fix: correct SARIF fix to remove entire invalid fixes entries #129
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - 'specs/**' | |
| - '.specify/**' | |
| - 'CLAUDE.md' | |
| - 'CONTRIBUTING.md' | |
| - 'LICENSE' | |
| - '.gitignore' | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - 'specs/**' | |
| - '.specify/**' | |
| - 'CLAUDE.md' | |
| - 'CONTRIBUTING.md' | |
| - 'LICENSE' | |
| - '.gitignore' | |
| permissions: | |
| contents: read | |
| security-events: write # For SARIF upload | |
| jobs: | |
| check-changes: | |
| name: Detect Code Changes | |
| runs-on: ubuntu-latest | |
| outputs: | |
| code-changed: ${{ steps.filter.outputs.code-files }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Check for code changes | |
| uses: dorny/paths-filter@v3 | |
| id: filter | |
| with: | |
| filters: | | |
| code-files: | |
| - '**/*.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - '.golangci.yml' | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| needs: check-changes | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@v8 | |
| with: | |
| version: v2.5 | |
| args: --timeout=3m --build-tags integration | |
| unit-tests: | |
| name: Unit Tests | |
| runs-on: ubuntu-latest | |
| needs: [check-changes, lint] | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Run unit tests | |
| run: go test -v -race -coverprofile=coverage.txt -covermode=atomic ./... | |
| shell: bash | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| files: ./coverage.txt | |
| flags: unittests | |
| name: codecov-ubuntu | |
| continue-on-error: true | |
| integration-tests: | |
| name: Integration Tests (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| needs: [check-changes, lint] | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Run integration tests | |
| run: go test -v -tags=integration -timeout 2m ./test | |
| shell: bash | |
| - name: Check for TODO-skipped tests | |
| run: | | |
| if grep -r 't.Skip("TODO:' test/; then | |
| echo "ERROR: Found TODO-skipped tests" | |
| exit 1 | |
| fi | |
| shell: bash | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| needs: [check-changes, lint] | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Run Gosec Security Scanner | |
| uses: securego/gosec@master | |
| with: | |
| args: '-no-fail -fmt sarif -out results.sarif ./...' | |
| - name: Fix SARIF format | |
| run: | | |
| jq '.runs[].results[] |= if .fixes then .fixes |= map(select(.artifactChanges and (.artifactChanges | type == "array" and length > 0))) else . end' results.sarif > results-fixed.sarif | |
| mv results-fixed.sarif results.sarif | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: results.sarif | |
| continue-on-error: true | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| needs: [check-changes, unit-tests, integration-tests, security] | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Run GoReleaser (snapshot) | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| version: latest | |
| args: build --snapshot --clean |