Jon Chery
df58bc25a3
---ci--- project: orca phase: 3 milestone: v0.3 status: complete requirements: covered: [REQ-022, REQ-030, REQ-032] partial: [] ---/ci--- v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that was previously on the milestone branch but not yet merged to main, plus the v0.3 completion work (iter.Seq streaming + doctor network/db). v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan). v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor), P3 (final review+ship). Total: 40 requirements, all complete. No new go.mod dependencies. Full test suite passes under -race. gofmt + go vet clean.
115 lines
4.2 KiB
YAML
115 lines
4.2 KiB
YAML
version: "1"
|
|
name: orca-ci
|
|
description: Orca — offline/CLI-first orchestration engine. Full release flow via CoreCI.
|
|
|
|
# CoreCI configuration for orca.
|
|
#
|
|
# Each pipeline runs in an isolated container with the golang:1.25 toolchain.
|
|
# All four pipelines (validate, build, test, release) must pass before a tag
|
|
# can be published. The release pipeline is gated on the existence of a
|
|
# semver tag (vX.Y.Z) and is the only pipeline that touches the Gitea API.
|
|
#
|
|
# P03 (v0.2) added three security-scanning stages to the `validate` pipeline:
|
|
# - gosec (REQ-014, REQ-040) Static analysis for Go security smells
|
|
# - govulncheck (REQ-014, REQ-027) Offline vuln scan of dependencies
|
|
# - gitleaks (REQ-039) Pre-commit-style secret scan
|
|
# The `test` pipeline runs with -race (REQ-031).
|
|
# See docs/security-scanning.md for operator-facing details.
|
|
|
|
pipelines:
|
|
validate:
|
|
description: Validate Go toolchain, formatting, and security scans
|
|
steps:
|
|
- name: go-version
|
|
image: golang:1.25
|
|
commands:
|
|
- go version
|
|
- gofmt -l .
|
|
- go vet ./...
|
|
|
|
- name: gosec
|
|
image: golang:1.25
|
|
commands:
|
|
- go install github.com/securego/gosec/v2/cmd/gosec@v2.18.2
|
|
- gosec -fmt text -quiet ./...
|
|
|
|
- name: govulncheck
|
|
image: golang:1.25
|
|
env:
|
|
# REQ-027: offline mode. GOFLAGS=-mod=mod ensures module mode;
|
|
# GOVULNCHECK_DB (when present) overrides the bundled DB.
|
|
GOFLAGS: -mod=mod
|
|
commands:
|
|
- go install golang.org/x/vuln/cmd/govulncheck@v1.1.3
|
|
- govulncheck -mode binary ./...
|
|
|
|
- name: gitleaks
|
|
image: golang:1.25
|
|
commands:
|
|
- apk add --no-cache curl
|
|
- sh -c "$(curl -fsSL https://github.com/gitleaks/gitleaks/releases/latest/download/install.sh)"
|
|
- gitleaks detect --source . --config .gitleaks.toml --baseline-path .gitleaks-baseline.json --no-banner
|
|
|
|
build:
|
|
description: Build the orca binary with version injection
|
|
steps:
|
|
- name: build
|
|
image: golang:1.25
|
|
env:
|
|
VERSION: ${CI_COMMIT_TAG:-dev}
|
|
GIT_COMMIT: ${CI_COMMIT_SHA}
|
|
BUILD_TIME: ${CI_BUILD_TIME}
|
|
commands:
|
|
- |
|
|
LDFLAGS="-s -w \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.buildTime=${BUILD_TIME}"
|
|
go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca
|
|
- file bin/orca
|
|
- ./bin/orca version
|
|
|
|
test:
|
|
description: Run all tests with race detection and coverage (REQ-031)
|
|
steps:
|
|
- name: test
|
|
image: golang:1.25
|
|
commands:
|
|
- go test -race -coverprofile=coverage.out ./...
|
|
- go tool cover -func=coverage.out | tail -1
|
|
|
|
release:
|
|
description: Full release flow — versioned build, tarball, changelog, Gitea release
|
|
when:
|
|
ref: "refs/tags/v*"
|
|
steps:
|
|
- name: build-artifact
|
|
image: golang:1.25
|
|
env:
|
|
VERSION: ${CI_COMMIT_TAG}
|
|
GIT_COMMIT: ${CI_COMMIT_SHA}
|
|
BUILD_TIME: ${CI_BUILD_TIME}
|
|
commands:
|
|
- |
|
|
LDFLAGS="-s -w \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.buildTime=${BUILD_TIME}"
|
|
go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca
|
|
- make changelog
|
|
- tar -czf orca-${VERSION}-linux-amd64.tar.gz -C bin orca
|
|
- ls -lh orca-${VERSION}-linux-amd64.tar.gz
|
|
- name: gitea-release
|
|
image: golang:1.25
|
|
env:
|
|
GITEA_TOKEN: ${GITEA_TOKEN}
|
|
VERSION: ${CI_COMMIT_TAG}
|
|
commands:
|
|
- apk add --no-cache curl tar
|
|
- sh -c "$(curl -fsSL https://gitea.com/gitea/tea/releases/latest/download/install.sh)"
|
|
- tea releases create ${VERSION}
|
|
--repo coreci/orca
|
|
--title "Orca ${VERSION}"
|
|
--note-file CHANGELOG.md
|
|
--asset orca-${VERSION}-linux-amd64.tar.gz
|