Merge pull request #13 from perplexityai/codex/precision-followups #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| race: true | |
| - os: macos-latest | |
| race: true | |
| - os: windows-latest | |
| race: false | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| check-latest: true | |
| - name: go mod tidy | |
| shell: bash | |
| run: | | |
| go mod tidy | |
| git diff --exit-code -- go.mod go.sum | |
| - name: gofmt | |
| shell: bash | |
| run: | | |
| out=$(gofmt -l .) | |
| if [ -n "$out" ]; then | |
| echo "gofmt found unformatted files:" | |
| echo "$out" | |
| exit 1 | |
| fi | |
| - name: go vet | |
| run: go vet ./... | |
| - name: go test (race) | |
| if: matrix.race | |
| run: go test -race ./... | |
| - name: go test | |
| if: ${{ !matrix.race }} | |
| run: go test ./... | |
| - name: go build | |
| run: go build -buildvcs=false ./cmd/numbat | |
| lint: | |
| name: golangci-lint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| check-latest: true | |
| - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: v2.12.2 | |
| # golangci-lint run does not execute formatters in v2; fmt does. This | |
| # gates gofumpt (and gofmt) on top of the lint pass above, reusing the | |
| # binary the action installed. | |
| - name: golangci-lint fmt | |
| run: golangci-lint fmt --diff | |
| fuzz: | |
| name: fuzz | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| check-latest: true | |
| # Bounded fuzzing: each target runs briefly to surface crashers without | |
| # turning into an open-ended job. The parsers and the redaction decoder | |
| # must survive arbitrary and malformed input without panicking. | |
| - name: fuzz extract parsers | |
| run: | | |
| for t in FuzzClaudeExtract FuzzCodexExtract FuzzGeminiExtract FuzzPiExtract FuzzKimiCodeExtract; do | |
| go test -run='^$' -fuzz="^${t}$" -fuzztime=30s ./internal/extract/ | |
| done | |
| - name: fuzz redaction decoder | |
| run: go test -run='^$' -fuzz='^FuzzString$' -fuzztime=30s ./internal/redact/ | |
| - name: fuzz OTLP decoder | |
| run: go test -run='^$' -fuzz='^FuzzOTLPLogs$' -fuzztime=30s ./internal/otel/ | |
| coverage: | |
| name: coverage (informational) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| check-latest: true | |
| # Non-gating: report total coverage for visibility, never fail the build | |
| # on it. No threshold is enforced. | |
| - name: go test coverage | |
| run: go test -coverprofile=coverage.out ./... | |
| - name: coverage summary | |
| run: | | |
| go tool cover -func=coverage.out | tail -n 1 | |
| { | |
| echo "### Coverage (informational)" | |
| echo '```' | |
| go tool cover -func=coverage.out | tail -n 1 | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: upload coverage profile | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-profile | |
| path: coverage.out | |
| govulncheck: | |
| name: govulncheck | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| check-latest: true | |
| - name: install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@v1.6.0 | |
| - name: govulncheck | |
| run: govulncheck ./... |