Commit 53f2b88075
53f2b880754582552f978b846a6e0da037a75d32
parent: 4e84b5e54e
Verified · cmc ci/build: failure ci/quality: success ci/test: failure
cmc <hello@cleberg.net> · 2026-10-22 18:15 UTC
ci: add Qlty quality job
The quality job fails on secrets (trufflehog) and gofmt, and prints the
full report, including radarlint-go's Sonar rules, without failing. The
nightly vuln job also runs osv-scanner, which reports advisories in
dependencies the code does not call.
GO-2026-5932 (x/crypto/openpgp) is ignored: gitbay imports
github.com/ProtonMail/go-crypto/openpgp, not that package.
Layout: unified · split
.gitbay/ci.yml
+16
| @@ -19,6 +19,18 @@ jobs: |
| 19 | 19 | - go test ./... -count=1 -timeout 20m |
| 20 | 20 | paths-ignore: |
| 21 | 21 | - .gitbay/wiki/** |
| 22 | # Static analysis through Qlty (.qlty/qlty.toml). Secrets and gofmt fail |
| 23 | # the build. The full report, including radarlint-go's Sonar rules, is |
| 24 | # printed without failing it. The CLI is pinned, and unpacked with Python |
| 25 | # because this image has no xz. |
| 26 | quality: |
| 27 | image: localhost/gitbay-ci:2 |
| 28 | steps: |
| 29 | - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp')" |
| 30 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter trufflehog,gofmt |
| 31 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --no-fail |
| 32 | paths-ignore: |
| 33 | - .gitbay/wiki/** |
| 22 | 34 | # Vulnerability scanning, separate from test so a newly published advisory |
| 23 | 35 | # against unchanged code does not mask a real test failure. It fails the |
| 24 | 36 | # build on purpose: an advisory that only lands in a report nobody reads is |
| @@ -37,3 +49,7 @@ jobs: |
| 37 | 49 | schedule: "0 3 * * *" |
| 38 | 50 | steps: |
| 39 | 51 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
| 52 | # osv-scanner also reports advisories in dependencies the code does not |
| 53 | # call, which govulncheck skips. |
| 54 | - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp')" |
| 55 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter osv-scanner |
.qlty/.gitignore
added
+7
| @@ -0,0 +1,7 @@ |
| 1 | * |
| 2 | !configs |
| 3 | !configs/** |
| 4 | !hooks |
| 5 | !hooks/** |
| 6 | !qlty.toml |
| 7 | !.gitignore |
.qlty/qlty.toml
added
+66
| @@ -0,0 +1,66 @@ |
| 1 | config_version = "0" |
| 2 | |
| 3 | # Qlty's generated defaults exclude **/config/** and **/templates/**, which |
| 4 | # would skip internal/config. |
| 5 | exclude_patterns = [ |
| 6 | "**/testdata/**", |
| 7 | "**/vendor/**", |
| 8 | ".gitbay/wiki/**", |
| 9 | ] |
| 10 | |
| 11 | test_patterns = [ |
| 12 | "**/*_test.go", |
| 13 | "e2e/**", |
| 14 | ] |
| 15 | |
| 16 | [smells] |
| 17 | mode = "comment" |
| 18 | |
| 19 | [[source]] |
| 20 | name = "default" |
| 21 | default = true |
| 22 | |
| 23 | [[plugin]] |
| 24 | name = "golangci-lint" |
| 25 | version = "2.15.0" |
| 26 | drivers = ["lint"] |
| 27 | |
| 28 | [[plugin]] |
| 29 | name = "gofmt" |
| 30 | |
| 31 | [[plugin]] |
| 32 | name = "radarlint-go" |
| 33 | |
| 34 | [[plugin]] |
| 35 | name = "osv-scanner" |
| 36 | |
| 37 | [[plugin]] |
| 38 | name = "trufflehog" |
| 39 | |
| 40 | [[plugin]] |
| 41 | name = "shellcheck" |
| 42 | |
| 43 | [[plugin]] |
| 44 | name = "ruff" |
| 45 | drivers = ["lint"] |
| 46 | |
| 47 | # Repeated literals are expected in table-driven and end-to-end tests. |
| 48 | [[triage]] |
| 49 | match.plugins = ["radarlint-go"] |
| 50 | match.rules = ["radarlint-go:go:S1192"] |
| 51 | match.file_patterns = ["**/*_test.go", "e2e/**"] |
| 52 | set.ignored = true |
| 53 | |
| 54 | # Unchecked errors in tests are setup and teardown calls. |
| 55 | [[triage]] |
| 56 | match.plugins = ["golangci-lint"] |
| 57 | match.rules = ["golangci-lint:errcheck"] |
| 58 | match.file_patterns = ["**/*_test.go", "e2e/**"] |
| 59 | set.ignored = true |
| 60 | |
| 61 | # x/crypto/openpgp is deprecated with no fixed version. gitbay imports |
| 62 | # github.com/ProtonMail/go-crypto/openpgp, not that package. |
| 63 | [[triage]] |
| 64 | match.plugins = ["osv-scanner"] |
| 65 | match.rules = ["osv-scanner:GO-2026-5932"] |
| 66 | set.ignored = true |