feat(cli): X7 — uninstall machine-global teardown (spec 13) — X7 complete #113
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: ["**/*.md", "docs/**", "LICENSE", "NOTICE"] | |
| pull_request: | |
| paths-ignore: ["**/*.md", "docs/**", "LICENSE", "NOTICE"] | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs on the same ref (fail-fast + CI economy). | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| # Single enforced Go toolchain floor (DECISIONS, ARCHITECTURE §7.8). | |
| GO_VERSION: "1.25" | |
| jobs: | |
| # One consolidated lane ordered cheap → expensive so a lint/unit failure stops | |
| # before the costly Docker + cross-compile work. actions/setup-go caches the | |
| # module + build cache (keyed by go.sum). ubuntu-latest ships Docker, used by | |
| # the integration + e2e steps. | |
| ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| cache: true # GOMODCACHE + GOCACHE, keyed by go.sum | |
| # --- cheap, high-signal (fail fast) --- | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -l .) | |
| if [ -n "$unformatted" ]; then | |
| echo "These files are not gofmt-clean:"; echo "$unformatted"; exit 1 | |
| fi | |
| - name: go vet | |
| run: go vet ./... | |
| - name: installer lint (shellcheck + POSIX sh) | |
| run: | | |
| shellcheck --severity=warning install.sh | |
| sh -n install.sh | |
| - name: build (CGO disabled — static binary invariant) | |
| run: CGO_ENABLED=0 go build ./... | |
| - name: unit tests -race | |
| env: | |
| CGO_ENABLED: "1" # the race detector requires cgo (see Makefile) | |
| run: go test -race ./... | |
| - name: smoke (built binary, end-to-end in an XDG sandbox) | |
| run: make smoke | |
| - name: determinism (byte-identical generation) | |
| run: make determinism | |
| # --- medium --- | |
| - name: cross-compile (4 CGO-free release targets) | |
| env: | |
| CGO_ENABLED: "0" | |
| run: | | |
| for t in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do | |
| echo "→ $t" | |
| GOOS=${t%/*} GOARCH=${t#*/} go build -o /dev/null ./cmd/devstack | |
| done | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| # --- expensive, real-daemon (Docker on ubuntu-latest) --- | |
| - name: docker available | |
| run: docker version | |
| - name: integration tests (-tags=integration -race) | |
| env: | |
| CGO_ENABLED: "1" | |
| run: go test -tags=integration -race ./... | |
| - name: e2e tests (-tags=e2e, real up/down via the CLI) | |
| env: | |
| DEVSTACK_E2E: "1" # ephemeral runner: safe to mutate the shared stack | |
| run: go test -tags=e2e ./tests/e2e/... | |
| # The full release pipeline (4 CGO-free targets + archives + checksums + | |
| # .deb/.rpm) — expensive and independent, so it runs in parallel and never | |
| # gates the fast feedback above. Needs full history for goreleaser's versioning. | |
| release-dryrun: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| cache: true | |
| - uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| version: "~> v2" | |
| args: release --snapshot --clean | |
| # Placeholder lanes wired as their milestones land: | |
| # - macos: macos-14 arm64 preflight-only (G2) | |
| # - config-conformance: golden workspace exercising every schema field |