Commit 53f2b88075
53f2b880754582552f978b846a6e0da037a75d32
parent: 4e84b5e54e
Verified · cmc ci/build: failure ci/quality: success ci/test: failure
cmc <hello@cleberg.net> · 2026-10-22 18:15 UTC
ci: add Qlty quality job
The quality job fails on secrets (trufflehog) and gofmt, and prints the
full report, including radarlint-go's Sonar rules, without failing. The
nightly vuln job also runs osv-scanner, which reports advisories in
dependencies the code does not call.
GO-2026-5932 (x/crypto/openpgp) is ignored: gitbay imports
github.com/ProtonMail/go-crypto/openpgp, not that package.
Layout: unified · split
.gitbay/ci.yml
+16
| @@ -19,6 +19,18 @@ jobs: |
| 19 | - go test ./... -count=1 -timeout 20m |
19 | - go test ./... -count=1 -timeout 20m |
| 20 | paths-ignore: |
20 | paths-ignore: |
| 21 | - .gitbay/wiki/** |
21 | - .gitbay/wiki/** |
| |
22 | # Static analysis through Qlty (.qlty/qlty.toml). Secrets and gofmt fail |
| |
23 | # the build. The full report, including radarlint-go's Sonar rules, is |
| |
24 | # printed without failing it. The CLI is pinned, and unpacked with Python |
| |
25 | # because this image has no xz. |
| |
26 | quality: |
| |
27 | image: localhost/gitbay-ci:2 |
| |
28 | steps: |
| |
29 | - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp')" |
| |
30 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter trufflehog,gofmt |
| |
31 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --no-fail |
| |
32 | paths-ignore: |
| |
33 | - .gitbay/wiki/** |
| 22 | # Vulnerability scanning, separate from test so a newly published advisory |
34 | # Vulnerability scanning, separate from test so a newly published advisory |
| 23 | # against unchanged code does not mask a real test failure. It fails the |
35 | # against unchanged code does not mask a real test failure. It fails the |
| 24 | # build on purpose: an advisory that only lands in a report nobody reads is |
36 | # build on purpose: an advisory that only lands in a report nobody reads is |
| @@ -37,3 +49,7 @@ jobs: |
| 37 | schedule: "0 3 * * *" |
49 | schedule: "0 3 * * *" |
| 38 | steps: |
50 | steps: |
| 39 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
51 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
| |
52 | # osv-scanner also reports advisories in dependencies the code does not |
| |
53 | # call, which govulncheck skips. |
| |
54 | - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp')" |
| |
55 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter osv-scanner |
.qlty/.gitignore
added
+7
| @@ -0,0 +1,7 @@ |
| |
1 | * |
| |
2 | !configs |
| |
3 | !configs/** |
| |
4 | !hooks |
| |
5 | !hooks/** |
| |
6 | !qlty.toml |
| |
7 | !.gitignore |
.qlty/qlty.toml
added
+66
| @@ -0,0 +1,66 @@ |
| |
1 | config_version = "0" |
| |
2 | |
| |
3 | # Qlty's generated defaults exclude **/config/** and **/templates/**, which |
| |
4 | # would skip internal/config. |
| |
5 | exclude_patterns = [ |
| |
6 | "**/testdata/**", |
| |
7 | "**/vendor/**", |
| |
8 | ".gitbay/wiki/**", |
| |
9 | ] |
| |
10 | |
| |
11 | test_patterns = [ |
| |
12 | "**/*_test.go", |
| |
13 | "e2e/**", |
| |
14 | ] |
| |
15 | |
| |
16 | [smells] |
| |
17 | mode = "comment" |
| |
18 | |
| |
19 | [[source]] |
| |
20 | name = "default" |
| |
21 | default = true |
| |
22 | |
| |
23 | [[plugin]] |
| |
24 | name = "golangci-lint" |
| |
25 | version = "2.15.0" |
| |
26 | drivers = ["lint"] |
| |
27 | |
| |
28 | [[plugin]] |
| |
29 | name = "gofmt" |
| |
30 | |
| |
31 | [[plugin]] |
| |
32 | name = "radarlint-go" |
| |
33 | |
| |
34 | [[plugin]] |
| |
35 | name = "osv-scanner" |
| |
36 | |
| |
37 | [[plugin]] |
| |
38 | name = "trufflehog" |
| |
39 | |
| |
40 | [[plugin]] |
| |
41 | name = "shellcheck" |
| |
42 | |
| |
43 | [[plugin]] |
| |
44 | name = "ruff" |
| |
45 | drivers = ["lint"] |
| |
46 | |
| |
47 | # Repeated literals are expected in table-driven and end-to-end tests. |
| |
48 | [[triage]] |
| |
49 | match.plugins = ["radarlint-go"] |
| |
50 | match.rules = ["radarlint-go:go:S1192"] |
| |
51 | match.file_patterns = ["**/*_test.go", "e2e/**"] |
| |
52 | set.ignored = true |
| |
53 | |
| |
54 | # Unchecked errors in tests are setup and teardown calls. |
| |
55 | [[triage]] |
| |
56 | match.plugins = ["golangci-lint"] |
| |
57 | match.rules = ["golangci-lint:errcheck"] |
| |
58 | match.file_patterns = ["**/*_test.go", "e2e/**"] |
| |
59 | set.ignored = true |
| |
60 | |
| |
61 | # x/crypto/openpgp is deprecated with no fixed version. gitbay imports |
| |
62 | # github.com/ProtonMail/go-crypto/openpgp, not that package. |
| |
63 | [[triage]] |
| |
64 | match.plugins = ["osv-scanner"] |
| |
65 | match.rules = ["osv-scanner:GO-2026-5932"] |
| |
66 | set.ignored = true |