Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / .github/workflows/ci.yml |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | bdacd9d0b4d5998d25fc74bf4007f4c3ec538c7a |
| Branch | deploy-and-ops |
| Path or archive member | .github/workflows/ci.yml |
| Original SHA-256 | 895ab1e13d7505a36e4012dd70ff2981ecad5c401aafa7e63133f94742c571c6 |
| Git blob SHA | 6010472712ebd0441fc89c5d33f36307d8f32e09 |
| Reading-copy SHA-256 | 895ab1e13d7505a36e4012dd70ff2981ecad5c401aafa7e63133f94742c571c6 |
Recovered source transcript
Download complete source text ↓96 lines · 4.4 KB
# missionMATCH CI. Fails closed on the security gates. Runs on every push and pull request.
# This job runs the UNIT suite plus the gates only. The integration suite in
# internal/integration (build tag integration) needs a live Postgres 16 with pgvector and the
# MEGAMIND plane, which a GitHub hosted runner does not have, so it stays a manual or staging
# step (make test-integration against M4). See ci-reconciliation note in the PR description.
name: ci
on:
push:
pull_request:
# Least privilege. The whole workflow can only read repo contents. No write scopes anywhere.
permissions:
contents: read
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
jobs:
# One job, one required status check named "build-test-gates". No matrix: the runner is
# native linux/amd64, which is exactly the FIPS build target and the only platform the race
# detector and the FIPS gates need. Add a matrix only when a second target appears.
build-test-gates:
name: build-test-gates
runs-on: ubuntu-latest
env:
# The exact validated module pin from docs/STACK_DECISIONS.md section 1. Mirrors the Makefile.
GOFIPS140: v1.0.0
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Go
uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
with:
# Single source of truth for the Go version: the go directive in go.mod (1.26).
go-version-file: go.mod
# setup-go caches GOMODCACHE and GOCACHE keyed on go.sum by default. Leave it on.
cache: true
- name: Build the FIPS binaries (cross compile, CGO off, validated module)
# Same incantation as `make build`. Cross compiles to linux/amd64 on a linux/amd64
# runner. Proves the release artifacts compile under GOFIPS140=v1.0.0.
run: make build
- name: Unit suite with the race detector under FIPS runtime
# CGO_ENABLED=1 is mandatory for -race (ThreadSanitizer). It works here because the
# runner is native linux/amd64, so this is a native test build, not a cross compile.
# GODEBUG=fips140=on runs the validated module in FIPS mode for the test process.
# No matrix tag, so internal/integration (build tag integration) is skipped: the DB
# backed suite is a separate staging step, not part of CI.
env:
CGO_ENABLED: "1"
GODEBUG: fips140=on
run: go test -race ./...
- name: Security gates (fail closed)
# make ci-gates = verify-backdoor + verify-fips. These already exit non zero on any
# failure, which fails the step and the job. There is deliberately NO continue-on-error
# on this step, so a gate failure blocks the merge through the required status check.
run: make ci-gates
# Build the two container images. Each Dockerfile carries an in build RUN gate
# (go version -m grep GOFIPS140=v1.0.0), so a SUCCESSFUL docker build is itself the proof that
# the FIPS stamp is present in the image: a non FIPS binary fails the build. The runner ships
# docker, so this also exercises the distroless non root image end to end.
image:
name: image
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Build the mm-api image (in build FIPS stamp gate)
run: docker build -f infra/docker/Dockerfile.mm-api -t mm-api:ci .
- name: Build the gateway image (in build FIPS stamp gate)
run: docker build -f infra/docker/Dockerfile.megamind-gateway -t megamind-gateway:ci .
# Terraform fmt and validate. No cloud credentials: init runs with -backend=false and validate is
# offline, so this is safe in CI. plan and apply are the operator's step (see infra/terraform/README.md)
# and are never run here.
terraform:
name: terraform
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Terraform
uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
- name: Format check
run: terraform -chdir=infra/terraform fmt -check -recursive
- name: Init without a backend (download providers, no credentials)
run: terraform -chdir=infra/terraform init -backend=false -input=false
- name: Validate
run: terraform -chdir=infra/terraform validate