chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 #41
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: go-race | |
| on: | |
| push: | |
| branches: | |
| - "**" | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| check: | |
| name: fmt-and-test-go${{ matrix.go-version }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| go-version: | |
| - "1.24.x" | |
| - "1.26.x" | |
| include: | |
| - go-version: "1.24.x" | |
| run_extended: false | |
| - go-version: "1.26.x" | |
| run_extended: true | |
| permissions: | |
| contents: read | |
| env: | |
| GOTOOLCHAIN: local | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ matrix.go-version }} | |
| check-latest: true | |
| - name: Enforce root source whitelist | |
| run: | | |
| set -euo pipefail | |
| expected="$(printf '%s\n' builder.go config.go context.go doc.go engine.go error_mapping.go errors.go goAuth.go types.go | sort)" | |
| actual="$(ls -1 *.go | grep -v '_test.go$' | sort)" | |
| if [ "$actual" != "$expected" ]; then | |
| echo "Root source file whitelist mismatch" | |
| echo "Expected:" | |
| echo "$expected" | |
| echo "Actual:" | |
| echo "$actual" | |
| exit 1 | |
| fi | |
| disallowed="$(ls -1 *.go | grep -v '_test.go$' | grep -E '(limiter|store|audit|metrics|engine_)' || true)" | |
| if [ -n "$disallowed" ]; then | |
| echo "Disallowed root source file names detected:" | |
| echo "$disallowed" | |
| exit 1 | |
| fi | |
| - name: Require changelog entry for API/config changes | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| set -euo pipefail | |
| # Files that require a CHANGELOG.md entry when modified | |
| API_PATTERNS="^(builder|config|context|engine|errors|goAuth|types)\.go$|^docs/api-reference\.md$|^docs/config\.md$" | |
| CHANGED=$(git diff --name-only "${{ github.event.pull_request.base.sha }}" HEAD || true) | |
| NEEDS_CL=false | |
| for f in $CHANGED; do | |
| if echo "$f" | grep -qE "$API_PATTERNS"; then | |
| NEEDS_CL=true | |
| break | |
| fi | |
| done | |
| if [ "$NEEDS_CL" = "true" ]; then | |
| if ! echo "$CHANGED" | grep -q "^CHANGELOG.md$"; then | |
| echo "::error::Public API or config docs changed but CHANGELOG.md was not updated." | |
| echo "Add an entry under [Unreleased] in CHANGELOG.md." | |
| exit 1 | |
| fi | |
| fi | |
| - name: Go environment summary | |
| run: | | |
| echo "=== Go version ===" | |
| go version | |
| echo "=== Go env (selected) ===" | |
| go env GOVERSION GOTOOLCHAIN GOROOT GOPATH GOOS GOARCH CGO_ENABLED | |
| - name: Install goimports | |
| run: go install golang.org/x/tools/cmd/goimports@v0.42.0 | |
| - name: Check gofmt | |
| run: | | |
| files=$(find . -name '*.go' -not -path './vendor/*') | |
| test -z "$(gofmt -l $files)" | |
| - name: Check goimports | |
| run: | | |
| files=$(find . -name '*.go' -not -path './vendor/*') | |
| test -z "$($(go env GOPATH)/bin/goimports -l $files)" | |
| - name: Run unit tests (includes vet) | |
| run: go test ./... | |
| - name: Build example app | |
| run: go build ./examples/http-minimal/... | |
| - name: Check engine.go delegate complexity | |
| run: go test -run TestEngine_DelegateMethodComplexity -v . | |
| - name: Run integration tests (miniredis) | |
| run: go test -tags=integration ./test/... | |
| - name: Run integration tests (real Redis) | |
| if: matrix.run_extended | |
| run: | | |
| docker compose -f docker-compose.test.yml up -d --wait | |
| REDIS_ADDR=127.0.0.1:6379 go test -tags=integration -v -run 'TestRedisCompat' ./test/... | |
| docker compose -f docker-compose.test.yml down | |
| - name: Run fuzz tests (short) | |
| if: matrix.run_extended | |
| run: | | |
| go test -fuzz=FuzzSessionDecode -fuzztime=30s ./session/ | |
| go test -fuzz=FuzzMaskCodecRoundTrip -fuzztime=30s ./permission/ | |
| go test -fuzz=FuzzDecodeRefreshToken -fuzztime=30s ./internal/ | |
| go test -fuzz=FuzzJWTParseAccess -fuzztime=30s ./jwt/ | |
| - name: Run perf sanity | |
| if: matrix.go-version == '1.24.x' | |
| run: bash security/run_perf_sanity.sh | |
| - name: Install static analysis tools | |
| if: matrix.run_extended | |
| run: | | |
| go install honnef.co/go/tools/cmd/staticcheck@latest | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| go install github.com/securego/gosec/v2/cmd/gosec@latest | |
| - name: Run staticcheck | |
| if: matrix.run_extended | |
| run: $(go env GOPATH)/bin/staticcheck "-checks=all,-ST1000,-ST1003,-ST1005,-U1000" ./... | |
| - name: Run security scanners with baseline | |
| if: matrix.run_extended | |
| run: bash security/run_scanners.sh | |
| race: | |
| name: race-${{ matrix.os }} | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| contents: read | |
| env: | |
| GOTOOLCHAIN: local | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.26.x" | |
| check-latest: true | |
| - name: Run race tests | |
| run: go test -race ./... |