117 lines
3.1 KiB
YAML
117 lines
3.1 KiB
YAML
name: CI
|
||
|
||
on:
|
||
push:
|
||
branches: ["**"]
|
||
pull_request:
|
||
|
||
permissions:
|
||
contents: read
|
||
|
||
jobs:
|
||
build:
|
||
name: 构建 / 静态检查 / 测试
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- uses: actions/setup-go@v5
|
||
with:
|
||
go-version-file: go.mod
|
||
cache: true
|
||
|
||
# 格式检查：任何未 gofmt 的文件都会让 CI 失败
|
||
- name: gofmt
|
||
run: |
|
||
unformatted="$(gofmt -l .)"
|
||
if [ -n "$unformatted" ]; then
|
||
echo "以下文件未通过 gofmt："
|
||
echo "$unformatted"
|
||
exit 1
|
||
fi
|
||
|
||
- name: go vet
|
||
run: go vet ./...
|
||
|
||
# staticcheck 能发现 go vet 覆盖不到的问题（死代码、永不匹配的条件、
|
||
# 误用标准库等）。本仓库在 ecdsax/ 下有 staticcheck.conf，对 SA1019 做了
|
||
# 定向豁免并写明了理由。
|
||
- name: staticcheck
|
||
run: |
|
||
go install honnef.co/go/tools/cmd/staticcheck@latest
|
||
staticcheck ./...
|
||
|
||
- name: go build
|
||
run: go build ./...
|
||
|
||
# -race 能发现并发使用中的问题；本库的函数应全部可并发调用
|
||
- name: go test
|
||
run: go test -race -covermode=atomic -coverprofile=coverage.txt ./...
|
||
|
||
- name: 覆盖率摘要
|
||
run: go tool cover -func=coverage.txt | tail -n 20
|
||
|
||
- name: 上传覆盖率
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: coverage
|
||
path: coverage.txt
|
||
|
||
vulncheck:
|
||
name: 依赖漏洞扫描
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- uses: actions/setup-go@v5
|
||
with:
|
||
go-version-file: go.mod
|
||
cache: true
|
||
|
||
# govulncheck 只报告「代码确实会走到」的漏洞，比单纯比对版本号更准
|
||
- name: govulncheck
|
||
run: |
|
||
go install golang.org/x/vuln/cmd/govulncheck@latest
|
||
govulncheck ./...
|
||
|
||
fuzz:
|
||
name: 模糊测试冒烟
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- uses: actions/setup-go@v5
|
||
with:
|
||
go-version-file: go.mod
|
||
cache: true
|
||
|
||
# 每个目标短跑一段时间。解密路径的输入直接来自不可信来源，这里是对
|
||
# "绝不 panic" 承诺的持续验证。
|
||
- name: fuzz 冒烟
|
||
run: |
|
||
for target in FuzzDecryptNeverPanics FuzzDecryptWithIVNeverPanics \
|
||
FuzzSymmetricRoundTrip FuzzAEADTamperDetection; do
|
||
echo "===== $target ====="
|
||
go test -run='^$' -fuzz="^${target}$" -fuzztime=30s .
|
||
done
|
||
|
||
tidy:
|
||
name: go.mod 一致性
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- uses: actions/setup-go@v5
|
||
with:
|
||
go-version-file: go.mod
|
||
cache: true
|
||
|
||
# 确保 go.mod / go.sum 与源码 import 保持一致
|
||
- name: go mod tidy 检查
|
||
run: |
|
||
cp go.mod go.mod.bak
|
||
cp go.sum go.sum.bak
|
||
go mod tidy
|
||
diff -u go.mod.bak go.mod
|
||
diff -u go.sum.bak go.sum
|