1- name : Go Build & Package
2-
3- on :
4- push :
5- branches : [ "main" ]
6- tags : [ "v*" ]
7- pull_request :
8- branches : [ "main" ]
9-
10- jobs :
11- test :
12- name : Lint, Test, Sec
13- runs-on : ubuntu-latest
14- container : debian:trixie
15- permissions :
16- contents : read
17-
18- steps :
19- - name : Install System Dependencies
20- run : |
21- apt-get update && apt-get install -y git make curl bash binutils build-essential
22- git config --global --add safe.directory '*'
23-
24- - name : Checkout code
25- uses : actions/checkout@v6
26-
27- - name : Set up Go
28- uses : actions/setup-go@v6
29- with :
30- go-version : ' 1.25'
31-
32- # Linting
33- - name : GolangCI-Lint
34- uses : golangci/golangci-lint-action@v9
35- with :
36- version : latest
37-
38- # Security Scan (Gosec)
39- - name : Run Gosec Security Scanner
40- uses : securego/gosec@master
41- with :
42- args : ./...
43-
44- # Vulnerability Check
45- - name : Run govulncheck
46- run : |
47- go install golang.org/x/vuln/cmd/govulncheck@latest
48- govulncheck ./...
49-
50- # Testing (with race detector)
51- - name : Run Tests
52- run : |
53- go test -v -race -coverprofile=coverage.out ./...
54- go tool cover -func=coverage.out
55- env :
56- CGO_ENABLED : 1
57-
58- shellcheck :
59- name : Shellcheck
60- runs-on : ubuntu-latest
61- permissions :
62- contents : read
63- steps :
64- - name : Checkout code
65- uses : actions/checkout@v6
66- - name : Run ShellCheck
67- uses : ludeeus/action-shellcheck@master
68- with :
69- version : v0.10.0
70-
71- build-and-package :
72- name : Build, Deb (${{ matrix.arch }})
73- needs : [test, shellcheck]
74- runs-on : ubuntu-latest
75- container : debian:trixie
76- strategy :
77- matrix :
78- arch : [amd64, arm64]
79- permissions :
80- contents : read
81-
82- steps :
83- - name : Install System Dependencies
84- run : |
85- apt-get update && apt-get install -y git make curl bash binutils build-essential
86- git config --global --add safe.directory '*'
87-
88- - name : Checkout code
89- uses : actions/checkout@v6
90-
91- - name : Set up Go
92- uses : actions/setup-go@v6
93- with :
94- go-version : ' 1.25'
95-
96- # Build Binary
97- - name : Build Binaries
98- run : make build ARCH=${{ matrix.arch }} LDFLAGS="-s -w"
99-
100- - name : Determine Version
101- id : get_version
102- shell : bash
103- run : |
104- if [[ $GITHUB_REF == refs/tags/v* ]]; then
105- # Strip 'refs/tags/v' to get '0.2.0'
106- VERSION=${GITHUB_REF#refs/tags/v}
107- else
108- # Fallback for non-tag builds (e.g. 0.0.0-dev-a1b2c3d)
109- VERSION=0.0.0-dev-${GITHUB_SHA::7}
110- fi
111- echo "VERSION=${VERSION}" >> $GITHUB_ENV
112-
113- # Create Deb File
114- - name : Package Deb
115- run : make deb VERSION=${{ env.VERSION }} ARCH=${{ matrix.arch }}
116-
117- # Upload the .deb file when tagged
118- - name : Upload Deb Artifact
119- uses : actions/upload-artifact@v6
120- if : startsWith(github.ref, 'refs/tags/v')
121- with :
122- name : deb-package-${{ matrix.arch }}
123- path : " *.deb"
124- if-no-files-found : error
125-
126- release :
127- name : Release
128- needs : build-and-package
129- runs-on : ubuntu-latest
130- permissions :
131- contents : write
132- security-events : write
133- if : startsWith(github.ref, 'refs/tags/v')
134- steps :
135- - uses : actions/download-artifact@v7
136- with :
137- pattern : deb-package-*
138- merge-multiple : true
139-
140- - name : Create Release
141- uses : softprops/action-gh-release@v2
142- with :
143- files : " *.deb"
144- env :
145- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
1+ d 2nd
0 commit comments