k3nnyandClaude Sonnet 4.6
986162d270
- GL046: validate image/service pull_policy values (always, if-not-present, never)
- GL047: error when a variables.options default value is not in the options list
- GL048: error on unrecognised trigger.forward keys
- GL049: validate rules[n].allow_failure (bool or {exit_codes:} map)
- Parse and evaluate workflow.rules/job.rules nested-array AND-groups; crash
on !!seq nodes is fixed; all members of a group must match for it to fire
- Add workflow.name and workflow.auto_cancel fields to Workflow struct
- Fix GL032 false positive: variables declared in any workflow rule's variables:
block no longer trigger an undeclared-variable warning in sibling workflow
rule if: expressions
- Add Windows ARM64 release build target (task build-windows-arm64)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
293 lines
11 KiB
YAML
293 lines
11 KiB
YAML
version: "3"
|
|
|
|
vars:
|
|
BINARY: glint
|
|
GO: /usr/local/go/bin/go
|
|
VERSION:
|
|
sh: git describe --tags --always --dirty 2>/dev/null || echo "dev"
|
|
|
|
tasks:
|
|
default:
|
|
desc: List available tasks
|
|
cmd: task --list
|
|
|
|
build:
|
|
desc: Build the glint binary
|
|
cmds:
|
|
- "{{.GO}} build -ldflags \"-X main.version={{.VERSION}}\" -o {{.BINARY}} ./cmd/glint/..."
|
|
sources:
|
|
- "**/*.go"
|
|
- go.mod
|
|
generates:
|
|
- "{{.BINARY}}"
|
|
|
|
test:
|
|
desc: Run Go unit tests
|
|
cmd: "{{.GO}} test ./..."
|
|
|
|
validate:
|
|
desc: Run glint against all testdata fixtures
|
|
deps: [build]
|
|
cmds:
|
|
- cmd: ./{{.BINARY}} check testdata/valid.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/extends.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/keywords_valid.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/invalid.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/needs.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/needs_cycle.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/keywords_invalid.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/includes_remote.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/includes_project.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/includes_component.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/script_multiline.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/context_rules.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --branch main testdata/context_rules.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --branch develop testdata/context_rules.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --branch feat/my-feature testdata/context_rules.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --tag v1.0.0 testdata/context_rules.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/rules_if_expr.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --branch main testdata/rules_if_expr.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --branch feat/x testdata/rules_if_expr.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/workflow_vars.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check --branch main testdata/workflow_vars.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check --branch develop testdata/workflow_vars.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check --branch feat/x testdata/workflow_vars.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/workflow_escape.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/variable_refs.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/variable_refs_included.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/dead_rules.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/new_rules_valid.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/new_rules_invalid.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/samba/.gitlab-ci.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/samba/.gitlab-ci-coverage.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/samba/.gitlab-ci-private.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check --format json testdata/valid.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --format sarif testdata/valid.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --format junit testdata/valid.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check --format github testdata/invalid.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/config_ignored/.gitlab-ci.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/config_severity/.gitlab-ci.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/config_suppress/.gitlab-ci.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/static_dead_rules.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/inherit_dead.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/inherit_dead_fields.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/rules_needs_valid.yml
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/rules_needs_invalid.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} check testdata/nested_rules.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} explain GL007
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} explain gl042
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} explain GL044
|
|
ignore_error: false
|
|
- cmd: ./{{.BINARY}} check testdata/insecure_remote_include.yml
|
|
ignore_error: true
|
|
- cmd: ./{{.BINARY}} explain
|
|
ignore_error: false
|
|
|
|
lint-go:
|
|
desc: Run go vet on all packages
|
|
cmd: "{{.GO}} vet ./..."
|
|
|
|
lint-static:
|
|
desc: Run staticcheck on all packages
|
|
cmd: "{{.GO}} tool staticcheck ./..."
|
|
|
|
ci:
|
|
desc: Full CI check — vet, staticcheck, test, build, validate
|
|
cmds:
|
|
- task: lint-go
|
|
- task: lint-static
|
|
- task: test
|
|
- task: build
|
|
- task: validate
|
|
|
|
build-linux-amd64:
|
|
desc: Build the glint binary for Linux x86-64 (requires a tagged commit)
|
|
aliases: [build-linux]
|
|
vars:
|
|
TAG:
|
|
sh: git describe --tags --exact-match
|
|
preconditions:
|
|
- sh: git describe --tags --exact-match
|
|
msg: "Current commit is not tagged — release build requires a git tag"
|
|
cmds:
|
|
- "GOOS=linux GOARCH=amd64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-linux-amd64 ./cmd/glint/..."
|
|
sources:
|
|
- "**/*.go"
|
|
- go.mod
|
|
generates:
|
|
- "{{.BINARY}}-{{.TAG}}-linux-amd64"
|
|
|
|
build-linux-arm64:
|
|
desc: Build the glint binary for Linux ARM64 (requires a tagged commit)
|
|
vars:
|
|
TAG:
|
|
sh: git describe --tags --exact-match
|
|
preconditions:
|
|
- sh: git describe --tags --exact-match
|
|
msg: "Current commit is not tagged — release build requires a git tag"
|
|
cmds:
|
|
- "GOOS=linux GOARCH=arm64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-linux-arm64 ./cmd/glint/..."
|
|
sources:
|
|
- "**/*.go"
|
|
- go.mod
|
|
generates:
|
|
- "{{.BINARY}}-{{.TAG}}-linux-arm64"
|
|
|
|
build-darwin-amd64:
|
|
desc: Build the glint binary for macOS Intel (requires a tagged commit)
|
|
vars:
|
|
TAG:
|
|
sh: git describe --tags --exact-match
|
|
preconditions:
|
|
- sh: git describe --tags --exact-match
|
|
msg: "Current commit is not tagged — release build requires a git tag"
|
|
cmds:
|
|
- "GOOS=darwin GOARCH=amd64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-darwin-amd64 ./cmd/glint/..."
|
|
sources:
|
|
- "**/*.go"
|
|
- go.mod
|
|
generates:
|
|
- "{{.BINARY}}-{{.TAG}}-darwin-amd64"
|
|
|
|
build-darwin-arm64:
|
|
desc: Build the glint binary for macOS Apple Silicon (requires a tagged commit)
|
|
vars:
|
|
TAG:
|
|
sh: git describe --tags --exact-match
|
|
preconditions:
|
|
- sh: git describe --tags --exact-match
|
|
msg: "Current commit is not tagged — release build requires a git tag"
|
|
cmds:
|
|
- "GOOS=darwin GOARCH=arm64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-darwin-arm64 ./cmd/glint/..."
|
|
sources:
|
|
- "**/*.go"
|
|
- go.mod
|
|
generates:
|
|
- "{{.BINARY}}-{{.TAG}}-darwin-arm64"
|
|
|
|
build-windows:
|
|
desc: Build the glint binary for Windows x86-64 (requires a tagged commit)
|
|
vars:
|
|
TAG:
|
|
sh: git describe --tags --exact-match
|
|
preconditions:
|
|
- sh: git describe --tags --exact-match
|
|
msg: "Current commit is not tagged — release build requires a git tag"
|
|
cmds:
|
|
- "GOOS=windows GOARCH=amd64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-windows-amd64.exe ./cmd/glint/..."
|
|
sources:
|
|
- "**/*.go"
|
|
- go.mod
|
|
generates:
|
|
- "{{.BINARY}}-{{.TAG}}-windows-amd64.exe"
|
|
|
|
build-windows-arm64:
|
|
desc: Build the glint binary for Windows ARM64 (requires a tagged commit)
|
|
vars:
|
|
TAG:
|
|
sh: git describe --tags --exact-match
|
|
preconditions:
|
|
- sh: git describe --tags --exact-match
|
|
msg: "Current commit is not tagged — release build requires a git tag"
|
|
cmds:
|
|
- "GOOS=windows GOARCH=arm64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-windows-arm64.exe ./cmd/glint/..."
|
|
sources:
|
|
- "**/*.go"
|
|
- go.mod
|
|
generates:
|
|
- "{{.BINARY}}-{{.TAG}}-windows-arm64.exe"
|
|
|
|
build-release:
|
|
desc: Build release binaries for all supported platforms (requires a tagged commit)
|
|
cmds:
|
|
- task: build-linux-amd64
|
|
- task: build-linux-arm64
|
|
- task: build-darwin-amd64
|
|
- task: build-darwin-arm64
|
|
- task: build-windows
|
|
- task: build-windows-arm64
|
|
|
|
fuzz:
|
|
desc: "Run all fuzz targets (set FUZZ_TIME=60s to control per-target duration, default 30s)"
|
|
cmds:
|
|
- "{{.GO}} test -fuzz=FuzzParseBytes -fuzztime=${FUZZ_TIME:-30s} ./internal/model/"
|
|
- "{{.GO}} test -fuzz=FuzzSanitizeYAMLEscapes -fuzztime=${FUZZ_TIME:-30s} ./internal/model/"
|
|
- "{{.GO}} test -fuzz=FuzzEvalIf -fuzztime=${FUZZ_TIME:-30s} ./internal/cicontext/"
|
|
- "{{.GO}} test -fuzz=FuzzExpandVarRefs -fuzztime=${FUZZ_TIME:-30s} ./internal/cicontext/"
|
|
- "{{.GO}} test -fuzz=FuzzLint -fuzztime=${FUZZ_TIME:-30s} ./internal/linter/"
|
|
|
|
changelog:
|
|
desc: "Regenerate CHANGELOG.md from git history (requires git-cliff — see README)"
|
|
cmd: git cliff --config cliff.toml --output CHANGELOG.md
|
|
|
|
changelog-next:
|
|
desc: "Preview unreleased changelog entries without writing (requires git-cliff)"
|
|
cmd: git cliff --config cliff.toml --unreleased
|
|
|
|
ext-install:
|
|
desc: Install VS Code extension npm dependencies (run once after checkout)
|
|
dir: editors/vscode
|
|
cmd: npm install
|
|
|
|
ext-compile:
|
|
desc: Compile the VS Code extension TypeScript source
|
|
dir: editors/vscode
|
|
cmd: npm run compile
|
|
|
|
ext-package:
|
|
desc: Package the VS Code extension into a .vsix file
|
|
dir: editors/vscode
|
|
deps: [ext-compile]
|
|
cmd: npm run package
|
|
|
|
clean:
|
|
desc: Remove build artifacts
|
|
cmd: rm -f {{.BINARY}} {{.BINARY}}-*.exe {{.BINARY}}-*-linux-amd64 {{.BINARY}}-*-linux-arm64 {{.BINARY}}-*-darwin-amd64 {{.BINARY}}-*-darwin-arm64
|