Skip to content

Commit 33bddcf

Browse files
tuannvmtuannvm
authored
chore(ci): update golang (#5)
* chore(ci): update golang Signed-off-by: Tommy Nguyen <tuannvm@hotmail.com> * ci(workflow): update review workflow to verify latest versions Signed-off-by: Tommy Nguyen <tuannvm@hotmail.com> * ci: add build and test workflows; add golangci config Signed-off-by: Tommy Nguyen <tuannvm@hotmail.com> --------- Signed-off-by: Tommy Nguyen <tuannvm@hotmail.com>
1 parent af38271 commit 33bddcf

File tree

5 files changed

+199
-4
lines changed

5 files changed

+199
-4
lines changed

‎.github/workflows/build.yml‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
name: Build & Verify Pipeline
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths-ignore:
7+
- "**.md"
8+
- ".github/ISSUE_TEMPLATE/**"
9+
- ".gitignore"
10+
pull_request:
11+
paths-ignore:
12+
- "**.md"
13+
- ".github/ISSUE_TEMPLATE/**"
14+
- ".gitignore"
15+
16+
permissions:
17+
contents: read
18+
packages: write
19+
id-token: write # Required for SLSA provenance
20+
security-events: write # Required for uploading security results
21+
pull-requests: read
22+
checks: write
23+
24+
env:
25+
GO_VERSION: "1.24.9"
26+
27+
jobs:
28+
# Static analysis and code quality check
29+
verify:
30+
name: Code Quality
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Checkout code
34+
uses: actions/checkout@v5
35+
with:
36+
fetch-depth: 0
37+
persist-credentials: false
38+
39+
- name: Set up Go
40+
uses: actions/setup-go@v6
41+
with:
42+
go-version: ${{ env.GO_VERSION }}
43+
cache: true
44+
check-latest: true
45+
46+
- name: Install dependencies
47+
run: |
48+
go mod download
49+
go mod verify
50+
51+
- name: Check Go mod tidy
52+
run: |
53+
go mod tidy
54+
if ! git diff --quiet go.mod go.sum; then
55+
echo "go.mod or go.sum is not tidy, run 'go mod tidy'"
56+
git diff go.mod go.sum
57+
exit 1
58+
fi
59+
60+
- name: Install golangci-lint
61+
uses: golangci/golangci-lint-action@v8
62+
with:
63+
version: latest
64+
args: --timeout=5m
65+
install-mode: binary
66+
skip-pkg-cache: true
67+
skip-build-cache: true
68+
69+
- name: Run linters
70+
run: golangci-lint run
71+
72+
# Security vulnerability scanning and SBOM generation
73+
security:
74+
name: Security Scan
75+
runs-on: ubuntu-latest
76+
needs: verify
77+
steps:
78+
- name: Checkout code
79+
uses: actions/checkout@v5
80+
with:
81+
persist-credentials: false
82+
83+
- name: Set up Go
84+
uses: actions/setup-go@v6
85+
with:
86+
go-version: ${{ env.GO_VERSION }}
87+
cache: true
88+
89+
- name: Run Go Vulnerability Check
90+
run: |
91+
go install golang.org/x/vuln/cmd/govulncheck@latest
92+
govulncheck ./...
93+
94+
- name: Run dependency scan
95+
uses: aquasecurity/trivy-action@0.33.1
96+
with:
97+
scan-type: "fs"
98+
scan-ref: "."
99+
format: "sarif"
100+
output: "trivy-results.sarif"
101+
severity: "CRITICAL,HIGH,MEDIUM"
102+
timeout: "10m"
103+
104+
- name: Upload security scan results
105+
uses: github/codeql-action/upload-sarif@v4
106+
if: always()
107+
with:
108+
sarif_file: "trivy-results.sarif"
109+
110+
- name: Generate SBOM
111+
uses: anchore/sbom-action@v0.20.9
112+
with:
113+
format: spdx-json
114+
output-file: sbom.spdx.json
115+
116+
- name: Upload SBOM
117+
uses: actions/upload-artifact@v5
118+
with:
119+
name: sbom
120+
path: sbom.spdx.json
121+
retention-days: 30
122+
123+
# Run unit and integration tests with code coverage
124+
test:
125+
name: Run Tests
126+
runs-on: ubuntu-latest
127+
needs: verify
128+
steps:
129+
- name: Checkout code
130+
uses: actions/checkout@v5
131+
with:
132+
persist-credentials: false
133+
134+
- name: Set up Go
135+
uses: actions/setup-go@v6
136+
with:
137+
go-version: ${{ env.GO_VERSION }}
138+
cache: true
139+
140+
- name: Run tests
141+
run: go test -v -race -coverprofile=coverage.txt -covermode=atomic ./...
142+
143+
- name: Upload coverage
144+
uses: codecov/codecov-action@v5
145+
with:
146+
file: ./coverage.txt
147+
flags: unittests
148+
fail_ci_if_error: false
149+
150+
# Simple build verification (for PRs and non-main branches)
151+
build:
152+
name: Build Verification
153+
runs-on: ubuntu-latest
154+
needs: [verify, security]
155+
# Only run for PRs or pushes to non-main branches
156+
if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref != 'refs/heads/main')
157+
steps:
158+
- name: Checkout code
159+
uses: actions/checkout@v5
160+
with:
161+
persist-credentials: false
162+
163+
- name: Set up Go
164+
uses: actions/setup-go@v6
165+
with:
166+
go-version: ${{ env.GO_VERSION }}
167+
cache: true
168+
169+
- name: Build all packages
170+
run: go build -v ./...
171+
172+
- name: Build examples
173+
run: |
174+
for example in $(find examples -name main.go 2>/dev/null); do
175+
echo "Building $example..."
176+
go build "$example"
177+
done

‎.github/workflows/cursor.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,12 +51,19 @@ jobs:
5151
Objectives:
5252
1) Re-check existing review comments and reply resolved when addressed.
5353
2) Review the current PR diff and flag only clear, high-severity issues.
54-
3) Leave very short inline comments (1-2 sentences) on changed lines only and a brief summary at the end.
54+
3) Verify language and library versions against latest releases using web search.
55+
4) Leave very short inline comments (1-2 sentences) on changed lines only and a brief summary at the end.
5556
5657
Procedure:
5758
- Get existing comments: gh pr view --json comments
5859
- Get diff: gh pr diff
5960
- Get changed files with patches to compute inline positions: gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files --paginate --jq '.[] | {filename,patch}'
61+
- IMPORTANT: When reviewing files that specify versions (go.mod, package.json, requirements.txt, Dockerfile, GitHub Actions workflows, etc.), MUST search the web for:
62+
- Latest stable versions of languages (Go, Node.js, Python, etc.)
63+
- Latest versions of libraries/dependencies
64+
- Latest versions of base images (Docker)
65+
- Latest versions of GitHub Actions
66+
- Compare found versions with what's in the PR and flag outdated versions
6067
- Compute exact inline anchors for each issue (file path + diff position). Comments MUST be placed inline on the changed line in the diff, not as top-level comments.
6168
- Detect prior top-level "no issues" style comments authored by this bot (match bodies like: "✅ no issues", "No issues found", "LGTM").
6269
- If CURRENT run finds issues and any prior "no issues" comments exist:
@@ -74,14 +81,16 @@ jobs:
7481
- Obvious logic errors with incorrect behavior
7582
- Clear performance anti-patterns with measurable impact
7683
- Definitive security vulnerabilities
84+
- Outdated language/library/dependency/action versions (use web search to verify latest)
85+
- Deprecated APIs or patterns (search documentation for current best practices)
7786
- Avoid duplicates: skip if similar feedback already exists on or near the same lines.
7887
7988
Commenting rules:
8089
- Max 10 inline comments total; prioritize the most critical issues
8190
- One issue per comment; place on the exact changed line
8291
- All issue comments MUST be inline (anchored to a file and line/position in the PR diff)
8392
- Natural tone, specific and actionable; do not mention automated or high-confidence
84-
- Use emojis: 🚨 Critical 🔒 Security ⚡ Performance ⚠️ Logic ✅ Resolved ✨ Improvement
93+
- Use emojis: 🚨 Critical 🔒 Security ⚡ Performance ⚠️ Logic 📦 Outdated Version 🔄 Deprecated ✅ Resolved ✨ Improvement
8594
8695
Submission:
8796
- If there are NO issues to report and an existing top-level comment indicating "no issues" already exists (e.g., "✅ no issues", "No issues found", "LGTM"), do NOT submit another comment. Skip submission to avoid redundancy.

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ permissions:
1010
contents: read
1111

1212
env:
13-
GO_VERSION: "1.25"
13+
GO_VERSION: "1.24.9"
1414

1515
jobs:
1616
test:

‎.golangci.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Define the configuration version
2+
version: "2"
3+
4+
run:
5+
timeout: 5m
6+
modules-download-mode: readonly
7+
8+
linters:
9+
default: standard

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/tuannvm/oauth-mcp-proxy
22

3-
go 1.24.0
3+
go 1.24.9
44

55
require (
66
github.com/coreos/go-oidc/v3 v3.16.0

0 commit comments

Comments
 (0)