.gitbay/ci.yml

 1jobs:
 2  # Fast feedback: this finishes in seconds, so it is not held behind the
 3  # suite.
 4  build:
 5    image: localhost/gitbay-ci:2
 6    steps:
 7      - go build ./...
 8      - go vet ./...
 9  # The suite drives real git, ssh, sshd and gpg. Several tests skip
10  # themselves when a tool is absent, so the prerequisites are asserted
11  # first, all of them in one step so one run names everything to install.
12  # A green check that quietly tested less is worse than a red one.
13  # The 20m is under the runner's own 30m limit, so go times out first and
14  # says which test hung instead of the runner killing it blind.
15  test:
16    image: localhost/gitbay-ci:2
17    steps:
18      - missing=""; for t in git git-lfs gpg; do command -v "$t" >/dev/null || missing="$missing $t"; done; test -x /usr/sbin/sshd || missing="$missing sshd"; test -z "$missing" || { echo "runner is missing:$missing"; exit 1; }
19      - go test ./... -count=1 -timeout 20m
20    paths-ignore:
21      - .gitbay/wiki/**
22  # Vulnerability scanning, separate from test so a newly published advisory
23  # against unchanged code does not mask a real test failure. It fails the
24  # build on purpose: an advisory that only lands in a report nobody reads is
25  # the state this replaced. @latest matches deploy/audit.sh, so a run scans
26  # against the database as it is today, not as it was at commit time.
27  #
28  # Nightly rather than per-push, because that last sentence is the whole
29  # job: the trigger is the advisory database, not the code. An advisory
30  # published against code nobody touched was invisible until someone
31  # happened to push, while a rebase that changed nothing re-scanned it.
32  # A schedule asks the question on the cadence the answer changes.
33  # `build trigger krz/gitbay vuln` runs it on demand before a release
34  # (#177).
35  vuln:
36    image: localhost/gitbay-ci:2
37    schedule: "0 3 * * *"
38    steps:
39      - go run golang.org/x/vuln/cmd/govulncheck@latest ./...