Plugin: add request-control Screener extension point #5600
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI - Lint | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - 'release-*' | |
| pull_request: | |
| branches: | |
| - main | |
| pull_request_target: | |
| branches: | |
| - main | |
| types: [ opened, synchronize, reopened ] | |
| permissions: | |
| contents: read | |
| actions: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-changes: | |
| # pull_request_target fires even when GITHUB_TOKEN creates the PR (e.g. the | |
| # release-notes bot). pull_request does not. We register pull_request_target | |
| # so bot-created PRs get a "skipped" conclusion that satisfies branch | |
| # protection, but we skip all real work: pull_request already covers human | |
| # PRs, and running twice would cause the concurrency group to cancel one run. | |
| if: github.event_name != 'pull_request_target' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| src: ${{ steps.filter.outputs.src }} | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@v7 | |
| - uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| src: | |
| - '**/*.go' | |
| - Dockerfile.* | |
| - Makefile* | |
| - go.mod | |
| - go.sum | |
| - .golangci.yml | |
| - .golangci-security.yml | |
| - .typos.toml | |
| - scripts/** | |
| - hack/** | |
| - test/** | |
| - .github/workflows/ci-lint.yaml | |
| lint: | |
| needs: check-changes | |
| if: ${{ needs.check-changes.outputs.src == 'true' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Verify go.mod and go.sum are tidy | |
| run: go mod tidy -diff | |
| - name: Create Go cache dirs | |
| id: go-cache | |
| run: | | |
| mkdir -p "$HOME/.cache/llm-d-gomodcache" "$HOME/.cache/llm-d-gobuildcache" | |
| echo "mod=$HOME/.cache/llm-d-gomodcache" >> "$GITHUB_OUTPUT" | |
| echo "build=$HOME/.cache/llm-d-gobuildcache" >> "$GITHUB_OUTPUT" | |
| - name: Cache Go modules and build cache | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ${{ steps.go-cache.outputs.mod }} | |
| ${{ steps.go-cache.outputs.build }} | |
| key: go-cache-${{ runner.os }}-${{ hashFiles('go.sum') }} | |
| restore-keys: | | |
| go-cache-${{ runner.os }}- | |
| - name: Run make build | |
| env: | |
| GO_MOD_CACHE_VOL: ${{ steps.go-cache.outputs.mod }} | |
| GO_BUILD_CACHE_VOL: ${{ steps.go-cache.outputs.build }} | |
| run: make build | |
| - name: Run make lint | |
| env: | |
| GO_MOD_CACHE_VOL: ${{ steps.go-cache.outputs.mod }} | |
| GO_BUILD_CACHE_VOL: ${{ steps.go-cache.outputs.build }} | |
| run: make lint | |
| - name: Run govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@v1.3.0 | |
| govulncheck ./... | |
| - name: Run make lint-security | |
| env: | |
| GO_MOD_CACHE_VOL: ${{ steps.go-cache.outputs.mod }} | |
| GO_BUILD_CACHE_VOL: ${{ steps.go-cache.outputs.build }} | |
| run: make lint-security | |
| # Fork PRs run with a read only GITHUB_TOKEN that cannot upload SARIF. | |
| - name: Upload gosec SARIF | |
| if: ${{ !cancelled() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} | |
| uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 | |
| with: | |
| sarif_file: gosec.sarif | |
| category: gosec | |
| # On runs that skip the upload above the artifact is the only way to | |
| # reach the findings. | |
| - name: Upload gosec SARIF artifact | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: gosec-sarif | |
| path: gosec.sarif | |
| retention-days: 7 | |
| if-no-files-found: warn |