Repository navigation
ci: add PR checks and build releases with the latest Go patch - #37
Merged
Merged
Conversation
Add the task targets shared with the other repos (fmt-check, tidy-check, vuln, ci, and lint with extra args) and a PR checks workflow that runs task ci and golangci-lint (new issues only) on PRs, pushes to main and on demand, with a weekly govulncheck-only scheduled run. release.yml now runs task ci, and builds with the latest Go 1.27 patch release instead of the exact go.mod version: a released binary keeps the standard library it was built with, and the go.mod version has govulncheck findings in the standard library that later patches fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
services,ttandadguard-dns-analyzer:fmt-check,tidy-check,vuln(govulncheck pinned at v1.9.0),ci, andlint, which now accepts extra args after--..github/workflows/pr-checks.yaml: runstask ci, then golangci-lint, which fails only on new issues. Triggers are PRs, pushes tomain, on demand, and a weekly govulncheck-only schedule. The job is named "PR checks", the same required check name as in the other repos. Minutes are free here because the repo is public.release.yml: the test step now runstask ciinstead of inlinego vet/go test. It also builds with the latest Go 1.27 patch release instead of the exactgo.modversion, because a released binary keeps the standard library it was built with. On the currentgo.modtoolchain (go1.26.0), govulncheck reports GO-2026-4602 inosand GO-2026-4601 innet/url(both fixed in go1.26.1).After merging
This PR is
ci:, so merging it releases nothing. To ship a binary built with the patched toolchain, run the release workflow by hand with bump: patch.Testing
task cipasses locally on Go 1.27.3, and govulncheck reports "No vulnerabilities found".Dependabot
Adds
.github/dependabot.yml(the same file in every repo): weekly, grouped version updates for GitHub Actions (ci:prefix) and Go modules (fix(deps):prefix). Security updates and alerts are a repo setting: Settings → Code security.🤖 Generated with Claude Code