coldfront/.github/workflows/ci.yml at main · pgEdge/coldfront · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
name: CI

# ColdFront CI — runs the SAME harness as run-ci-local.sh (ci/matrix.sh); the
# steps never diverge from local. Two jobs:
#
#   quick — every push + PR. ci/matrix.sh --quick = preflight (gofmt/vet/lint/
#           unit tests/build) + ONE hermetic cell (PG18 · vanilla · tiered ·
#           primary · s3) on SeaweedFS + the pg_regress unit layer. No cloud
#           creds, no real cloud calls. This is the fast gate and is exactly
#           what run-ci-local.sh runs.
#
#   full  — nightly + on-demand (workflow_dispatch). ci/matrix.sh --full across
#           PG{16,17,18} (fanned over parallel runners via PG_ONLY) ×
#           {vanilla,mesh} × {tiered,decoupled} × {primary,standby}.
#
# GATING POLICY (identical here and locally, enforced by ci/matrix.sh
# backend_ready): the hermetic SeaweedFS-as-S3 backend ALWAYS runs — that is the
# default coverage. The real cloud stores — real AWS S3 (aws), Azure ADLS
# (azure), GCS (gcs) — run ONLY when their COLDFRONT_* credentials are present.
# They are wired here from repo secrets; a secret that is not configured arrives
# as an empty string, so backend_ready reports that backend PENDING and it never
# runs. A fork PR (no secret access) therefore exercises SeaweedFS-only.

on:
  push:
    branches: [main]   # branch work is gated via its PR; main covers merges + direct pushes
  pull_request:
  schedule:
    - cron: '0 3 * * *'   # nightly full matrix (UTC)
  workflow_dispatch:

permissions:
  contents: read
  packages: read   # pull the private coldfront-duckdb-base image the app builds FROM

jobs:
  quick:
    name: quick (preflight + hermetic s3 cell)
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    # Rapid pushes to the same ref cancel their superseded quick run (so we don't
    # burn runners cold-building DuckDB for commits that are already obsolete).
    concurrency:
      group: quick-${{ github.ref }}
      cancel-in-progress: true
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Install golangci-lint
        run: |
          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
            | sh -s -- -b "$(go env GOPATH)/bin" v2.12.2

      - name: Install mkdocs (for docs --strict preflight)
        run: pipx install mkdocs && pipx inject mkdocs mkdocs-material

      # SeaweedFS-only: --quick never touches a cloud STORAGE backend, so this job
      # gets no cloud storage credentials by design. It still logs in to GHCR —
      # only to PULL the coldfront-duckdb-base image the app builds FROM.
      - name: Log in to GHCR (pull base image)
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
      - name: ci/matrix.sh --quick
        run: ci/matrix.sh --quick

  full:
    name: full matrix (PG ${{ matrix.pg }})
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 350
    strategy:
      fail-fast: false
      matrix:
        pg: ['18', '17', '16']
    env:
      # Restrict the matrix drive loop to this runner's PG major (fan-out).
      PG_ONLY: ${{ matrix.pg }}
      # Cloud creds from repo secrets. Each is EMPTY when the secret is not
      # configured ⇒ ci/matrix.sh backend_ready() marks that backend PENDING and
      # it does not run. With all three sets absent, only SeaweedFS-as-S3 runs.
      COLDFRONT_AWS_ACCESS_KEY: ${{ secrets.COLDFRONT_AWS_ACCESS_KEY }}
      COLDFRONT_AWS_SECRET_KEY: ${{ secrets.COLDFRONT_AWS_SECRET_KEY }}
      COLDFRONT_AWS_BUCKET: ${{ secrets.COLDFRONT_AWS_BUCKET }}
      COLDFRONT_AWS_REGION: ${{ secrets.COLDFRONT_AWS_REGION }}
      COLDFRONT_AZURE_ACCOUNT: ${{ secrets.COLDFRONT_AZURE_ACCOUNT }}
      COLDFRONT_AZURE_FILESYSTEM: ${{ secrets.COLDFRONT_AZURE_FILESYSTEM }}
      COLDFRONT_AZURE_KEY: ${{ secrets.COLDFRONT_AZURE_KEY }}
      COLDFRONT_AZURE_CONNECTION_STRING: ${{ secrets.COLDFRONT_AZURE_CONNECTION_STRING }}
      COLDFRONT_GCS_ACCESS_KEY: ${{ secrets.COLDFRONT_GCS_ACCESS_KEY }}
      COLDFRONT_GCS_SECRET_KEY: ${{ secrets.COLDFRONT_GCS_SECRET_KEY }}
      COLDFRONT_GCS_BUCKET: ${{ secrets.COLDFRONT_GCS_BUCKET }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Install golangci-lint
        run: |
          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
            | sh -s -- -b "$(go env GOPATH)/bin" v2.12.2

      - name: Install mkdocs (for docs --strict preflight)
        run: pipx install mkdocs && pipx inject mkdocs mkdocs-material

      - name: Log in to GHCR (pull base image)
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
      - name: ci/matrix.sh --full
        run: ci/matrix.sh --full

  secret-scan:
    name: secret scan (gitleaks)
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0   # full history so gitleaks scans every commit
      # Run gitleaks via its container — the gitleaks-ACTION is license-gated for
      # org accounts; the binary/container is not.
      - name: gitleaks (scan committed history)
        run: |
          docker run --rm -v "${{ github.workspace }}:/repo" \
            ghcr.io/gitleaks/gitleaks:v8.30.1 git /repo --redact --no-banner

  license-check:
    name: license check (go-licenses)
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true
      - name: go-licenses check (no forbidden licenses in Go deps)
        run: |
          go install github.com/google/go-licenses@latest
          "$(go env GOPATH)/bin/go-licenses" check ./cmd/... ./internal/... \
            --ignore github.com/pgedge/coldfront