chore: bootstrap repo scaffolding (M0.1)
Bootstraps §1.2 scaffolding (README, CONTRIBUTING, CODEOWNERS, CHANGELOG, PR + issue templates, LICENSE, CI workflow, release workflow, commitlint, cliff, .editorconfig, .gitignore, .env.example) and ships a proprietary all-rights-reserved LICENSE naming both founders. Refs: M0.1
This commit was merged in pull request #1.
This commit is contained in:
@@ -0,0 +1,98 @@
|
||||
# CI for Go services. Copy to .gitea/workflows/ci.yaml in the repo.
|
||||
name: ci
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
push:
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
shared:
|
||||
runs-on: docker
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with: { fetch-depth: 0 }
|
||||
|
||||
- name: commitlint (PR only)
|
||||
if: github.event_name == 'pull_request'
|
||||
uses: wagoid/commitlint-github-action@v6
|
||||
|
||||
- name: gitleaks
|
||||
uses: gitleaks/gitleaks-action@v2
|
||||
|
||||
- name: trivy fs scan
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: fs
|
||||
severity: HIGH,CRITICAL
|
||||
exit-code: 1
|
||||
|
||||
test:
|
||||
runs-on: docker
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/setup-go@v5
|
||||
with: { go-version: '1.22' }
|
||||
|
||||
- name: cache
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: ~/go/pkg/mod
|
||||
key: go-${{ hashFiles('go.sum') }}
|
||||
|
||||
- name: fmt
|
||||
run: test -z "$(gofmt -l .)"
|
||||
|
||||
- name: vet
|
||||
run: go vet ./...
|
||||
|
||||
- name: lint
|
||||
uses: golangci/golangci-lint-action@v6
|
||||
with: { version: latest }
|
||||
|
||||
- name: test (with integration via testcontainers)
|
||||
run: go test -race -coverprofile=cover.out ./...
|
||||
|
||||
- name: coverage gate
|
||||
run: |
|
||||
go tool cover -func=cover.out | tail -1 | awk '{ if ($3+0 < 70.0) { print "coverage below 70%"; exit 1 } }'
|
||||
|
||||
- name: build
|
||||
run: go build ./...
|
||||
|
||||
image:
|
||||
needs: [shared, test]
|
||||
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
||||
runs-on: docker
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: login to registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: registry.yourplatform.com
|
||||
username: ${{ secrets.REGISTRY_USER }}
|
||||
password: ${{ secrets.REGISTRY_PASS }}
|
||||
|
||||
- name: build + push
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
push: true
|
||||
tags: |
|
||||
registry.yourplatform.com/${{ github.event.repository.name }}:sha-${{ github.sha }}
|
||||
registry.yourplatform.com/${{ github.event.repository.name }}:env-stage
|
||||
|
||||
- name: sbom
|
||||
uses: anchore/sbom-action@v0
|
||||
with:
|
||||
image: registry.yourplatform.com/${{ github.event.repository.name }}:sha-${{ github.sha }}
|
||||
|
||||
- name: orca deploy stage
|
||||
run: orca apply --env=stage --image-tag=sha-${{ github.sha }}
|
||||
env:
|
||||
ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
|
||||
|
||||
- name: e2e on stage
|
||||
run: orca exec --env=stage e2e-runner
|
||||
@@ -0,0 +1,85 @@
|
||||
# release.yaml — production release on git tag vX.Y.Z.
|
||||
# Promotes the image already on stage to prod, gated by manual sign-off.
|
||||
name: release
|
||||
|
||||
on:
|
||||
push:
|
||||
tags: ['v*.*.*']
|
||||
|
||||
jobs:
|
||||
promote:
|
||||
runs-on: docker
|
||||
environment:
|
||||
name: production # Gitea Environments — requires sign-off per branch protection
|
||||
url: https://yourplatform.com
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with: { fetch-depth: 0 }
|
||||
|
||||
- name: extract version
|
||||
id: v
|
||||
run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: verify stage soak (>= 24h on this image)
|
||||
run: |
|
||||
IMG=registry.yourplatform.com/${{ github.event.repository.name }}:env-stage
|
||||
SOAK_SECONDS=$(orca image-age --env=stage --image $IMG)
|
||||
if [ "$SOAK_SECONDS" -lt 86400 ]; then
|
||||
echo "Stage soak only $SOAK_SECONDS s, < 24h. Aborting."
|
||||
exit 1
|
||||
fi
|
||||
env:
|
||||
ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
|
||||
|
||||
- name: re-tag image as semver + env-prod
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: registry.yourplatform.com
|
||||
username: ${{ secrets.REGISTRY_USER }}
|
||||
password: ${{ secrets.REGISTRY_PASS }}
|
||||
|
||||
- run: |
|
||||
IMG=registry.yourplatform.com/${{ github.event.repository.name }}
|
||||
docker pull $IMG:env-stage
|
||||
docker tag $IMG:env-stage $IMG:v${{ steps.v.outputs.version }}
|
||||
docker tag $IMG:env-stage $IMG:env-prod
|
||||
docker push $IMG:v${{ steps.v.outputs.version }}
|
||||
docker push $IMG:env-prod
|
||||
|
||||
- name: deploy to prod
|
||||
run: orca apply --env=prod --image-tag=v${{ steps.v.outputs.version }}
|
||||
env:
|
||||
ORCA_TOKEN: ${{ secrets.ORCA_PROD_TOKEN }}
|
||||
|
||||
- name: post-deploy smoke
|
||||
run: orca exec --env=prod smoke-runner
|
||||
|
||||
- name: generate release notes from conventional commits
|
||||
uses: orhun/git-cliff-action@v3
|
||||
with:
|
||||
config: cliff.toml
|
||||
args: --latest --strip header
|
||||
env:
|
||||
OUTPUT: RELEASE_NOTES.md
|
||||
|
||||
- name: create Gitea release
|
||||
run: |
|
||||
curl -X POST -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "$(jq -Rs '{tag_name:"v${{ steps.v.outputs.version }}", name:"v${{ steps.v.outputs.version }}", body:.}' < RELEASE_NOTES.md)" \
|
||||
https://gitea.meghsakha.com/api/v1/repos/${{ github.repository }}/releases
|
||||
|
||||
rollback-on-failure:
|
||||
needs: promote
|
||||
if: failure()
|
||||
runs-on: docker
|
||||
steps:
|
||||
- name: orca rollback prod
|
||||
run: orca rollout undo ${{ github.event.repository.name }} --env=prod
|
||||
env:
|
||||
ORCA_TOKEN: ${{ secrets.ORCA_PROD_TOKEN }}
|
||||
- name: page on-call
|
||||
run: |
|
||||
curl -X POST -H "Content-Type: application/json" \
|
||||
-d '{"text":"Release of ${{ github.event.repository.name }} ${{ github.ref }} FAILED. Rolled back. See Gitea Actions run."}' \
|
||||
${{ secrets.ONCALL_WEBHOOK }}
|
||||
Reference in New Issue
Block a user