popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: split dev/prod jobs, add non-blocking frontend major deps check
CI / Nginx config check (push) Failing after 12s
Details
CI / Docker compose check (push) Successful in 17s
Details
CI / Env docs check (push) Successful in 17s
Details
CI / Frontend deps check (push) Failing after 23s
Details
CI / Frontend major deps (warn only) (push) Has been skipped
Details
CI / Knip (push) Has been skipped
Details
CI / Frontend a11y check (push) Has been skipped
Details
CI / Secrets scan (push) Successful in 37s
Details
CI / Go build (push) Successful in 37s
Details
CI / Frontend build (push) Successful in 1m10s
Details
CI / Svelte strict check (push) Has been skipped
Details
CI / Frontend QC (audit) (push) Has been skipped
Details
CI / Frontend QC (typecheck) (push) Has been skipped
Details
CI / Frontend QC (lint) (push) Has been skipped
Details
CI / go mod tidy (push) Successful in 45s
Details
CI / Go vet (prod) (push) Successful in 1m50s
Details
CI / Go vet (dev) (push) Successful in 2m28s
Details
CI / Staticcheck (prod) (push) Failing after 2m50s
Details
CI / Go vulnerabilities (push) Successful in 2m40s
Details
CI / Staticcheck (dev) (push) Failing after 3m53s
Details
CI / golangci-lint (push) Failing after 3m58s
Details
CI / Security scan (prod) (push) Failing after 4m21s
Details
CI / Security scan (dev) (push) Failing after 4m21s
Details
CI / Tests (prod) (push) Has been skipped
Details
CI / Tests (dev) (push) Has been skipped
Details
CI / Race (prod) (push) Has been skipped
Details
CI / Race (dev) (push) Has been skipped
Details

Browse Source 
Split 3 multi-step jobs into separate dev and prod jobs for clearer
parallel execution:
  - go-vet → go-vet-dev + go-vet-prod
  - go-staticcheck → go-staticcheck-dev + go-staticcheck-prod
  - go-gosec → go-gosec-dev + go-gosec-prod

Each split job runs independently with its own setup and cache key.
Updated test/race needs to reference all split job names.

Added frontend-deps-major job (warn-only, exit 0):
  - Detects major/out-of-range npm updates (wanted !== latest)
  - Non-blocking informational check alongside the existing blocking
    frontend-deps job that catches in-range updates
This commit is contained in:
popertots
2026-07-10 10:45:29 +01:00
parent 2a0b81e565
commit e0f072b593
1 changed files with 156 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yaml
+156 -16
View File
@@ -93,8 +93,8 @@ jobs:
run: go build ./...
working-directory: backend
go-vet:
name: Go vet
go-vet-dev:
name: Go vet (dev)
needs: [go-build]
runs-on: ubuntu-latest
defaults:
@@ -114,7 +114,7 @@ jobs:
path: |
~/go/pkg/mod
~/.cache/go-build
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-vet
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-vet-dev
restore-keys: |
${{ runner.os }}-go-
@@ -127,6 +127,36 @@ jobs:
run: go vet -tags "test,dev" ./...
working-directory: backend
go-vet-prod:
name: Go vet (prod)
needs: [go-build]
runs-on: ubuntu-latest
defaults:
run:
shell: sh
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version: "1.26"
cache: false
- name: Cache Go modules
uses: actions/cache@v4
with:
path: |
~/go/pkg/mod
~/.cache/go-build
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-vet-prod
restore-keys: |
${{ runner.os }}-go-
- name: Fix node toolcache path for Post-step cleanup
run: |
mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
- name: Vet (prod tags)
run: go vet -tags "test,!dev" ./...
working-directory: backend
@@ -167,8 +197,8 @@ jobs:
golangci-lint run ./...
working-directory: backend
go-staticcheck:
name: Staticcheck
go-staticcheck-dev:
name: Staticcheck (dev)
needs: [go-build]
runs-on: ubuntu-latest
defaults:
@@ -188,7 +218,7 @@ jobs:
path: |
~/go/pkg/mod
~/.cache/go-build
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-staticcheck
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-staticcheck-dev
restore-keys: |
${{ runner.os }}-go-
@@ -203,13 +233,8 @@ jobs:
staticcheck -tags "test,dev" ./...
working-directory: backend
- name: Staticcheck (prod tags)
run: |
staticcheck -tags "test,!dev" ./...
working-directory: backend
go-gosec:
name: Security scan (gosec)
go-staticcheck-prod:
name: Staticcheck (prod)
needs: [go-build]
runs-on: ubuntu-latest
defaults:
@@ -229,7 +254,43 @@ jobs:
path: |
~/go/pkg/mod
~/.cache/go-build
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-gosec
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-staticcheck-prod
restore-keys: |
${{ runner.os }}-go-
- name: Fix node toolcache path for Post-step cleanup
run: |
mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
- name: Staticcheck (prod tags)
run: |
go install honnef.co/go/tools/cmd/staticcheck@latest
staticcheck -tags "test,!dev" ./...
working-directory: backend
go-gosec-dev:
name: Security scan (dev)
needs: [go-build]
runs-on: ubuntu-latest
defaults:
run:
shell: sh
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version: "1.26"
cache: false
- name: Cache Go modules
uses: actions/cache@v4
with:
path: |
~/go/pkg/mod
~/.cache/go-build
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-gosec-dev
restore-keys: |
${{ runner.os }}-go-
@@ -244,8 +305,39 @@ jobs:
gosec -severity medium -tags "test,dev" ./...
working-directory: backend
go-gosec-prod:
name: Security scan (prod)
needs: [go-build]
runs-on: ubuntu-latest
defaults:
run:
shell: sh
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version: "1.26"
cache: false
- name: Cache Go modules
uses: actions/cache@v4
with:
path: |
~/go/pkg/mod
~/.cache/go-build
key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-gosec-prod
restore-keys: |
${{ runner.os }}-go-
- name: Fix node toolcache path for Post-step cleanup
run: |
mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
- name: gosec (prod tags)
run: |
go install github.com/securego/gosec/v2/cmd/gosec@latest
gosec -severity medium -tags "test,!dev" ./...
working-directory: backend
@@ -290,7 +382,7 @@ jobs:
test:
name: Tests (${{ matrix.label }})
needs: [go-vet, go-lint, go-staticcheck, go-gosec, go-mod-tidy, vulns]
needs: [go-vet-dev, go-vet-prod, go-lint, go-staticcheck-dev, go-staticcheck-prod, go-gosec-dev, go-gosec-prod, go-mod-tidy, vulns]
runs-on: ubuntu-latest
defaults:
run:
@@ -379,7 +471,7 @@ jobs:
race:
name: Race (${{ matrix.label }})
needs: [go-vet, go-lint, go-staticcheck, go-gosec, go-mod-tidy, vulns]
needs: [go-vet-dev, go-vet-prod, go-lint, go-staticcheck-dev, go-staticcheck-prod, go-gosec-dev, go-gosec-prod, go-mod-tidy, vulns]
runs-on: ubuntu-latest
defaults:
run:
@@ -573,6 +665,54 @@ jobs:
console.log('All overrides appear necessary');
"
frontend-deps-major:
name: Frontend major deps (warn only)
needs: [frontend-deps]
runs-on: ubuntu-latest
defaults:
run:
shell: sh
steps:
- uses: actions/checkout@v4
- name: Fix node toolcache path for Post-step cleanup
run: |
mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
- name: Restore npm dependencies
uses: actions/cache@v4
with:
path: |
~/.npm
frontend/node_modules
key: ${{ runner.os }}-npm-${{ hashFiles('frontend/package-lock.json') }}
restore-keys: |
${{ runner.os }}-npm-
- name: Install dependencies
run: cd frontend && npm ci
- name: Check for major updates (non-blocking)
run: |
cd frontend && npm outdated --json 2>&1 | node -e "
const chunks = [];
process.stdin.on('data', c => chunks.push(c));
process.stdin.on('end', () => {
const raw = Buffer.concat(chunks).toString().trim();
if (!raw) { console.log('No dependencies to check'); process.exit(0); }
const data = JSON.parse(raw);
const major = Object.entries(data).filter(([_, v]) => v.wanted !== v.latest);
if (major.length) {
console.log('Major (out-of-range) updates available — review carefully:');
major.forEach(([k, v]) => console.log(' ' + k + ': ' + v.current + ' (wanted: ' + v.wanted + ') -> latest: ' + v.latest));
} else {
console.log('All dependencies within semver range, no major updates');
}
process.exit(0);
});
"
knip:
name: Knip
needs: [frontend-deps]