Establish continuous integration workflows#15
Merged
danielorbach merged 5 commits intomainfrom Mar 10, 2026
Merged
Conversation
Exercises the test suite against stable and oldstable Go with race detection enabled to catch concurrency issues early. The workflow runs on every pull request and push to main.
Runs golangci-lint on every pull request using sensible defaults. The .golangci.yml configuration is intentionally minimal (version marker only), relying on the tool's built-in defaults until the project's needs require customization.
Runs govulncheck on every pull request and uploads SARIF results to GitHub Code Scanning. The job does not block merges on its own; enforcement is delegated to branch protection rules on Code Scanning alerts.
Catches newly published linter rules and vulnerability advisories between active development periods. The weekly cron fires Monday 09:00 UTC; workflow_dispatch allows on-demand runs.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions CI pipeline intended to gate PRs and main with Go tests (including race detection), linting, and vulnerability scanning, plus a README status badge to make CI visibility obvious.
Changes:
- Add a CI workflow that runs tests on stable/oldstable Go, runs golangci-lint, and runs govulncheck with SARIF upload.
- Add a minimal
.golangci.ymlto signal/enable golangci-lint usage. - Add a CI status badge to
README.md.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| README.md | Adds a GitHub Actions badge linking to the CI workflow. |
| .golangci.yml | Introduces a baseline golangci-lint config file (version marker). |
| .github/workflows/ci.yml | Defines CI jobs for tests, lint, and govulncheck + SARIF upload. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Mar 10, 2026
danielorbach
added a commit
that referenced
this pull request
Mar 11, 2026
With CI in place (#15), the repository can gate dependency updates on passing checks. Dependabot now monitors both Go modules and GitHub Actions on a weekly schedule, and patch-level updates auto-merge once CI passes. Minor and major updates still require human review. TODO comments in the automerge workflow mark where Claude-assisted review steps will slot in once the Claude Code workflow (#5) lands: approve-and-merge for minor updates, comment-only analysis for major ones. This addresses three of the four checkboxes in #6; the remaining one (LLM-assisted review) is blocked on #5. Relates to #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduces a CI pipeline that gates pull requests and pushes to main, giving reviewers reproducible proof that changes pass tests and meet quality standards. The same workflow runs on a weekly schedule and supports manual dispatch so regressions from upstream dependencies surface early.
The pipeline validates three dimensions: correctness (test suite with race detection across stable and oldstable Go), code quality (golangci-lint), and supply-chain safety (govulncheck with SARIF upload to Code Scanning). A status badge in the README makes the current CI state visible at a glance.
Closes #4