Skip to content

Commit 0296680

Browse files
authored
sync: update 16 files from source repository (#31)
1 parent 357ba58 commit 0296680

16 files changed

+223
-134
lines changed

.github/.env.base

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ REDIS_CACHE_FORCE_PULL=false # Force pull Redis images even when cache
235235
# 🪄 MAGE-X CONFIGURATION
236236
# ================================================================================================
237237

238-
MAGE_X_VERSION=v1.18.1 # https://github.com/mrz1836/mage-x/releases
238+
MAGE_X_VERSION=v1.18.7 # https://github.com/mrz1836/mage-x/releases
239239
MAGE_X_USE_LOCAL=false # Use local version for development
240240
MAGE_X_CI_SKIP_STEP_SUMMARY=true # Skip duplicate test results in step summary (already in test validation summary)
241241
MAGE_X_AUTO_DISCOVER_BUILD_TAGS=true # Enable auto-discovery of build tags
@@ -249,7 +249,7 @@ MAGE_X_GOVULNCHECK_VERSION=v1.1.4 # https://go.googl
249249
MAGE_X_GO_SECONDARY_VERSION=1.24.x # Secondary Go version for MAGE-X (also our secondary)
250250
MAGE_X_GO_VERSION=1.24.x # Primary Go version for MAGE-X (also our primary)
251251
MAGE_X_MOCKGEN_VERSION=v0.6.0 # https://github.com/uber-go/mock/releases
252-
MAGE_X_NANCY_VERSION=v1.0.52 # https://github.com/sonatype-nexus-community/nancy/releases
252+
MAGE_X_NANCY_VERSION=v1.2.0 # https://github.com/sonatype-nexus-community/nancy/releases
253253
MAGE_X_STATICCHECK_VERSION=2025.1.1 # https://github.com/dominikh/go-tools/releases
254254
MAGE_X_SWAG_VERSION=v1.16.6 # https://github.com/swaggo/swag/releases
255255
MAGE_X_YAMLFMT_VERSION=v0.21.0 # https://github.com/google/yamlfmt/releases
@@ -309,14 +309,14 @@ MAGE_X_CVE_EXCLUDES=CVE-9999-12345,CVE-9999-43210
309309
# Security Tools
310310
GITLEAKS_VERSION=8.30.0 # https://github.com/gitleaks/gitleaks/releases
311311
GOVULNCHECK_VERSION=v1.1.4 # https://pkg.go.dev/golang.org/x/vuln
312-
NANCY_VERSION=v1.0.52 # https://github.com/sonatype-nexus-community/nancy/releases
312+
NANCY_VERSION=v1.2.0 # https://github.com/sonatype-nexus-community/nancy/releases
313313

314314
# ================================================================================================
315315
# 🪝 PRE-COMMIT SYSTEM CONFIGURATION (go-pre-commit)
316316
# ================================================================================================
317317

318318
# Pre-Commit System
319-
GO_PRE_COMMIT_VERSION=v1.5.1 # https://github.com/mrz1836/go-pre-commit/releases
319+
GO_PRE_COMMIT_VERSION=v1.5.2 # https://github.com/mrz1836/go-pre-commit/releases
320320
GO_PRE_COMMIT_USE_LOCAL=false # Use local version for development
321321

322322
# System Settings
@@ -516,3 +516,34 @@ GO_BROADCAST_AI_FAIL_ON_ERROR=false
516516

517517
# Diff Debugging
518518
# GO_BROADCAST_DEBUG_DIFF_PATH=/tmp/debug-diff.txt
519+
520+
# ================================================================================================
521+
# 🛡️ GUARDIAN CI TESTING FRAMEWORK
522+
# ================================================================================================
523+
524+
# Feature Toggle
525+
ENABLE_CI_GUARDIAN=false
526+
527+
# Tool Versions (pinned for reproducibility)
528+
GUARDIAN_ACT_VERSION=v0.2.84
529+
GUARDIAN_ACTIONLINT_VERSION=v1.7.10
530+
GUARDIAN_GO_SARIF_VERSION=v3.3.0
531+
532+
# Execution Settings
533+
GUARDIAN_SCENARIO_TIMEOUT=30s
534+
GUARDIAN_STATIC_TIMEOUT=5s
535+
GUARDIAN_PARALLEL_SCENARIOS=1
536+
537+
# Output Configuration
538+
GUARDIAN_OUTPUT_DIR=.mage-x
539+
GUARDIAN_SARIF_OUTPUT=guardian.sarif
540+
GUARDIAN_JSONL_OUTPUT=ci-results.jsonl
541+
542+
# Policy Configuration
543+
GUARDIAN_EXCEPTIONS_FILE=.github/guardian.yaml
544+
GUARDIAN_POLICY_STRICT=true
545+
546+
# Debug Settings
547+
GUARDIAN_VERBOSE=false
548+
GUARDIAN_DRY_RUN=false
549+
GUARDIAN_KEEP_CONTAINERS=false

.github/actions/cancel-workflow-on-failure/action.yml

Lines changed: 86 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
# ------------------------------------------------------------------------------------
22
# Cancel Workflow On Failure (Composite Action) (GoFortress)
33
#
4+
# NOTE: This action is currently NOT IN USE. It was disabled because GitHub's
5+
# cancel API overwrites the "failed" status with "cancelled" on the job that
6+
# triggered it, making it impossible to identify which job actually failed.
7+
#
8+
# The action is kept for potential future use in scenarios where the trade-off
9+
# (faster cancellation vs clear failure visibility) is acceptable.
10+
#
411
# Purpose: Provide a reusable action that cancels the entire workflow run when
512
# a critical job fails. This prevents wasting CI resources on parallel jobs
613
# that will ultimately be invalidated by an earlier failure.
@@ -58,6 +65,23 @@ inputs:
5865
description: "GitHub token with actions:write permission (defaults to GITHUB_TOKEN)"
5966
required: false
6067
default: ""
68+
# Failure context inputs for enhanced job summary
69+
failed-job:
70+
description: "Name of the job that failed (for prominent display)"
71+
required: false
72+
default: ""
73+
failed-step:
74+
description: "Name of the step that failed"
75+
required: false
76+
default: ""
77+
failure-tool:
78+
description: "Tool that detected the failure (e.g., 'go vet', 'golangci-lint')"
79+
required: false
80+
default: ""
81+
failure-summary:
82+
description: "Brief summary of what failed (e.g., '3 issues detected')"
83+
required: false
84+
default: ""
6185

6286
outputs:
6387
cancelled:
@@ -88,6 +112,11 @@ runs:
88112
GITHUB_JOB: ${{ github.job }}
89113
GITHUB_WORKFLOW: ${{ github.workflow }}
90114
GITHUB_API_URL: ${{ github.api_url }}
115+
# Failure context for enhanced job summary
116+
FAILED_JOB: ${{ inputs.failed-job }}
117+
FAILED_STEP: ${{ inputs.failed-step }}
118+
FAILURE_TOOL: ${{ inputs.failure-tool }}
119+
FAILURE_SUMMARY: ${{ inputs.failure-summary }}
91120
run: |
92121
# Note: Using set -uo pipefail (but not -e):
93122
# -e is avoided so we can handle errors (like curl failures and HTTP status codes) explicitly
@@ -261,19 +290,73 @@ runs:
261290
STATUS_CELL_VALUE="⚠️ HTTP $HTTP_STATUS"
262291
fi
263292
293+
# Derive summary heading from actual outcome
294+
if [[ "$HTTP_STATUS" == "202" ]]; then
295+
SUMMARY_HEADING="## 🚨 Workflow Cancelled: Critical Failure Detected"
296+
else
297+
SUMMARY_HEADING="## ⚠️ Cancellation Skipped: Critical Failure Detected"
298+
fi
299+
264300
# Add to job summary (always, regardless of success/failure)
301+
# Enhanced summary with prominent failure origin when context is provided
265302
{
266-
echo "## 🚨 Workflow Cancellation"
303+
echo "$SUMMARY_HEADING"
304+
echo ""
305+
306+
# Show prominent failure origin if context was provided
307+
if [[ -n "$FAILED_JOB" || -n "$FAILED_STEP" || -n "$FAILURE_TOOL" || -n "$FAILURE_SUMMARY" ]]; then
308+
echo "### ❌ Failure Origin"
309+
echo ""
310+
echo "| | |"
311+
echo "|---|---|"
312+
if [[ -n "$FAILED_JOB" ]]; then
313+
# Escape markdown special characters in FAILED_JOB
314+
FAILED_JOB_MD=$FAILED_JOB
315+
FAILED_JOB_MD=${FAILED_JOB_MD//\\/\\\\}
316+
FAILED_JOB_MD=${FAILED_JOB_MD//|/\\|}
317+
FAILED_JOB_MD=${FAILED_JOB_MD//\`/\\\`}
318+
echo "| **Job** | $FAILED_JOB_MD |"
319+
fi
320+
if [[ -n "$FAILED_STEP" ]]; then
321+
# Escape markdown special characters in FAILED_STEP
322+
FAILED_STEP_MD=$FAILED_STEP
323+
FAILED_STEP_MD=${FAILED_STEP_MD//\\/\\\\}
324+
FAILED_STEP_MD=${FAILED_STEP_MD//|/\\|}
325+
FAILED_STEP_MD=${FAILED_STEP_MD//\`/\\\`}
326+
echo "| **Step** | $FAILED_STEP_MD |"
327+
fi
328+
if [[ -n "$FAILURE_TOOL" ]]; then
329+
# Escape markdown special characters in FAILURE_TOOL
330+
FAILURE_TOOL_MD=$FAILURE_TOOL
331+
FAILURE_TOOL_MD=${FAILURE_TOOL_MD//\\/\\\\}
332+
FAILURE_TOOL_MD=${FAILURE_TOOL_MD//|/\\|}
333+
FAILURE_TOOL_MD=${FAILURE_TOOL_MD//\`/\\\`}
334+
echo "| **Tool** | $FAILURE_TOOL_MD |"
335+
fi
336+
if [[ -n "$FAILURE_SUMMARY" ]]; then
337+
# Escape markdown special characters in FAILURE_SUMMARY
338+
FAILURE_SUMMARY_MD=$FAILURE_SUMMARY
339+
FAILURE_SUMMARY_MD=${FAILURE_SUMMARY_MD//\\/\\\\}
340+
FAILURE_SUMMARY_MD=${FAILURE_SUMMARY_MD//|/\\|}
341+
FAILURE_SUMMARY_MD=${FAILURE_SUMMARY_MD//\`/\\\`}
342+
echo "| **Reason** | $FAILURE_SUMMARY_MD |"
343+
fi
344+
echo ""
345+
echo "---"
346+
echo ""
347+
fi
348+
349+
echo "### Workflow Cancellation Details"
267350
echo ""
268351
echo "| Detail | Value |"
269352
echo "|--------|-------|"
270-
echo "| **Reason** | $CANCEL_REASON_MD |"
271353
echo "| **Triggered by** | \`$GITHUB_JOB\` |"
272354
echo "| **Run ID** | $GITHUB_RUN_ID |"
273355
echo "| **Status** | $STATUS_CELL_VALUE |"
356+
echo "| **Cancellation reason** | $CANCEL_REASON_MD |"
274357
echo ""
275358
if [[ "$HTTP_STATUS" == "202" ]]; then
276-
echo "This cancellation was triggered to save CI resources after a critical failure."
359+
echo "> This cancellation was triggered to save CI resources. Other parallel jobs were stopped."
277360
elif [[ "$HTTP_STATUS" == "403" ]]; then
278361
echo "⚠️ **Permission Issue**: Add \`actions: write\` permission to enable cancellation."
279362
elif [[ "$HTTP_STATUS" == "409" ]]; then

.github/actions/setup-go-with-cache/action.yml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -206,11 +206,12 @@ runs:
206206
echo "🔑 Cache keys computed successfully"
207207
208208
# --------------------------------------------------------------------
209-
# Restore Go module cache (shared across versions)
209+
# Go module cache (shared across versions)
210+
# Uses actions/cache@v4 which handles both restore and save
210211
# --------------------------------------------------------------------
211-
- name: 💾 Restore Go module cache
212+
- name: 💾 Go module cache
212213
id: restore-gomod
213-
uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
214+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
214215
with:
215216
path: ~/go/pkg/mod
216217
key: ${{ steps.cache-keys.outputs.module-key }}
@@ -279,11 +280,12 @@ runs:
279280
echo "============================================================"
280281
281282
# --------------------------------------------------------------------
282-
# Restore Go build cache (per-version)
283+
# Go build cache (per-version)
284+
# Uses actions/cache@v4 which handles both restore and save
283285
# --------------------------------------------------------------------
284-
- name: 💾 Restore Go build cache
286+
- name: 💾 Go build cache
285287
id: restore-gobuild
286-
uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
288+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
287289
with:
288290
path: |
289291
~/.cache/go-build

.github/workflows/codeql-analysis.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646

4747
# Initializes the CodeQL tools for scanning.
4848
- name: Initialize CodeQL
49-
uses: github/codeql-action/init@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4.31.11
49+
uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
5050
with:
5151
languages: ${{ matrix.language }}
5252
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -57,7 +57,7 @@ jobs:
5757
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5858
# If this step fails, then you should remove it and run the build manually (see below)
5959
- name: Autobuild
60-
uses: github/codeql-action/autobuild@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4.31.11
60+
uses: github/codeql-action/autobuild@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
6161

6262
# ℹ️ Command-line programs to run using the OS shell.
6363
# 📚 https://git.io/JvXDl
@@ -67,4 +67,4 @@ jobs:
6767
# uses a compiled language
6868

6969
- name: Perform CodeQL Analysis
70-
uses: github/codeql-action/analyze@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4.31.11
70+
uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0

.github/workflows/fortress-benchmarks.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,7 @@ jobs:
394394
with:
395395
name: bench-stats-${{ matrix.os }}-${{ matrix.go-version }}
396396
path: bench-stats-${{ matrix.os }}-${{ matrix.go-version }}.json
397-
retention-days: 1
397+
retention-days: 7
398398

399399
# --------------------------------------------------------------------
400400
# Upload raw benchmark results

.github/workflows/fortress-code-quality.yml

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,6 @@ jobs:
6666
runs-on: ${{ inputs.primary-runner }}
6767
permissions:
6868
contents: read
69-
actions: write # Required for workflow cancellation on failure
7069
steps:
7170
# --------------------------------------------------------------------
7271
# Checkout code (required for local actions)
@@ -270,15 +269,6 @@ jobs:
270269
echo "❌ Go vet detected static analysis issues"
271270
exit 1
272271
273-
# --------------------------------------------------------------------
274-
# Cancel workflow on failure (save CI resources)
275-
# --------------------------------------------------------------------
276-
- name: 🚨 Cancel workflow on failure
277-
if: failure()
278-
uses: ./.github/actions/cancel-workflow-on-failure
279-
with:
280-
reason: "Go vet static analysis failed"
281-
282272
# ----------------------------------------------------------------------------------
283273
# Lint (Code Linting)
284274
# ----------------------------------------------------------------------------------
@@ -289,7 +279,6 @@ jobs:
289279
runs-on: ${{ inputs.primary-runner }}
290280
permissions:
291281
contents: read
292-
actions: write # Required for workflow cancellation on failure
293282
outputs:
294283
golangci-lint-version: ${{ steps.golangci-lint-version.outputs.version }}
295284
steps:
@@ -568,15 +557,6 @@ jobs:
568557
echo "❌ Lint detected code quality issues"
569558
exit 1
570559
571-
# --------------------------------------------------------------------
572-
# Cancel workflow on failure (save CI resources)
573-
# --------------------------------------------------------------------
574-
- name: 🚨 Cancel workflow on failure
575-
if: failure()
576-
uses: ./.github/actions/cancel-workflow-on-failure
577-
with:
578-
reason: "Code linting (golangci-lint) failed"
579-
580560
# ----------------------------------------------------------------------------------
581561
# YAML/JSON Format Validation (MAGE-X)
582562
# ----------------------------------------------------------------------------------
@@ -586,7 +566,6 @@ jobs:
586566
runs-on: ${{ inputs.primary-runner }}
587567
permissions:
588568
contents: read
589-
actions: write # Required for workflow cancellation on failure
590569
outputs:
591570
yamlfmt-version: ${{ steps.yamlfmt-version.outputs.version }}
592571
steps:
@@ -801,12 +780,3 @@ jobs:
801780
run: |
802781
echo "❌ Format check detected YAML/JSON formatting issues"
803782
exit 1
804-
805-
# --------------------------------------------------------------------
806-
# Cancel workflow on failure (save CI resources)
807-
# --------------------------------------------------------------------
808-
- name: 🚨 Cancel workflow on failure
809-
if: failure()
810-
uses: ./.github/actions/cancel-workflow-on-failure
811-
with:
812-
reason: "YAML/JSON format validation failed"

.github/workflows/fortress-completion-statistics.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -697,7 +697,7 @@ jobs:
697697
with:
698698
artifact-name: "statistics-section"
699699
artifact-path: "statistics-section.md"
700-
retention-days: "1"
700+
retention-days: "7"
701701
if-no-files-found: "warn"
702702

703703
- name: 📋 Set Output Content

.github/workflows/fortress-completion-tests.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -465,7 +465,7 @@ jobs:
465465
with:
466466
artifact-name: "tests-section"
467467
artifact-path: "tests-section.md"
468-
retention-days: "1"
468+
retention-days: "7"
469469
if-no-files-found: "warn"
470470

471471
- name: 📋 Set Output Content

.github/workflows/fortress-coverage.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@ on:
5151
CODECOV_TOKEN:
5252
description: "Codecov token for uploading coverage (required when coverage-provider is codecov)"
5353
required: false
54+
GH_PAT_TOKEN:
55+
description: "Personal access token for enhanced GitHub API access (optional, falls back to github-token)"
56+
required: false
5457

5558
# Security: Restrict default permissions (jobs must explicitly request what they need)
5659
permissions: {}
@@ -2511,4 +2514,4 @@ jobs:
25112514
with:
25122515
name: coverage-stats-codecov
25132516
path: coverage-stats-codecov-*.json
2514-
retention-days: 1
2517+
retention-days: 7

0 commit comments

Comments
 (0)