ci: add GitHub Actions CI + prepare v0.1.2 release (#6) #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # GitHub Actions CI — mirrors the Makefile's verification discipline | |
| # (vet → test/race → conformance → build, plus bench) on pull requests and | |
| # pushes to main, and only when source files change (doc-only changes are | |
| # skipped). The Makefile is the single source of truth: jobs call `make <target>` | |
| # where a target exists; the extra hardening steps (gofmt gate, govulncheck, | |
| # cross-platform build, coverage) are CI-only and call `go` directly. | |
| # | |
| # luapure is a zero-dependency pure-Go port, so there is no go.sum: `make test` | |
| # is already race-enabled and `make conformance` runs the official Lua 5.4 | |
| # fixtures as a hard gate. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "**/*.go" | |
| - "go.mod" | |
| - "Makefile" | |
| - "conformance/**" | |
| - "_lua5.4-tests/**" | |
| - "_glue5.4-tests/**" | |
| - ".github/workflows/ci.yml" | |
| pull_request: | |
| paths: | |
| - "**/*.go" | |
| - "go.mod" | |
| - "Makefile" | |
| - "conformance/**" | |
| - "_lua5.4-tests/**" | |
| - "_glue5.4-tests/**" | |
| - ".github/workflows/ci.yml" | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Fast fail on formatting before spending time on the heavier jobs. | |
| format: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -l .) | |
| if [ -n "$unformatted" ]; then | |
| echo "These files are not gofmt-clean:"; echo "$unformatted" | |
| exit 1 | |
| fi | |
| # The canonical pre-push gate: vet → race-enabled tests (with coverage) → | |
| # official Lua 5.4 conformance fixtures. Equivalent to `make check` minus the | |
| # build step (which the cross-platform build job below proves separately). | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod # tracks the toolchain pinned in go.mod | |
| cache: true # build cache, keyed on go.mod (no go.sum: zero deps) | |
| - run: make vet | |
| # `make test` is `go test -race -count=1 ./...`; add a coverage profile. | |
| # covermode=atomic is required under -race. | |
| - name: test (race, with coverage) | |
| run: go test -race -covermode=atomic -coverprofile=coverage.out -count=1 ./... | |
| - name: conformance (official Lua 5.4 fixtures) | |
| run: make conformance | |
| - name: upload coverage | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage | |
| path: coverage.out | |
| if-no-files-found: warn | |
| # Scan dependencies and code for known vulnerabilities. | |
| govulncheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: govulncheck | |
| env: | |
| # govulncheck@latest requires a newer Go than go.mod pins; allow the | |
| # toolchain to auto-upgrade for the tool install. setup-go v6 defaults | |
| # GOTOOLCHAIN to "local", which otherwise blocks this. | |
| GOTOOLCHAIN: auto | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| # build runs only after verify passes, mirroring the Makefile's | |
| # "build only after tests pass", and proves the engine + all `go` targets are | |
| # cross-platform. `make` isn't assumed on Windows, so call `go` directly. | |
| build: | |
| needs: verify | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - run: go vet ./... | |
| - run: go build ./... | |
| # bench is observational, not a gate — a slow/noisy run must not fail CI. | |
| bench: | |
| needs: verify | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - run: make bench |