152 lines
4.7 KiB
YAML
152 lines
4.7 KiB
YAML
name: quality-gates
|
|
|
|
on:
|
|
pull_request:
|
|
schedule:
|
|
- cron: "17 3 * * *"
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
inputs:
|
|
tier:
|
|
description: Quality tier to execute
|
|
required: true
|
|
default: nightly
|
|
type: choice
|
|
options:
|
|
- nightly
|
|
- release
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: quality-gates-${{ github.event_name }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 120
|
|
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Select quality tier
|
|
id: tier
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
REQUESTED_TIER: ${{ inputs.tier }}
|
|
run: |
|
|
case "$EVENT_NAME" in
|
|
pull_request) tier="pr" ;;
|
|
schedule) tier="nightly" ;;
|
|
release) tier="release" ;;
|
|
workflow_dispatch) tier="$REQUESTED_TIER" ;;
|
|
*) echo "unsupported event: $EVENT_NAME" >&2; exit 2 ;;
|
|
esac
|
|
echo "tier=$tier" >> "$GITHUB_OUTPUT"
|
|
echo "Selected quality tier: $tier"
|
|
|
|
- name: Install system dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
clang-19 llvm-19-dev libclang-19-dev libclang-cpp19-dev \
|
|
libz3-dev libsqlite3-dev \
|
|
meson ninja-build pkg-config \
|
|
nlohmann-json3-dev libcli11-dev libspdlog-dev libfmt-dev
|
|
{
|
|
echo "CC=clang-19"
|
|
echo "CXX=clang++-19"
|
|
echo "LLVM_CONFIG=llvm-config-19"
|
|
} >> "$GITHUB_ENV"
|
|
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install build toolchains
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
python -m pip install 'conan>=2,<3'
|
|
conan profile detect --force
|
|
rustup toolchain install nightly-2026-05-28 \
|
|
--component rustc-dev --component rustfmt --component llvm-tools-preview
|
|
rustup toolchain install nightly-2026-07-28
|
|
rustup run nightly-2026-05-28 rustc -Vv
|
|
rustup run nightly-2026-07-28 rustc -Vv
|
|
|
|
- name: Configure and compile
|
|
run: ./setup.sh release
|
|
|
|
- name: Run tiered quality gate
|
|
env:
|
|
TIER: ${{ steps.tier.outputs.tier }}
|
|
BASE_REF: origin/${{ github.base_ref }}
|
|
HEAD_REF: ${{ github.sha }}
|
|
run: |
|
|
case "$TIER" in
|
|
pr)
|
|
./build/release/src/cli/fold quality \
|
|
--skip-format \
|
|
--compile-db build/release \
|
|
--base-ref "$BASE_REF" \
|
|
--head-ref "$HEAD_REF" \
|
|
--test-repetitions 1 \
|
|
--out-dir quality-report
|
|
;;
|
|
nightly)
|
|
./build/release/src/cli/fold quality \
|
|
--skip-diff-scan --full-tests \
|
|
--test-repetitions 3 \
|
|
--out-dir quality-report
|
|
;;
|
|
release)
|
|
./build/release/src/cli/fold quality \
|
|
--skip-diff-scan --full-tests \
|
|
--test-repetitions 1 \
|
|
--out-dir quality-report
|
|
;;
|
|
*) echo "unsupported tier: $TIER" >&2; exit 2 ;;
|
|
esac
|
|
|
|
- name: Install uv for release coverage
|
|
if: steps.tier.outputs.tier == 'release'
|
|
run: python -m pip install uv
|
|
|
|
- name: Enforce reviewed release coverage floor
|
|
if: steps.tier.outputs.tier == 'release'
|
|
env:
|
|
COVERAGE_MIN_LINE: "70"
|
|
run: ./scripts/coverage.sh
|
|
|
|
- name: Smoke release binary
|
|
if: steps.tier.outputs.tier == 'release'
|
|
run: |
|
|
./build/release/src/cli/fold --version
|
|
set +e
|
|
./build/release/src/cli/fold scan \
|
|
tests/fixtures/clones \
|
|
--std c++20 --detectors clone --processes 1 \
|
|
--format sarif --output quality-report/release-smoke.sarif.json
|
|
scan_status=$?
|
|
set -e
|
|
if (( scan_status > 1 )); then
|
|
exit "$scan_status"
|
|
fi
|
|
test -s quality-report/release-smoke.sarif.json
|
|
|
|
- name: Upload quality evidence
|
|
if: always()
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: quality-${{ steps.tier.outputs.tier }}-${{ github.sha }}
|
|
path: |
|
|
quality-report/
|
|
build/coverage/coverage.json
|
|
build/coverage/coverage.txt
|
|
if-no-files-found: error
|