Repository navigation
ci: Codecov hardening and release smoke tests - #83
Merged
Merged
Conversation
- Fail CI when Codecov upload errors if CODECOV_TOKEN is present; skip uploads gracefully when the secret is unavailable (fork/Dependabot). - Split release into snapshot build, cross-platform binary/npm smoke tests, then GoReleaser publish and npm publish. - Add release dry-run workflow (actionlint + goreleaser snapshot) for PRs. - Document release checks in docs/dev.md. Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #83 +/- ##
==========================================
+ Coverage 84.32% 84.44% +0.12%
==========================================
Files 67 69 +2
Lines 6367 6744 +377
==========================================
+ Hits 5369 5695 +326
- Misses 723 766 +43
- Partials 275 283 +8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
- Run actionlint via pinned go install instead of curl/bash. - Add least-privilege permissions (contents/actions) on release workflows. - Pin setup-node to full commit SHA in new/changed workflows. - Harden release-smoke.js: node: imports, platform allowlist, tight chmod, invoke npm/npx via absolute paths next to node. Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
|
cursor Bot
pushed a commit
that referenced
this pull request
Oct 10, 2026
Co-authored-by: x_zhuo <zx06@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens CI coverage reporting and adds automated release smoke tests so broken artifacts or npm packages are caught before publish.
Codecov
fail_ci_if_error: truewhenCODECOV_TOKENis present (detected via a dedicated step; secrets are not used inifexpressions).skip_validation: trueavoids flaky Codecov CLI GPG verification; upload failures still fail the job.Release smoke tests
Order unchanged: snapshot build → smoke → GoReleaser release → npm publish.
Scripts:
scripts/release-smoke.js,scripts/release-artifacts.js.Security / quality (follow-up)
.github/tools/go.mod+go.sumviago run.permissions(contents: read,actions: read/writewhere needed);setup-nodepinned to SHA48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e.release-smoke.js:node:imports, platform allowlist, chmod without group/world write, npm/npx via absolute paths besidenode(Windows usesshell: truefor.cmdonly).CI status (head
4b86ecc)new_security_ratingactual1).中文摘要
go.sum锁定模块、workflow 最小权限、第三方 action SHA 固定、release-smoke.js权限与命令执行加固。