release: v0.15.0 — federation event signing #243
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI workflow for Noema. | |
| # | |
| # Runs on every push to main/next and on every PR targeting main/next. | |
| # This is the "fast check" workflow — it guarantees a broken build | |
| # never lands on a release-track branch, and gives PR authors a red X | |
| # before a reviewer has to spot the problem. | |
| # | |
| # Release builds are handled separately in release.yml, which only | |
| # runs on v* tag pushes. Keeping the two workflows split means a | |
| # regular commit never accidentally triggers a release. | |
| # | |
| # Security note: no `run:` step interpolates any `github.event.*` | |
| # value, so there is no workflow-injection surface. `github.ref` is | |
| # used only in the concurrency group key, which is a YAML identifier | |
| # and never reaches a shell. | |
| name: ci | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - next | |
| pull_request: | |
| branches: | |
| - main | |
| - next | |
| # Cancel any in-flight CI runs for the same branch/PR when a new push | |
| # arrives — avoids burning minutes on stale commits. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: build + vet + test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| # Track go.mod so CI never drifts from the version the | |
| # project actually builds against locally. | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Verify module graph is tidy | |
| # Fails if go.mod or go.sum would change under `go mod tidy`. | |
| # Catches forgotten `go get` bookkeeping before it lands. | |
| run: | | |
| go mod tidy | |
| git diff --exit-code -- go.mod go.sum | |
| - name: Build all packages | |
| run: go build ./... | |
| - name: Vet | |
| run: go vet ./... | |
| - name: Staticcheck | |
| # honnef.co/go/tools picks up bugs, stylistic issues, and | |
| # performance problems that go vet doesn't cover. Pinned to a | |
| # dated release tag so CI output is reproducible — bump the | |
| # version below when you want the newer checks. Installed via | |
| # go install so the only third-party surface is the upstream | |
| # module itself; no GitHub Action in the middle. | |
| run: | | |
| go install honnef.co/go/tools/cmd/staticcheck@2026.1 | |
| "$(go env GOPATH)/bin/staticcheck" ./... | |
| - name: Test with race detector | |
| # -race catches data races that pure unit tests miss. Noema | |
| # has a federation syncer, a background SQLite connection, and | |
| # MCP request concurrency — exactly the kind of surface where | |
| # races hide until production. | |
| run: go test -race ./... | |
| - name: Set up Node | |
| # Required by the Obsidian plugin build below. ubuntu-latest | |
| # ships Node 20+ already; pinning explicitly keeps CI immune | |
| # to runner-image drift and matches the version pinned in | |
| # release.yml so plugin behaviour is reproducible across both | |
| # workflows. | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: plugins/obsidian/package-lock.json | |
| - name: Build Obsidian plugin | |
| # Catches TypeScript regressions, broken imports, and esbuild | |
| # config drift before they hit a release. Runs even on PRs | |
| # that don't touch plugins/obsidian/ — cost is ~15s per CI | |
| # run, well worth it given the bug we shipped to v0.10.0-beta.5 | |
| # would have been caught here. We install with npm ci (strict, | |
| # respects package-lock) and run the production build to | |
| # exercise the same path goreleaser uses on tag pushes. | |
| working-directory: plugins/obsidian | |
| run: | | |
| npm ci --silent | |
| npm run build | |
| npx tsc --noEmit |