👷 ci: Adds comprehensive workflows. Lint, test, release, etc. (#2)

.github/changelog.json

@@ -0,0 +1,24 @@
+{
+ "categories": [
+ {
+ "title": "## ✨ Features",
+ "labels": ["enhancement"]
+ },
+ {
+ "title": "## 🐛 Fixes",
+ "labels": ["bug"]
+ },
+ {
+ "title": "## 🎨 Cleanup",
+ "labels": ["cleanup"]
+ },
+ {
+ "title": "## 👷 CI/CD",
+ "labels": ["cicd"]
+ },
+ {
+ "title": "## 📌 Dependencies",
+ "labels": ["dependencies"]
+ }
+ ]
+}

.github/dependabot.yml

@@ -0,0 +1,28 @@
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduleinterval
+version: 2
+updates:
+ - package-ecosystem: "gomod"
+ directory: "/"
+ schedule:
+ interval: "weekly"
+ groups:
+ go:
+ update-types:
+ - "major"
+ - "minor"
+ - "patch"
+ commit-message:
+ prefix: "⬆️ go:"
+
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ schedule:
+ interval: "weekly"
+ groups:
+ github-actions:
+ update-types:
+ - "major"
+ - "minor"
+ - "patch"
+ commit-message:
+ prefix: "⬆️ gha:"

.github/labeler.yml

@@ -0,0 +1,14 @@
+enhancement:
+ - head-branch: ["^feature", "feature", "^new", "new"]
+
+bug:
+ - head-branch: ["^fix", "fix", "^bug", "bug"]
+
+cicd:
+ - head-branch: ["^ci", "ci", "^cicd", "cicd"]
+
+documentation:
+ - head-branch: ["^docs", "docs"]
+
+cleanup:
+ - head-branch: ["^cleanup", "cleanup", "^chore", "chore"]

.github/workflows/dependency-review.yml

@@ -0,0 +1,32 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: "Dependency Review"
+on: [pull_request]
+
+permissions:
+ contents: read
+
+jobs:
+ dependency-review:
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ pull-requests: write
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - name: "Checkout Repository"
+ uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - name: "Dependency Review"
+ uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
+ with:
+ comment-summary-in-pr: always

.github/workflows/dependency-update.yml

@@ -0,0 +1,44 @@
+name: "Update dependabot unsupported dependencies"
+
+on:
+ schedule:
+ - cron: "5 0 * * 1"
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+jobs:
+ pre-commit:
+ name: "Pre-commit Dependency Update"
+ runs-on: ubuntu-latest
+
+ permissions:
+ contents: read
+ pull-requests: write
+
+ steps:
+ - name: "Harden Runner"
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - name: "Checkout Repository"
+ uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+ - name: "Setup Python"
+ uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+
+ - name: "Update .pre-commit-config.yml"
+ run: |
+ pip install pre-commit
+ pre-commit autoupdate --freeze
+
+ - name: "Create new pull-request"
+ uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+ if: always()
+ with:
+ branch: update/pre-commit-hooks
+ title: "⬆️ pch: Update pre-commit hook versions"
+ commit-message: "⬆️ pch: Update pre-commit hook versions"
+ labels: "dependencies,pre-commit"

.github/workflows/gomod.yml

@@ -0,0 +1,34 @@
+name: Validate gomod dependencies
+on:
+ push:
+ branches: [main]
+ pull_request:
+ branches: [main]
+ types: [opened, synchronize, reopened]
+
+permissions:
+ contents: read
+
+jobs:
+ validate:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+ - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+ with:
+ go-version-file: go.mod
+ cache: true
+
+ - shell: bash
+ run: |
+ go mod tidy && git diff --exit-code
+
+ - shell: bash
+ run: |
+ go mod download && go mod verify

.github/workflows/lint.yml

@@ -0,0 +1,130 @@
+name: Lint
+
+on:
+ push:
+ branches: [main]
+ pull_request:
+ branches: [main]
+ types: [opened, synchronize, reopened]
+
+permissions:
+ contents: read
+
+jobs:
+ golangci-lint:
+ runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - name: golangci-lint
+ uses: reviewdog/action-golangci-lint@7708105983c614f7a2725e2172908b7709d1c3e4 # v2.6.2
+ with:
+ github_token: ${{ github.token }}
+ reporter: github-pr-review
+ fail_on_error: "false"
+ filter_mode: file
+ go_version_file: go.mod
+ prettier:
+ runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - name: create package.json
+ run: |
+ echo -e '{"devDependencies": {"prettier": "^3.1.0"}}' > package.json
+ - name: prettier
+ uses: EPMatt/reviewdog-action-prettier@93fb51ed5da157256e1d8c998fb249837304050c # v1.2.0
+ with:
+ github_token: ${{ github.token }}
+ reporter: github-pr-review
+ fail_on_error: "false"
+ filter_mode: file
+ misspell:
+ runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - name: misspell
+ uses: reviewdog/action-misspell@ef8b22c1cca06c8d306fc6be302c3dab0f6ca12f # v1.23.0
+ with:
+ github_token: ${{ github.token }}
+ reporter: github-pr-review
+ fail_on_error: "false"
+ filter_mode: file
+ exclude: |
+ ./.git/*
+ ./.cache/*
+ alex:
+ runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - name: alex
+ uses: reviewdog/action-alex@f95df9e356d97e67e4626f04ad125c4a99a906a9 # v1.13.0
+ with:
+ github_token: ${{ github.token }}
+ reporter: github-pr-review
+ fail_on_error: "false"
+ filter_mode: file
+ markdownlint:
+ runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - name: markdownlint
+ uses: reviewdog/action-markdownlint@e9f3ab4fea1433280a4b0eddca17be1340dfea94 # v0.24.0
+ with:
+ github_token: ${{ github.token }}
+ reporter: github-pr-review
+ fail_on_error: "false"
+ filter_mode: file
+ markdownlint_flags: |
+ --disable MD033 MD013 -- .
+ actionlint:
+ runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - name: actionlint
+ uses: reviewdog/action-actionlint@4f8f9963ca57a41e5fd5b538dd79dbfbd3e0b38a # v1.54.0
+ with:
+ github_token: ${{ github.token }}
+ reporter: github-pr-review
+ fail_on_error: "false"
+ filter_mode: file

.github/workflows/pr-label.yml

@@ -0,0 +1,22 @@
+name: Label Pull Request
+
+on:
+ pull_request:
+
+permissions:
+ contents: read
+
+jobs:
+ label:
+ runs-on: ubuntu-latest
+
+ permissions:
+ contents: read
+ pull-requests: write
+
+ steps:
+ - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 #v5.0.0

.github/workflows/release.yml

@@ -0,0 +1,37 @@
+name: Publish release
+
+on:
+ push:
+ tags:
+ - "v*.*.*"
+
+permissions:
+ contents: read
+
+jobs:
+ release:
+ runs-on: ubuntu-latest
+
+ permissions:
+ contents: write
+ pull-requests: write
+ deployments: write
+
+ steps:
+ - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+ with:
+ egress-policy: audit
+
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+ - uses: mikepenz/release-changelog-builder-action@f3fc77b47b74e78971fffecb2102ae6eac9a44d6 # v5
+ id: build_changelog
+ with:
+ configuration: .github/changelog.json
+ failOnError: "true"
+ fetchReviewers: "true"
+
+ - uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
+ if: startsWith(github.ref, 'refs/tags/')
+ with:
+ body: ${{steps.build_changelog.outputs.changelog}}