
run: go mod download
|
||||
|
||||
- name: Run go vet
|
||||
run: go vet ./...
|
||||
|
||||
- name: Run golangci-lint
|
||||
uses: golangci/golangci-lint-action@v6
|
||||
with:
|
||||
version: latest
|
||||
args: --timeout=5m --out-format=github-actions
|
||||
|
||||
# Stage 3: Test with Coverage (depends on lint)
|
||||
test:
|
||||
name: Test (Go 1.23)
|
||||
name: Test & Coverage
|
||||
runs-on: ubuntu-latest
|
||||
needs: validate
|
||||
|
||||
needs: lint
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '1.24'
|
||||
|
||||
- name: Cache Go modules
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cache/go-build
|
||||
~/go/pkg/mod
|
||||
key: ${{ runner.os }}-go-1.24-${{ hashFiles('**/go.sum') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-go-1.24-
|
||||
|
||||
- name: Download dependencies
|
||||
run: go mod download
|
||||
|
||||
- name: Run tests with coverage
|
||||
run: go test -v -race -covermode=atomic -coverprofile=coverage.out ./...
|
||||
|
||||
- name: Generate coverage report
|
||||
run: go tool cover -html=coverage.out -o coverage.html
|
||||
|
||||
- name: Upload coverage to Codecov
|
||||
uses: codecov/codecov-action@v4
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
files: ./coverage.out
|
||||
flags: unittests
|
||||
name: codecov-umbrella
|
||||
fail_ci_if_error: false
|
||||
|
||||
- name: Archive coverage
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: coverage-report
|
||||
path: |
|
||||
coverage.out
|
||||
coverage.html
|
||||
retention-days: 30
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0 # Full history for SonarCloud
|
||||
|
||||
# Test on multiple Go versions and platforms
|
||||
test-matrix:
|
||||
name: Test (Go ${{ matrix.go-version }} on ${{ matrix.os }})
|
||||
runs-on: ${{ matrix.os }}
|
||||
needs: validate
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os: [ubuntu-latest, macos-latest, windows-latest]
|
||||
go-version: ['1.24']
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
|
||||
- name: Cache Go modules
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cache/go-build
|
||||
~/go/pkg/mod
|
||||
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-go-${{ env.GO_VERSION }}-
|
||||
|
||||
- name: Download dependencies
|
||||
run: go mod download
|
||||
|
||||
- name: Run tests with coverage
|
||||
run: |
|
||||
go test -v -race -covermode=atomic -coverprofile=coverage.out -json ./... > test-report.json 2>&1 || true
|
||||
# Ensure coverage file exists even if tests fail
|
||||
if [ ! -f coverage.out ]; then
|
||||
echo "mode: atomic" > coverage.out
|
||||
fi
|
||||
|
||||
- name: Display coverage summary
|
||||
run: |
|
||||
echo "📊 Coverage Summary:"
|
||||
go tool cover -func=coverage.out | tail -20
|
||||
|
||||
- name: Upload coverage artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: coverage-reports
|
||||
path: |
|
||||
coverage.out
|
||||
test-report.json
|
||||
retention-days: 7
|
||||
|
||||
- name: Upload to Codecov
|
||||
uses: codecov/codecov-action@v4
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
files: ./coverage.out
|
||||
flags: unittests
|
||||
name: codecov-onvif-go
|
||||
fail_ci_if_error: true
|
||||
verbose: true
|
||||
|
||||
# Stage 4: SonarCloud Analysis (depends on test)
|
||||
sonarcloud:
|
||||
name: SonarCloud Analysis
|
||||
runs-on: ubuntu-latest
|
||||
needs: test
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: ${{ matrix.go-version }}
|
||||
|
||||
- name: Cache Go modules
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cache/go-build
|
||||
~/go/pkg/mod
|
||||
key: ${{ runner.os }}-go-${{ matrix.go-version }}-${{ hashFiles('**/go.sum') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-go-${{ matrix.go-version }}-
|
||||
|
||||
- name: Download dependencies
|
||||
run: go mod download
|
||||
|
||||
- name: Run tests
|
||||
run: go test -v -race ./...
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0 # Full history for accurate blame information
|
||||
|
||||
# Build verification
|
||||
- name: Download coverage reports
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: coverage-reports
|
||||
|
||||
- name: Verify coverage file
|
||||
run: |
|
||||
echo "📁 Downloaded files:"
|
||||
ls -la
|
||||
if [ -f coverage.out ]; then
|
||||
echo "✅ Coverage file found"
|
||||
head -5 coverage.out
|
||||
else
|
||||
echo "⚠️ Coverage file not found, creating empty one"
|
||||
echo "mode: atomic" > coverage.out
|
||||
fi
|
||||
|
||||
- name: SonarCloud Scan
|
||||
uses: SonarSource/sonarcloud-github-action@master
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
||||
|
||||
# Stage 5: Build Verification (depends on test, runs in parallel with sonarcloud)
|
||||
build:
|
||||
name: Build Verification
|
||||
runs-on: ubuntu-latest
|
||||
needs: validate
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '1.24'
|
||||
|
||||
- name: Cache Go modules
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cache/go-build
|
||||
~/go/pkg/mod
|
||||
key: ${{ runner.os }}-go-1.24-${{ hashFiles('**/go.sum') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-go-1.24-
|
||||
|
||||
- name: Download dependencies
|
||||
run: go mod download
|
||||
|
||||
- name: Build main packages
|
||||
run: go build -v ./...
|
||||
|
||||
- name: Build examples
|
||||
run: |
|
||||
for dir in examples/*/; do
|
||||
if [ -f "$dir/main.go" ] || [ -f "$dir/*.go" ]; then
|
||||
echo "Building $dir"
|
||||
(cd "$dir" && go build -v .) || echo "⚠️ Failed to build $dir"
|
||||
fi
|
||||
done
|
||||
|
||||
- name: Build CLI tools
|
||||
run: |
|
||||
go build -v ./cmd/onvif-cli
|
||||
go build -v ./cmd/onvif-quick
|
||||
go build -v ./cmd/onvif-server
|
||||
go build -v ./cmd/onvif-diagnostics
|
||||
|
||||
# Code quality - only run if tests pass
|
||||
sonarcloud:
|
||||
name: Code Quality (SonarCloud)
|
||||
runs-on: ubuntu-latest
|
||||
needs: test
|
||||
if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main') && secrets.SONAR_TOKEN != ''
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Download coverage from test job
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: coverage-report
|
||||
|
||||
- name: SonarCloud Scan
|
||||
uses: SonarSource/sonarcloud-github-action@master
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
||||
with:
|
||||
args: >
|
||||
-Dsonar.projectKey=0x524a_onvif-go
|
||||
-Dsonar.organization=0x524a
|
||||
-Dsonar.go.coverage.reportPaths=coverage.out
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
|
||||
- name: Cache Go modules
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cache/go-build
|
||||
~/go/pkg/mod
|
||||
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-go-${{ env.GO_VERSION }}-
|
||||
|
||||
- name: Download dependencies
|
||||
run: go mod download
|
||||
|
||||
- name: Build library
|
||||
run: go build -v ./...
|
||||
|
||||
- name: Build CLI tools
|
||||
run: |
|
||||
echo "🔨 Building CLI tools..."
|
||||
go build -v -o bin/onvif-cli ./cmd/onvif-cli
|
||||
go build -v -o bin/onvif-quick ./cmd/onvif-quick
|
||||
go build -v -o bin/onvif-server ./cmd/onvif-server
|
||||
go build -v -o bin/onvif-diagnostics ./cmd/onvif-diagnostics
|
||||
echo "✅ All CLI tools built successfully"
|
||||
|
||||
# Final status check
|
||||
ci-success:
|
||||
name: CI Success
|
||||
runs-on: ubuntu-latest
|
||||
needs: [fmt, lint, test, sonarcloud, build]
|
||||
if: always()
|
||||
steps:
|
||||
- name: Check all jobs status
|
||||
run: |
|
||||
if [[ "${{ needs.fmt.result }}" != "success" ]]; then
|
||||
echo "❌ Format check failed"
|
||||
exit 1
|
||||
fi
|
||||
if [[ "${{ needs.lint.result }}" != "success" ]]; then
|
||||
echo "❌ Lint check failed"
|
||||
exit 1
|
||||
fi
|
||||
if [[ "${{ needs.test.result }}" != "success" ]]; then
|
||||
echo "❌ Tests failed"
|
||||
exit 1
|
||||
fi
|
||||
if [[ "${{ needs.sonarcloud.result }}" != "success" ]]; then
|
||||
echo "❌ SonarCloud analysis failed"
|
||||
exit 1
|
||||
fi
|
||||
if [[ "${{ needs.build.result }}" != "success" ]]; then
|
||||
echo "❌ Build verification failed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ All CI checks passed successfully!"
|
||||
|
||||
@@ -1,71 +0,0 @@
|
||||
name: Coverage Analysis
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: [CI]
|
||||
types: [completed]
|
||||
branches: [master, main]
|
||||
|
||||
jobs:
|
||||
# Generate additional coverage analysis if CI passed
|
||||
coverage-analysis:
|
||||
name: Coverage Analysis
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event.workflow_run.conclusion == 'success'
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '1.24'
|
||||
|
||||
- name: Download coverage artifacts
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: coverage-report
|
||||
run-id: ${{ github.event.workflow_run.id }}
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Check coverage percentage
|
||||
id: coverage
|
||||
run: |
|
||||
if [ -f coverage.out ]; then
|
||||
echo "📊 Coverage Report:"
|
||||
go tool cover -func=coverage.out | tail -1
|
||||
|
||||
coverage=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
|
||||
echo "Total Coverage: ${coverage}%"
|
||||
echo "percentage=${coverage}" >> $GITHUB_OUTPUT
|
||||
|
||||
# Set threshold to 50%
|
||||
threshold=50
|
||||
if (( $(echo "$coverage < $threshold" | bc -l) )); then
|
||||
echo "⚠️ Coverage below ${threshold}% threshold: ${coverage}%"
|
||||
echo "::warning::Coverage is below ${threshold}% threshold"
|
||||
else
|
||||
echo "✅ Coverage above ${threshold}% threshold: ${coverage}%"
|
||||
fi
|
||||
|
||||
# Generate detailed coverage by package
|
||||
echo ""
|
||||
echo "📦 Coverage by Package:"
|
||||
go tool cover -func=coverage.out | grep -E "^github.com" | sort -k3 -nr | head -20
|
||||
else
|
||||
echo "❌ Coverage file not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Comment PR with coverage
|
||||
if: github.event.workflow_run.event == 'pull_request'
|
||||
uses: marocchino/sticky-pull-request-comment@v2
|
||||
with:
|
||||
recreate: true
|
||||
message: |
|
||||
## 📊 Coverage Report
|
||||
|
||||
Total Coverage: **${{ steps.coverage.outputs.percentage }}%**
|
||||
|
||||
[View detailed coverage report](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }})
|
||||
@@ -1,31 +0,0 @@
|
||||
name: Lint
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ master, main, develop ]
|
||||
pull_request:
|
||||
branches: [ master, main, develop ]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
golangci-lint:
|
||||
name: Lint
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '1.24'
|
||||
|
||||
- name: Run golangci-lint
|
||||
uses: golangci/golangci-lint-action@v6
|
||||
with:
|
||||
version: latest
|
||||
args: --timeout=5m --out-format=github-actions
|
||||
|
||||
@@ -7,7 +7,7 @@ sonar.projectVersion=1.0.0
|
||||
|
||||
# Source code location
|
||||
sonar.sources=.
|
||||
sonar.exclusions=**/vendor/**,**/*_test.go,**/examples/**,**/cmd/**,**/server/**,**/testing/**
|
||||
sonar.exclusions=**/vendor/**,**/*_test.go,**/examples/**,**/cmd/**,**/testdata/**,**/testing/**
|
||||
|
||||
# Test settings
|
||||
sonar.tests=.
|
||||
@@ -15,15 +15,32 @@ sonar.test.inclusions=**/*_test.go
|
||||
sonar.test.exclusions=**/vendor/**
|
||||
|
||||
# Go specific settings
|
||||
sonar.language=go
|
||||
sonar.go.coverage.reportPaths=coverage.out
|
||||
sonar.go.tests.reportPaths=test-report.json
|
||||
|
||||
# Source encoding
|
||||
sonar.sourceEncoding=UTF-8
|
||||
|
||||
# Coverage exclusions
|
||||
sonar.coverage.exclusions=**/cmd/**,**/examples/**,**/server/**,**/testing/**,**/*_test.go
|
||||
# Coverage exclusions - exclude non-production code from coverage metrics
|
||||
sonar.coverage.exclusions=**/cmd/**,**/examples/**,**/server/**,**/testing/**,**/testdata/**,**/*_test.go
|
||||
|
||||
# Duplications
|
||||
sonar.cpd.exclusions=**/*_test.go
|
||||
# Duplications exclusions
|
||||
sonar.cpd.exclusions=**/*_test.go,**/testdata/**
|
||||
|
||||
# Security Hotspot exclusions - skip test files and CI configuration
|
||||
# These files don't represent production security concerns
|
||||
sonar.security.hotspots.exclusions=**/*_test.go,**/testing/**,**/testdata/**,**/.github/**,**/examples/**,**/cmd/**
|
||||
|
||||
# Issue exclusions for specific rules in test files
|
||||
sonar.issue.ignore.multicriteria=e1,e2,e3
|
||||
|
||||
# Ignore security issues in test files
|
||||
sonar.issue.ignore.multicriteria.e1.ruleKey=go:S5042
|
||||
sonar.issue.ignore.multicriteria.e1.resourceKey=**/*_test.go
|
||||
|
||||
# Ignore hardcoded credentials in test/example files (test credentials are expected)
|
||||
sonar.issue.ignore.multicriteria.e2.ruleKey=go:S6418
|
||||
sonar.issue.ignore.multicriteria.e2.resourceKey=**/*_test.go
|
||||
|
||||
sonar.issue.ignore.multicriteria.e3.ruleKey=go:S6418
|
||||
sonar.issue.ignore.multicriteria.e3.resourceKey=**/examples/**
|
||||
|
||||
Reference in New Issue
Block a user