Jon Chery
df3f980fa0
CoreCI's SQLite logging fills the runner's disk during go test -race,
causing the release job to fail when writing the tarball (3-second
failure). The release job ran inside CoreCI's shell-isolated executor
which shares the same disk as CoreCI's SQLite DB.
Fix: move the release logic (build tarball + upload to Gitea) to a
separate Gitea Actions step that runs AFTER coreci run completes.
This step runs in the Gitea Actions runner directly (full env, no
CoreCI disk constraints). The .coreci.yml now only has build→test
jobs. The release is handled by scripts/ci-release.sh called from the
Gitea Actions workflow.
Architecture:
Gitea Actions ci job:
1. Checkout + Set up Go + Install CoreCI
2. coreci run (executes .coreci.yml: build → test)
3. sh scripts/ci-release.sh (build tarball + upload to Gitea API)
---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---
103 lines
4.1 KiB
Bash
Executable File
103 lines
4.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# ci-run.sh — CoreCI pipeline runner for orca.
|
|
# Called by .coreci.yml jobs via: sh scripts/ci-run.sh <job-name>
|
|
#
|
|
# CoreCI's ValidateShellCommand forbids shell metacharacters (&|;`><$())
|
|
# in the invoke: string. This script wraps the complex logic so the
|
|
# invoke: field is just "sh scripts/ci-run.sh <job-name>".
|
|
#
|
|
# Environment variables (provided by CoreCI's CI context + PassThroughEnv):
|
|
# CI_COMMIT_BRANCH — tag name on tag pushes (from GITHUB_REF_NAME)
|
|
# CI_COMMIT_SHA — commit SHA
|
|
# GITEA_TOKEN — Gitea API token (from Gitea Actions secret PAT_TOKEN)
|
|
#
|
|
# NOTE: uses #!/bin/sh — do NOT use bash-only features (pipefail, [[ ]], etc.)
|
|
# The Gitea Actions runner uses dash as /bin/sh.
|
|
|
|
set -u
|
|
|
|
JOB="${1:-}"
|
|
if [ -z "$JOB" ]; then
|
|
echo "usage: sh scripts/ci-run.sh <job-name>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# CoreCI's shell-isolated executor (buildIsolatedEnv) does NOT forward
|
|
# Go toolchain env vars (GOROOT, GOPATH, GOCACHE, GOMODCACHE are in the
|
|
# systemVars deny-list). Re-derive them from the `go` binary on PATH so
|
|
# Go commands work in the shell-isolated executor.
|
|
echo "ci-run: PATH=$PATH" >&2
|
|
echo "ci-run: which go=$(command -v go 2>/dev/null || echo 'not found')" >&2
|
|
if command -v go >/dev/null 2>&1; then
|
|
export GOROOT="${GOROOT:-$(go env GOROOT 2>/dev/null || echo "")}"
|
|
export GOPATH="${GOPATH:-$(go env GOPATH 2>/dev/null || echo "$HOME/go")}"
|
|
export GOCACHE="${GOCACHE:-$(go env GOCACHE 2>/dev/null || echo "$HOME/.cache/go-build")}"
|
|
export GOMODCACHE="${GOMODCACHE:-$(go env GOMODCACHE 2>/dev/null || echo "$HOME/go/pkg/mod")}"
|
|
echo "ci-run: GOROOT=$GOROOT GOPATH=$GOPATH GOCACHE=$GOCACHE GOMODCACHE=$GOMODCACHE" >&2
|
|
fi
|
|
|
|
info() { echo "ci-run: $*"; }
|
|
err() { echo "ci-run: error: $*" >&2; exit 1; }
|
|
|
|
case "$JOB" in
|
|
# ── validate ──────────────────────────────────────────────────────
|
|
go-vet)
|
|
go version
|
|
gofmt -l .
|
|
go vet ./...
|
|
;;
|
|
|
|
verify-reqs)
|
|
make verify-reqs
|
|
;;
|
|
|
|
gosec)
|
|
go install github.com/securego/gosec/v2/cmd/gosec@v2.18.2
|
|
gosec -fmt text -quiet ./...
|
|
;;
|
|
|
|
govulncheck)
|
|
go install golang.org/x/vuln/cmd/govulncheck@v1.1.3
|
|
govulncheck -mode binary ./...
|
|
;;
|
|
|
|
gitleaks)
|
|
curl -fsSL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks-linux-amd64.tar.gz -o /tmp/gitleaks.tar.gz
|
|
tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
|
|
mv /tmp/gitleaks /usr/local/bin/gitleaks 2>/dev/null || cp /tmp/gitleaks ./gitleaks
|
|
chmod +x ./gitleaks 2>/dev/null || true
|
|
if [ -x ./gitleaks ]; then
|
|
./gitleaks detect --source . --config .gitleaks.toml --baseline-path .gitleaks-baseline.json --no-banner
|
|
else
|
|
gitleaks detect --source . --config .gitleaks.toml --baseline-path .gitleaks-baseline.json --no-banner
|
|
fi
|
|
;;
|
|
|
|
# ── build ──────────────────────────────────────────────────────────
|
|
build)
|
|
info "building orca binary..."
|
|
VERSION="${CI_COMMIT_BRANCH:-dev}"
|
|
GIT_COMMIT="${CI_COMMIT_SHA:-unknown}"
|
|
BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
info "VERSION=$VERSION GIT_COMMIT=$GIT_COMMIT BUILD_TIME=$BUILD_TIME"
|
|
LDFLAGS="-s -w \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
|
|
-X git.cloudinit.dev/coreci/orca/internal/cli.buildTime=${BUILD_TIME}"
|
|
mkdir -p bin
|
|
info "running: go build -trimpath -ldflags=... -o bin/orca ./cmd/orca"
|
|
go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca 2>&1 || err "go build failed with exit $?"
|
|
file bin/orca 2>/dev/null || echo "file command not available"
|
|
./bin/orca version 2>&1 || echo "orca version failed"
|
|
;;
|
|
|
|
# ── test (REQ-031: -race) ─────────────────────────────────────────
|
|
test)
|
|
go test -race -coverprofile=coverage.out ./...
|
|
go tool cover -func=coverage.out | tail -1
|
|
;;
|
|
|
|
*)
|
|
err "unknown job: ${JOB}"
|
|
;;
|
|
esac |