chore(deps): pin tasks v1.17.0 #506
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Go CI | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| paths: | |
| - "**/*.go" | |
| - "go.mod" | |
| - "go.sum" | |
| - ".golangci.yml" | |
| - "Makefile" | |
| - ".github/workflows/go-ci.yml" | |
| - "compat/**" | |
| - "scripts/build-tmux-compat.sh" | |
| - "scripts/test-tmux-compat-manifest.sh" | |
| - "scripts/test-tmux-compat-prefix.sh" | |
| - "scripts/test-tmux-compatibility.sh" | |
| - "scripts/tmux-compat-lib.sh" | |
| # Bundled integration assets are shipped JavaScript that the Go suite | |
| # drives under node. A change to one of them changes what Sidecar | |
| # installs into a user's agent, and without this it triggered no CI run | |
| # at all. | |
| - "internal/agentintegration/assets/**" | |
| # A Herdr sync changes only vendored data: detection manifests, their | |
| # lock, and the vendored integration assets. None of that is Go source, | |
| # so none of it matched the filters above — and the lock digest test, the | |
| # vendored-regex compile test and the fixture census are exactly the | |
| # checks such a change exists to run. A sync pull request opened with | |
| # GITHUB_TOKEN triggers no `pull_request` run at all (herdr-sync.yml runs | |
| # the suite itself for that reason), but a human pushing to the sync | |
| # branch got no CI either, which these three entries fix. | |
| - "internal/agentactivity/manifests/**" | |
| - "internal/agentintegration/upstream/**" | |
| - "internal/agentintegration/upstream.lock.json" | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "**/*.go" | |
| - "go.mod" | |
| - "go.sum" | |
| - ".golangci.yml" | |
| - "Makefile" | |
| - ".github/workflows/go-ci.yml" | |
| - "compat/**" | |
| - "scripts/build-tmux-compat.sh" | |
| - "scripts/test-tmux-compat-manifest.sh" | |
| - "scripts/test-tmux-compat-prefix.sh" | |
| - "scripts/test-tmux-compatibility.sh" | |
| - "scripts/tmux-compat-lib.sh" | |
| - "internal/agentintegration/assets/**" | |
| - "internal/agentactivity/manifests/**" | |
| - "internal/agentintegration/upstream/**" | |
| - "internal/agentintegration/upstream.lock.json" | |
| # Releases gate on a Go CI run for the exact commit being tagged | |
| # (scripts/check-release-state.sh). A release head is often a docs-only | |
| # commit — a changelog entry — which the path filters above skip, leaving | |
| # the gate with nothing to check. Allow dispatching a run for such a commit. | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| # The bundled OpenCode integration is shipped JavaScript, and the only | |
| # tests that run it need node. They skip when node is absent, so without | |
| # this step CI reported green while the asset's lane mapping, its export | |
| # surface, and its report ordering went unchecked. SIDECAR_REQUIRE_NODE | |
| # turns that skip into a failure, so losing node here breaks the build | |
| # rather than quietly stopping the checks. | |
| - name: Set up Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "24" | |
| - name: Test | |
| run: go test ./... | |
| env: | |
| SIDECAR_REQUIRE_NODE: "1" | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: golangci-lint (full codebase) | |
| uses: golangci/golangci-lint-action@v9 | |
| with: | |
| version: v2.13.1 | |
| args: ./... | |
| tmux-compatibility: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: minimum | |
| build_roles: minimum | |
| client_role: minimum | |
| server_role: "" | |
| - name: latest | |
| build_roles: latest | |
| client_role: latest | |
| server_role: "" | |
| # A Homebrew upgrade replaces the client binary but cannot replace a | |
| # running server. Derive that real-world skew from the same two | |
| # manifest roles rather than adding a third version source. | |
| - name: latest-client-minimum-server | |
| build_roles: minimum latest | |
| client_role: latest | |
| server_role: minimum | |
| name: tmux compatibility (${{ matrix.name }}) | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Install tmux build dependencies | |
| run: sudo apt-get update && sudo apt-get install -y build-essential libevent-dev libncurses-dev libutf8proc-dev bison pkg-config | |
| - name: Validate compatibility manifest | |
| run: ./scripts/test-tmux-compat-manifest.sh && ./scripts/test-tmux-compat-prefix.sh | |
| - name: Build manifest releases | |
| env: | |
| BUILD_ROLES: ${{ matrix.build_roles }} | |
| run: | | |
| for role in $BUILD_ROLES; do | |
| ./scripts/build-tmux-compat.sh "$role" "$RUNNER_TEMP/tmux-$role" | |
| done | |
| - name: Test compatibility contract | |
| env: | |
| CLIENT_ROLE: ${{ matrix.client_role }} | |
| SERVER_ROLE: ${{ matrix.server_role }} | |
| run: | | |
| args=("$CLIENT_ROLE" "$RUNNER_TEMP/tmux-$CLIENT_ROLE/bin/tmux") | |
| if [[ -n "$SERVER_ROLE" ]]; then | |
| args+=(--server-role "$SERVER_ROLE" --server-tmux "$RUNNER_TEMP/tmux-$SERVER_ROLE/bin/tmux") | |
| fi | |
| ./scripts/test-tmux-compatibility.sh "${args[@]}" |