feat(exec,export): .pass-cli.toml manifest + --from (#115.4, completes #115) #416
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| # NOTE: no paths-ignore on either push or pull_request. The required status | |
| # checks (Lint, Unit Tests, Build, Integration Tests) are ruleset requirements | |
| # on both the `main` branch and the `refs/tags/v*` release tags, so they must | |
| # *report* on every main commit and every PR — otherwise (a) a PR can never | |
| # merge, and (b) a `v*` tag created on a docs-only commit is rejected because | |
| # the checks never ran on that SHA (see #114). The jobs below already | |
| # short-circuit to success via "Skip if no code changes" when check-changes | |
| # finds no Go/build files, so non-code pushes/PRs (docs, skills, .gitignore) | |
| # still satisfy the required checks in seconds. A workflow-level paths-ignore | |
| # would suppress the whole workflow and leave those commits/PRs blocked. | |
| push: | |
| branches: [main] | |
| tags-ignore: | |
| - 'v*' | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| check-changes: | |
| name: Detect Code Changes | |
| runs-on: ubuntu-latest | |
| outputs: | |
| code-changed: ${{ steps.filter.outputs.code-files }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Check for code changes | |
| uses: dorny/paths-filter@v3 | |
| id: filter | |
| with: | |
| filters: | | |
| code-files: | |
| - '**/*.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - '.golangci.yml' | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| needs: check-changes | |
| steps: | |
| - name: Skip if no code changes | |
| if: needs.check-changes.outputs.code-changed != 'true' | |
| run: | | |
| echo "No code changes detected, skipping lint" | |
| exit 0 | |
| - name: Checkout code | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| cache-dependency-path: go.sum | |
| - name: Cache golangci-lint | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.cache/golangci-lint | |
| key: ${{ runner.os }}-golangci-lint-${{ hashFiles('.golangci.yml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-golangci-lint- | |
| - name: Run golangci-lint | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: golangci/golangci-lint-action@v9 | |
| with: | |
| version: v2.5 | |
| args: --timeout=3m --build-tags integration | |
| unit-tests: | |
| name: Unit Tests | |
| runs-on: ubuntu-latest | |
| needs: check-changes | |
| steps: | |
| - name: Skip if no code changes | |
| if: needs.check-changes.outputs.code-changed != 'true' | |
| run: | | |
| echo "No code changes detected, skipping unit tests" | |
| exit 0 | |
| - name: Checkout code | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| cache-dependency-path: go.sum | |
| - name: Set up Linux keychain (D-Bus + gnome-keyring) | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gnome-keyring dbus-x11 | |
| shell: bash | |
| - name: Run unit tests | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| run: | | |
| # Start D-Bus session | |
| eval $(dbus-launch --sh-syntax) | |
| # Start and unlock gnome-keyring for Secret Service API | |
| gnome-keyring-daemon --start --components=secrets & | |
| sleep 1 | |
| echo "" | gnome-keyring-daemon --unlock | |
| # Run tests | |
| go test -v -coverprofile=coverage.txt -covermode=atomic ./... | |
| shell: bash | |
| - name: Upload coverage to Codecov | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| files: ./coverage.txt | |
| flags: unittests | |
| name: codecov-ubuntu | |
| continue-on-error: true | |
| integration-tests: | |
| name: Integration Tests (${{ matrix.os }}) | |
| if: github.event_name == 'pull_request' | |
| runs-on: ${{ matrix.os }} | |
| needs: check-changes | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - name: Skip if no code changes | |
| if: needs.check-changes.outputs.code-changed != 'true' | |
| run: | | |
| echo "No code changes detected, skipping integration tests" | |
| exit 0 | |
| - name: Checkout code | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| cache-dependency-path: go.sum | |
| - name: Run integration tests | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| run: go test -v -tags=integration -timeout 4m ./test/integration | |
| shell: bash | |
| - name: Check for TODO-skipped tests | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| run: | | |
| if grep -r 't.Skip("TODO:' test/integration; then | |
| echo "ERROR: Found TODO-skipped tests" | |
| exit 1 | |
| fi | |
| shell: bash | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| needs: [check-changes, unit-tests, integration-tests] | |
| if: ${{ !failure() && !cancelled() }} | |
| steps: | |
| - name: Skip if no code changes | |
| if: needs.check-changes.outputs.code-changed != 'true' | |
| run: | | |
| echo "No code changes detected, skipping build" | |
| exit 0 | |
| - name: Checkout code | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| cache-dependency-path: go.sum | |
| - name: Run GoReleaser (snapshot) | |
| if: needs.check-changes.outputs.code-changed == 'true' | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| # Pinned (not `latest`) so GoReleaser upgrades are deliberate and get | |
| # exercised by this snapshot Build job before they can affect a real | |
| # release. `latest` silently rolls forward at tag time — a future | |
| # GoReleaser that removes the deprecated `brews:` key would otherwise | |
| # break the release with no advance warning (see #113). | |
| version: v2.16.0 | |
| args: build --snapshot --clean |