Files
Git-Identity-Audit/.github/workflows/ci.yml
T
CopilotGitHubcopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
c91d9c0884 Harden CI workflow token scope with explicit default permissions (#2)
* Initial plan

* fix: add least-privilege workflow token permissions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
2026-07-27 14:52:19 +07:00

76 lines
1.8 KiB
YAML

name: CI
on:
push:
branches: [main]
tags: ["*.*.*"]
pull_request:
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/setup-go@v6
with:
go-version: "1.26.4"
- run: go build ./...
- run: go vet ./...
- run: go test ./...
build:
needs: test
runs-on: ubuntu-latest
strategy:
matrix:
include:
- goos: linux
goarch: amd64
- goos: linux
goarch: arm64
- goos: darwin
goarch: amd64
- goos: darwin
goarch: arm64
- goos: windows
goarch: amd64
steps:
- uses: actions/checkout@v5
- uses: actions/setup-go@v6
with:
go-version: "1.26.4"
- name: Build
env:
GOOS: ${{ matrix.goos }}
GOARCH: ${{ matrix.goarch }}
CGO_ENABLED: "0"
VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || github.sha }}
run: |
ext=""
if [ "$GOOS" = "windows" ]; then ext=".exe"; fi
mkdir -p dist
go build -o "dist/git-identity-audit-${VERSION}-${GOOS}-${GOARCH}${ext}" .
- uses: actions/upload-artifact@v5
with:
name: git-identity-audit-${{ matrix.goos }}-${{ matrix.goarch }}
path: dist/*
release:
if: startsWith(github.ref, 'refs/tags/')
needs: build
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/download-artifact@v6
with:
path: dist
merge-multiple: true
- uses: softprops/action-gh-release@v2
with:
name: ${{ github.ref_name }}
files: dist/*