Skip to content

Commit 77d87aa

Browse files
cpcloudclaude
cpcloud
and
claude
committed
ci: split workflows into CI, Lint, and Security
Move lint jobs (deadcode, golangci-lint, pre-commit) into lint.yml and security jobs (govulncheck, osv-scanner, trufflehog, CodeQL) into security.yml. Simplify CodeQL to build-mode: none (no build step needed) and drop its weekly cron schedule. CI workflow retains test, benchmarks, nix build, docs, and semantic release. closes #718 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent d5c7a62 commit 77d87aa

4 files changed

Lines changed: 132 additions & 111 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -149,51 +149,6 @@ jobs:
149149
- name: Run smoke benchmarks
150150
run: go test -bench . -benchtime 1x -timeout 5m -run '^$' ./...
151151

152-
nix-tools:
153-
name: ${{ matrix.name }}
154-
runs-on: ubuntu-latest
155-
concurrency:
156-
group: ci-${{ matrix.tool }}-${{ github.ref }}
157-
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
158-
strategy:
159-
fail-fast: ${{ github.event_name == 'pull_request' }}
160-
matrix:
161-
include:
162-
- tool: deadcode
163-
name: Dead Code
164-
- tool: golangci-lint
165-
name: Lint
166-
- tool: govulncheck
167-
name: Vulnerability Check
168-
- tool: osv-scanner
169-
name: OSV Scan
170-
steps:
171-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
172-
with:
173-
persist-credentials: false
174-
175-
- uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
176-
177-
- name: Run ${{ matrix.tool }}
178-
run: nix run '.#${{ matrix.tool }}'
179-
180-
pre-commit:
181-
name: Pre-commit
182-
runs-on: ubuntu-latest
183-
concurrency:
184-
group: ci-pre-commit-${{ github.ref }}
185-
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
186-
steps:
187-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
188-
with:
189-
fetch-depth: 0
190-
persist-credentials: false
191-
192-
- uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
193-
194-
- name: Run pre-commit hooks
195-
run: nix run '.#pre-commit' -- --from-ref 'origin/${{ github.base_ref || 'main' }}' --to-ref HEAD
196-
197152
nix-build:
198153
name: Nix Build
199154
runs-on: ubuntu-latest
@@ -235,29 +190,13 @@ jobs:
235190
- name: Build docs
236191
run: nix run '.#docs'
237192

238-
secrets:
239-
name: Secret Scan
240-
runs-on: ubuntu-latest
241-
concurrency:
242-
group: ci-secrets-${{ github.ref }}
243-
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
244-
steps:
245-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
246-
with:
247-
fetch-depth: 0
248-
persist-credentials: false
249-
250-
- uses: trufflesecurity/trufflehog@7635b24fd512a2e817dd3e9dd661caaf035a079d # v3.93.1
251-
with:
252-
extra_args: --only-verified
253-
254193
# ---------------------------------------------------------------------------
255194
# Semantic Release (dry-run on PRs, publish on main push)
256195
# ---------------------------------------------------------------------------
257196

258197
semantic-release:
259198
name: Semantic Release
260-
needs: [test, nix-tools, pre-commit, nix-build, docs, secrets]
199+
needs: [test, nix-build, docs]
261200
runs-on: ubuntu-latest
262201
concurrency:
263202
group: semantic-release-${{ github.ref }}

‎.github/workflows/codeql.yml‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎.github/workflows/lint.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Copyright 2026 Phillip Cloud
2+
# Licensed under the Apache License, Version 2.0
3+
4+
name: Lint
5+
6+
on:
7+
push:
8+
branches: [main]
9+
pull_request:
10+
branches: [main]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
nix-lint:
17+
name: ${{ matrix.name }}
18+
runs-on: ubuntu-latest
19+
concurrency:
20+
group: lint-${{ matrix.tool }}-${{ github.ref }}
21+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
22+
strategy:
23+
fail-fast: ${{ github.event_name == 'pull_request' }}
24+
matrix:
25+
include:
26+
- tool: deadcode
27+
name: Dead Code
28+
- tool: golangci-lint
29+
name: Lint
30+
steps:
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
32+
with:
33+
persist-credentials: false
34+
35+
- uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
36+
37+
- name: Run ${{ matrix.tool }}
38+
run: nix run '.#${{ matrix.tool }}'
39+
40+
pre-commit:
41+
name: Pre-commit
42+
runs-on: ubuntu-latest
43+
concurrency:
44+
group: lint-pre-commit-${{ github.ref }}
45+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
46+
steps:
47+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
48+
with:
49+
fetch-depth: 0
50+
persist-credentials: false
51+
52+
- uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
53+
54+
- name: Run pre-commit hooks
55+
run: nix run '.#pre-commit' -- --from-ref 'origin/${{ github.base_ref || 'main' }}' --to-ref HEAD

‎.github/workflows/security.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Copyright 2026 Phillip Cloud
2+
# Licensed under the Apache License, Version 2.0
3+
4+
name: Security
5+
6+
on:
7+
push:
8+
branches: [main]
9+
pull_request:
10+
branches: [main]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
nix-security:
17+
name: ${{ matrix.name }}
18+
runs-on: ubuntu-latest
19+
concurrency:
20+
group: security-${{ matrix.tool }}-${{ github.ref }}
21+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
22+
strategy:
23+
fail-fast: ${{ github.event_name == 'pull_request' }}
24+
matrix:
25+
include:
26+
- tool: govulncheck
27+
name: Vulnerability Check
28+
- tool: osv-scanner
29+
name: OSV Scan
30+
steps:
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
32+
with:
33+
persist-credentials: false
34+
35+
- uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
36+
37+
- name: Run ${{ matrix.tool }}
38+
run: nix run '.#${{ matrix.tool }}'
39+
40+
secrets:
41+
name: Secret Scan
42+
runs-on: ubuntu-latest
43+
concurrency:
44+
group: security-secrets-${{ github.ref }}
45+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
46+
steps:
47+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
48+
with:
49+
fetch-depth: 0
50+
persist-credentials: false
51+
52+
- uses: trufflesecurity/trufflehog@7635b24fd512a2e817dd3e9dd661caaf035a079d # v3.93.1
53+
with:
54+
extra_args: --only-verified
55+
56+
codeql:
57+
name: CodeQL (Go)
58+
runs-on: ubuntu-latest
59+
concurrency:
60+
group: security-codeql-${{ github.ref }}
61+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
62+
permissions:
63+
security-events: write
64+
steps:
65+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
66+
with:
67+
persist-credentials: false
68+
69+
- name: Initialize CodeQL
70+
uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
71+
with:
72+
languages: go
73+
build-mode: none
74+
75+
- name: Perform CodeQL analysis
76+
uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3

0 commit comments

Comments
 (0)
⚡