mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-08 17:56:14 -10:00
HazyLabandcl-ment
3063593129
* ci: harden workflow permissions, add timeouts, concurrency and coverage report * ci: reuse make fmt-check and refine coverage table formatting * ci: scan Windows build graph via vulncheck-windows and collapse coverage summary to single-pass awk * ci: invoke the pinned Windows govulncheck via a local GOBIN go install writes the binary to GOBIN, which is not necessarily on PATH. Install into .cache/gobin and run that executable. GOOS=windows applies only to the scan so the scanner stays a host binary. * ci: declare contents:read on the action smoke workflow Pull-request workflows inherit the default GITHUB_TOKEN unless they set an explicit permission block. The smoke workflow is now covered by the same least-privilege policy as ci.yml. * ci: parse workflow permissions structurally and quote the Windows scanner path The pull-request token check now ignores commented lookalikes and accepts an inline on: [pull_request] trigger. vulncheck-windows keeps the cache path as one shell word. * ci: drop -race from this PR so issue 939 stays with PR 940 Coverage profile remains. The dedicated race-detector job is owned by the open race PR. * ci: parse workflow permissions as YAML and scope GOWORK=off * ci: label the non-race smoke test explicitly --------- Co-authored-by: cl-ment <[email protected]>
87 lines
3.1 KiB
Makefile
87 lines
3.1 KiB
Makefile
# Zero build/test/lint targets. AGENTS.md says to build and run quality checks
|
|
# with `make` — these targets back those instructions.
|
|
.DEFAULT_GOAL := build
|
|
GO_VERSION = $(word 2,$(shell git grep -G -h "^go[[:space:]]" -- go.mod))
|
|
GO_TOOLCHAIN = go$(GO_VERSION)
|
|
DEADCODE_VERSION := v0.46.0
|
|
GOLANGCI_LINT_VERSION := v2.12.2
|
|
GOVULNCHECK_VERSION := v1.3.0
|
|
|
|
.PHONY: build build-all test test-race vet fmt fmt-check lint lint-static deadcode vulncheck vulncheck-windows tidy clean baseline help
|
|
|
|
# Build the main CLI binary into ./zero.
|
|
build:
|
|
go build -o zero ./cmd/zero
|
|
|
|
# Build every command in cmd/.
|
|
build-all:
|
|
go build ./...
|
|
|
|
# Run the full test suite with the race detector (matches CI expectations).
|
|
test:
|
|
go test ./... -race -count=1
|
|
|
|
# Faster, no race detector.
|
|
test-quick:
|
|
go test ./...
|
|
|
|
vet:
|
|
go vet ./...
|
|
|
|
fmt:
|
|
gofmt -w $(shell git ls-files '*.go')
|
|
|
|
# Fail if any tracked Go file is not gofmt-clean.
|
|
fmt-check:
|
|
@out="$$(gofmt -l $$(git ls-files '*.go'))"; \
|
|
if [ -n "$$out" ]; then echo "gofmt needed:"; echo "$$out"; exit 1; fi
|
|
|
|
# Lint = formatting check + vet (no extra tooling required).
|
|
lint: fmt-check vet
|
|
|
|
# Versioned tools select the toolchain from their own modules when invoked with
|
|
# package@version. Read this module's go directive directly, without invoking
|
|
# the possibly stale Go toolchain or consulting a multi-module GOWORK. git grep
|
|
# works with both POSIX shells and cmd.exe, including GNU Make 3.81 on macOS.
|
|
# The target-specific export is shell-independent.
|
|
lint-static deadcode vulncheck vulncheck-windows: export GOTOOLCHAIN = $(GO_TOOLCHAIN)
|
|
lint-static deadcode vulncheck vulncheck-windows: export GOWORK = off
|
|
|
|
lint-static:
|
|
go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) run --enable-only unused,ineffassign,staticcheck ./...
|
|
|
|
deadcode:
|
|
go run golang.org/x/tools/cmd/deadcode@$(DEADCODE_VERSION) -test=false ./...
|
|
|
|
vulncheck:
|
|
go run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) ./...
|
|
|
|
vulncheck-windows:
|
|
mkdir -p "$(CURDIR)/.cache/gobin"
|
|
GOBIN="$(CURDIR)/.cache/gobin" go install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
|
|
GOOS=windows "$(CURDIR)/.cache/gobin/govulncheck" ./...
|
|
|
|
tidy:
|
|
go mod tidy
|
|
|
|
clean:
|
|
rm -f zero
|
|
go clean ./...
|
|
|
|
# Run the per-turn benchmark harness over the checked-in baseline manifest and
|
|
# write the JSON result to internal/perfbench/reports/baseline.json. Requires a
|
|
# built `zero` binary and a model; set ZERO_BENCH_MODEL (required) and
|
|
# ZERO_BENCH_BINARY (defaults to ./zero) to configure the run. The report is
|
|
# machine-specific and regenerated, not hand-edited.
|
|
baseline: build
|
|
@if [ -z "$(ZERO_BENCH_MODEL)" ]; then echo "Set ZERO_BENCH_MODEL (and optionally ZERO_BENCH_BINARY) before running 'make baseline'"; exit 2; fi
|
|
@ZERO_BIN="$${ZERO_BENCH_BINARY:-./zero}"; \
|
|
go run ./cmd/zero-perf-bench turn \
|
|
--suite internal/perfbench/manifests/baseline.json \
|
|
--model $(ZERO_BENCH_MODEL) \
|
|
--binary "$$ZERO_BIN" \
|
|
--output internal/perfbench/reports/baseline.json
|
|
|
|
help:
|
|
@echo "Targets: build (default), build-all, test, test-quick, vet, fmt, fmt-check, lint, lint-static, deadcode, vulncheck, vulncheck-windows, tidy, clean, baseline"
|