Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CI ¶
CI groups targets that CI workflows dispatch to for decisions that are easier to keep in typed, unit-tested Go than in workflow YAML.
func (CI) CheckShardResults ¶
CheckShardResults is test.yml's per-OS required check ("Acceptance Tests (linux)" and friends): it lists the run attempt's jobs live via the GitHub REST API, waits for every "Acceptance Tests (<target>, shard N/M)" job to have a conclusion (the jobs API is eventually consistent and has returned an empty conclusion for a shard that finished minutes earlier), then fails unless all of them succeeded. The check argument is the required-check name the matrix carries, e.g. "Acceptance Tests (macos)". See internal/ci/acceptance.
func (CI) ClassifyInfraFailures ¶
ClassifyInfraFailures fetches every job of the repo/runID/runAttempt run attempt (repos/{repo}/actions/runs/{runID}/attempts/{runAttempt}/jobs, live via the GitHub REST API), classifies the non-success ones as infrastructure zombies or real failures, prints one TSV line (`job<TAB>conclusion<TAB>class`) per job to stdout and the verdict to stderr. When GITHUB_OUTPUT is set it also records `verdict` (rerun|no-rerun|no-jobs), `reason` and the multi-line `table` for the calling workflow step. When GITHUB_STEP_SUMMARY is set it also appends a Markdown rendering of the same classification. See internal/ci/rerun for the rules.
func (CI) RerunInfraFailures ¶
RerunInfraFailures re-runs the failed/cancelled jobs of a workflow run (repos/{repo}/actions/runs/{runID}/rerun-failed-jobs, mirroring `gh run rerun <runID> --failed`), but only after re-verifying - for pull_request runs - that the run's head SHA still matches every associated PR's current head, skipping the rerun otherwise. This is best-effort, not a hard guarantee: a new push can still land in the gap between that check and the rerun-request call below, so a just-superseded run can occasionally get rerun anyway. Workflow_run triggers only fire after the triggering run has already finished, so there's no live "cancel this if a newer run starts" concurrency group to attach here the way pull_request triggers get one - the wasted cost of that rare case is one extra CI run for an already-stale commit, not a correctness problem. A fork PR (whose pull_requests list GitHub always leaves empty) can't be verified this way and is never rerun either. Every decision is appended to GITHUB_STEP_SUMMARY when set; only a genuine rerun-request failure (not "the run hasn't finished yet") is returned as an error.
func (CI) Vulncheck ¶
Vulncheck scans every package of the module with govulncheck and writes its SARIF report to output. The tool must already be installed and on PATH. The report is normalized before it replaces output: exact duplicate stacks, which the SARIF schema forbids and GitHub code scanning rejects, are removed while every finding and distinct stack is kept. Scanner failures and malformed output fail the target without touching an existing report. See internal/ci/vulncheck.
Source Files