s1d3sw1ped/steamcache2
1
0
Fork 0
Code Issues Pull requests Projects Releases 34 Packages Wiki Activity Actions

Move CI workflows to .forgejo/workflows #58

Merged
linus merged 3 commits from jerry/move-workflows-to-forgejo into main 2026-10-18 03:07:57 +00:00
Conversation 4 Commits 3 Files changed 6 +85 -9
jerry commented 2026-10-18 02:05:25 +00:00
Contributor
Copy link

Forgejo reads .forgejo/workflows and ignores .gitea/workflows, so since the move from Gitea CI on this repo wouldn't run. This moves release-tag.yaml, test-pr.yaml over.

Edits: gitea.* contexts become github.*, and artifact actions are pinned to the code.forgejo.org v4 versions where they were used (upstream v4 refuses to run on non-GitHub servers).

Forgejo reads .forgejo/workflows and ignores .gitea/workflows, so since the move from Gitea CI on this repo wouldn't run. This moves release-tag.yaml, test-pr.yaml over. Edits: gitea.* contexts become github.*, and artifact actions are pinned to the code.forgejo.org v4 versions where they were used (upstream v4 refuses to run on non-GitHub servers).
Move CI workflows to .forgejo/workflows
Some checks failed
CI / vulncheck (pull_request) Failing after 29s
Details
CI / check-and-test (pull_request) Successful in 1m34s
Details
a9a699daba 
The server moved from Gitea to Forgejo, which reads .forgejo/workflows and ignores .gitea/workflows, so CI would silently stop running here. Move the files over. While at it, swap the gitea.* expression contexts for github.* (Forgejo rejects gitea.*) and point upload/download-artifact@v4 at code.forgejo.org/forgejo, since upstream v4 refuses to run on non-GitHub servers.
linus commented 2026-10-18 02:53:18 +00:00
Collaborator
Copy link

vulncheck red from Go stdlib vulns fixed in go1.27.2, tracked in a separate Go bump PR. Diff is workflow files only; merging per Eva's GO and Justin's call via Rex.

vulncheck red from Go stdlib vulns fixed in go1.27.2, tracked in a separate Go bump PR. Diff is workflow files only; merging per Eva's GO and Justin's call via Rex.
build: Pin Go 1.27.2 and stop early on a toolchain mismatch
Some checks failed
CI / check-and-test (pull_request) Failing after 28s
Details
CI / vulncheck (pull_request) Successful in 29s
Details
a811795262 
CI / vulncheck is failing because the stdlib in go1.27.0 and go1.27.1 has
known vulnerabilities (GO-2026-6603 to 6617) that are fixed in go1.27.2.
setup-go reads go.mod, which only said go 1.27.0, so every runner kept
building with the vulnerable toolchain.

Add a toolchain go1.27.2 line to go.mod and a scripts/check-toolchain.sh
preflight, run before the build in each CI job. If the Go, GoReleaser or
go.mod pins are wrong it stops and prints what it found, what is required
and the fix command. Also pin GoReleaser to v2.18.3 in the release job and
use the versioned action tags instead of @main/@master.
ash requested review from eva 2026-10-18 02:57:35 +00:00
ash commented 2026-10-18 02:58:04 +00:00
Collaborator
Copy link

I pushed one commit onto this branch (separate from Jerry's): a811795, "build: Pin Go 1.27.2 and stop early on a toolchain mismatch". It adds toolchain go1.27.2 to go.mod, a scripts/check-toolchain.sh preflight run in each CI job right after setup-go, GoReleaser pinned to v2.18.3 in the release job, and a README note. The Makefile build target runs the preflight, test and test-race check Go only.

Checked on the jumpbox, with govulncheck v1.9.0:

Go govulncheck tests
before (Jerry's head) go1.27.1 9 vulnerabilities (GO-2026-6603, 6605, 6607, 6608, 6610, 6611, 6612, 6613, 6617) 12 packages ok, 0 fail (5 without tests)
after (this head) go1.27.2 0 vulnerabilities, exit 0 12 packages ok, 0 fail (5 without tests)

The preflight passes on go1.27.2. With go1.27.1 it stops with "found: go1.27.1 / required: go1.27.2 / fix: ...", and if go.mod's toolchain line is edited it reports the changed pins and the git checkout -- go.mod fix.

The Go bump was written by hand, copying the reviewed preflight from jiggablend #18 (s1d3sw1ped/jiggablend#18) rather than going through OpenCode, since it is a mechanical copy. I'll post the CI result once vulncheck finishes. Eva, please re-review this head.

vuln-before-steamcache2-move-workflows-to-forgejo.txt

vuln-after-steamcache2-move-workflows-to-forgejo.txt

I pushed one commit onto this branch (separate from Jerry's): a811795, "build: Pin Go 1.27.2 and stop early on a toolchain mismatch". It adds `toolchain go1.27.2` to go.mod, a scripts/check-toolchain.sh preflight run in each CI job right after setup-go, GoReleaser pinned to v2.18.3 in the release job, and a README note. The Makefile build target runs the preflight, test and test-race check Go only. Checked on the jumpbox, with govulncheck v1.9.0: | | Go | govulncheck | tests | |---|---|---|---| | before (Jerry's head) | go1.27.1 | 9 vulnerabilities (GO-2026-6603, 6605, 6607, 6608, 6610, 6611, 6612, 6613, 6617) | 12 packages ok, 0 fail (5 without tests) | | after (this head) | go1.27.2 | 0 vulnerabilities, exit 0 | 12 packages ok, 0 fail (5 without tests) | The preflight passes on go1.27.2. With go1.27.1 it stops with "found: go1.27.1 / required: go1.27.2 / fix: ...", and if go.mod's toolchain line is edited it reports the changed pins and the `git checkout -- go.mod` fix. The Go bump was written by hand, copying the reviewed preflight from jiggablend #18 (https://git.s1d3sw1ped.com/s1d3sw1ped/jiggablend/pulls/18) rather than going through OpenCode, since it is a mechanical copy. I'll post the CI result once vulncheck finishes. Eva, please re-review this head. ![vuln-before-steamcache2-move-workflows-to-forgejo.txt](https://git.s1d3sw1ped.com/attachments/0b120d19-a8f4-4463-8976-13e608611382) ![vuln-after-steamcache2-move-workflows-to-forgejo.txt](https://git.s1d3sw1ped.com/attachments/8d6a720b-4f31-4882-adc5-5548d2bb7eec)
vuln-before-steamcache2-move-workflows-to-forgejo.txt
24 KiB
vuln-after-steamcache2-move-workflows-to-forgejo.txt
299 B
ci: Bump golangci-lint to v2.14.0 for Go 1.27.2
All checks were successful
CI / vulncheck (pull_request) Successful in 24s
Details
CI / check-and-test (pull_request) Successful in 1m4s
Details
94958feb59 
With the toolchain at go1.27.2 the pinned golangci-lint v2.13.2 stops
type-checking the module (undefined: yaml and similar typecheck errors),
which fails CI / check-and-test even though go build and go vet pass.
v2.14.0 lints the same tree with 0 issues and is the version in the
forge toolchain standard.
ash commented 2026-10-18 03:05:53 +00:00
Collaborator
Copy link

CI on the first push: CI / vulncheck passed, but CI / check-and-test failed after about 30s. That was my doing: golangci-lint v2.13.2 stops type-checking the module on go1.27.2 (undefined: yaml and similar typecheck errors; I reproduced it on the jumpbox, while v2.14.0 gives 0 issues). I pushed 94958fe, "ci: Bump golangci-lint to v2.14.0 for Go 1.27.2", on top, an ordinary fast-forward push. v2.14.0 is the version in the forge toolchain standard. Both CI / vulncheck and CI / check-and-test are now green on this head. Eva, please re-review this head.

CI on the first push: CI / vulncheck passed, but CI / check-and-test failed after about 30s. That was my doing: golangci-lint v2.13.2 stops type-checking the module on go1.27.2 (undefined: yaml and similar typecheck errors; I reproduced it on the jumpbox, while v2.14.0 gives 0 issues). I pushed 94958fe, "ci: Bump golangci-lint to v2.14.0 for Go 1.27.2", on top, an ordinary fast-forward push. v2.14.0 is the version in the forge toolchain standard. Both CI / vulncheck and CI / check-and-test are now green on this head. Eva, please re-review this head.
eva approved these changes 2026-10-18 03:07:29 +00:00
eva left a comment
Copy link

APPROVE at head 94958feb59.

  • CI / vulncheck and CI / check-and-test green on this head.
  • Diff is the workflow move to .forgejo/workflows, go.mod toolchain go1.27.2, scripts/check-toolchain.sh (byte-identical to the merged jiggablend preflight; prints toolchain / found / required / fix), README note, golangci-lint v2.14.0 (v2.13.2 fails to type-check on go1.27.2), goreleaser pinned to v2.18.3 in release-tag. Makefile gains check-toolchain/check-go targets. No stray files or secrets; mergeable.
  • Nit, non-blocking: govulncheck@latest in the vulncheck job is unpinned; covered by the pin-everything issue (steamcache2 #57 / vulture #16).
APPROVE at head 94958feb59237f29ef8cd767147c72aac2df41ea. - CI / vulncheck and CI / check-and-test green on this head. - Diff is the workflow move to .forgejo/workflows, go.mod `toolchain go1.27.2`, scripts/check-toolchain.sh (byte-identical to the merged jiggablend preflight; prints toolchain / found / required / fix), README note, golangci-lint v2.14.0 (v2.13.2 fails to type-check on go1.27.2), goreleaser pinned to v2.18.3 in release-tag. Makefile gains check-toolchain/check-go targets. No stray files or secrets; mergeable. - Nit, non-blocking: `govulncheck@latest` in the vulncheck job is unpinned; covered by the pin-everything issue (steamcache2 #57 / vulture #16).
linus merged commit 2ddfda718b into main 2026-10-18 03:07:57 +00:00
linus deleted branch jerry/move-workflows-to-forgejo 2026-10-18 03:07:57 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
eva
Labels
Clear labels   
blocked
Stuck. The assignee needs a decision or an unblock; see the latest comment.

  
bug
Something is not working

  
draft
Draft for review — do not merge without Eva review

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
blocked
bug
draft
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
s1d3sw1ped/steamcache2!58
No description provided.