ci: update gh workflows and linting opts (#178)

.github/dependabot.yml

@@ -9,7 +9,7 @@ updates:
     labels:
       - "dependencies"
     commit-message:
-        prefix: "(chore) "
+        prefix: "chore: "
     groups:
       experimental-golang-deps:
         patterns:
@@ -30,7 +30,7 @@ updates:
     labels:
       - "dependencies"
     commit-message:
-      prefix: "(chore) "
+      prefix: "chore: "
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
@@ -40,4 +40,4 @@ updates:
     labels:
       - "dependencies"
     commit-message:
-      prefix: "(chore) "
+      prefix: "chore: "

.github/workflows/analyze.yaml

@@ -0,0 +1,74 @@
+name: Analyze
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read # for actions/checkout to fetch code
+  security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  generated:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "^1.23"
+      - name: Install Go Tools
+        run: |
+          go install go.uber.org/mock/[email protected]
+      - name: Init project and generate code
+        run: |
+          go mod tidy
+          go fmt ./...
+          go generate ./...
+          go run ./tools/docsgen/.
+      - name: Verify clean state
+        run: |
+          if [[ `git status . --porcelain` ]]; then
+            echo "Uncommitted changes found"
+            git diff --color --compact-summary
+            exit 1
+          else
+            echo "No uncommitted changes"
+          fi
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "^1.23"
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: v1.60.3
+          args: --out-format=sarif:results.sarif,colored-line-number,github-actions
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: golangci-lint
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: stable
+          cache: true
+          check-latest: true
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: govulncheck ./...

.github/workflows/codeql.yaml

@@ -1,4 +1,4 @@
-name: CodeQL
+name: Analyze
 
 on:
   push:
@@ -16,23 +16,18 @@ jobs:
       contents: read
       security-events: write
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "^1.22.5"
-
+          go-version: "^1.23"
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
           languages: go
-
       - name: Autobuild
         uses: github/codeql-action/autobuild@v3
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3

.github/workflows/release.yaml

@@ -4,34 +4,59 @@ on:
   push:
     tags:
       - "*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to release'
+        required: true
 
 jobs:
-  releases:
+  release-docs:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "^1.23"
+      - name: Generate docs
+        run: |
+          go run ./tools/docsgen/.
+      - name: Setup Pages
+        uses: actions/configure-pages@v1
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v1
+        with:
+          path: 'docs/'
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@main
+  release-binary:
     permissions:
       contents: write
       packages: write
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.23.1"
-
+          go-version: "^1.23"
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
-
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:

.github/workflows/test.yaml

@@ -0,0 +1,41 @@
+name: Validate
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest] # TODO: Explore adding Windows support
+    runs-on: ${{ matrix.os }}
+    env:
+      GO111MODULE: on
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "^1.23"
+      - name: Run Tests with Retries
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 5
+          max_attempts: 3
+          command: go test ./... -race -coverprofile=coverage.txt -covermode=atomic -timeout 5m
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        if: matrix.os == 'ubuntu-latest' # Only upload coverage from one OS
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        with:
+          file: ./coverage.txt
+          fail_ci_if_error: false