294 lines
8.5 KiB
YAML
294 lines
8.5 KiB
YAML
name: GoChat CI/CD Pipeline
|
|
# Reference: Chatwoot uses CircleCI for CI/CD; this is the Go equivalent using GitHub Actions
|
|
# Multi-stage pipeline: test → build → security → deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop, 'release/**']
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: ghcr.io
|
|
IMAGE_NAME: gochat/gochat
|
|
GOPROXY: https://goproxy.cn,direct
|
|
|
|
jobs:
|
|
# ---- Stage 1: Lint + Test ----
|
|
test:
|
|
name: Test & Lint
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
db-mode: [postgres, sqlite]
|
|
services:
|
|
postgres:
|
|
image: pgvector/pgvector:pg16
|
|
env:
|
|
POSTGRES_DB: gochat_test
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd pg_isready
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
redis:
|
|
image: redis:7-alpine
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.25'
|
|
|
|
# Lint
|
|
- name: Run golangci-lint
|
|
uses: golangci/golangci-lint-action@v6
|
|
with:
|
|
version: v1.64
|
|
|
|
# Vet
|
|
- name: Run go vet
|
|
run: go vet ./...
|
|
|
|
# Unit + Integration Tests
|
|
- name: Run unit & integration tests
|
|
env:
|
|
GOCHAT_ENV: test
|
|
GOCHAT_TEST_DB: ${{ matrix.db-mode }}
|
|
POSTGRES_HOST: localhost
|
|
POSTGRES_PORT: 5432
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
POSTGRES_DB: gochat_test
|
|
REDIS_HOST: localhost
|
|
REDIS_PORT: 6379
|
|
GOPROXY: https://goproxy.cn,direct
|
|
run: go test -v -race -coverprofile=coverage.out -timeout 180s ./internal/... ./pkg/... ./cmd/...
|
|
|
|
# E2E Tests (only on postgres matrix)
|
|
- name: Run e2e tests
|
|
if: matrix.db-mode == 'postgres'
|
|
env:
|
|
GOCHAT_ENV: test
|
|
POSTGRES_HOST: localhost
|
|
POSTGRES_PORT: 5432
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
POSTGRES_DB: gochat_test
|
|
REDIS_HOST: localhost
|
|
REDIS_PORT: 6379
|
|
run: go test -v -timeout 120s ./tests/e2e/...
|
|
|
|
# Benchmark (quick sanity check, not full bench)
|
|
- name: Run benchmarks
|
|
env:
|
|
GOCHAT_ENV: test
|
|
GOCHAT_TEST_DB: ${{ matrix.db-mode }}
|
|
POSTGRES_HOST: localhost
|
|
POSTGRES_PORT: 5432
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
POSTGRES_DB: gochat_test
|
|
run: go test -bench=. -benchtime=1s -run=^$ -timeout 60s ./internal/service/... ./pkg/crypto/...
|
|
|
|
# Coverage report
|
|
- name: Upload coverage
|
|
if: matrix.db-mode == 'postgres'
|
|
uses: codecov/codecov-action@v4
|
|
with:
|
|
files: coverage.out
|
|
|
|
# ---- Stage 2: Security Scan ----
|
|
security:
|
|
name: Security Scan
|
|
needs: test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.25'
|
|
|
|
# Gosec — Go security scanner
|
|
- name: Run gosec
|
|
uses: securego/gosec@master
|
|
with:
|
|
args: '-no-fail ./...'
|
|
|
|
# Dependency vulnerability scan
|
|
- name: Run govulncheck
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./...
|
|
|
|
# Trivy filesystem scan
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: 'fs'
|
|
scan-ref: '.'
|
|
format: 'table'
|
|
exit-code: '1'
|
|
severity: 'CRITICAL,HIGH'
|
|
|
|
# ---- Stage 3: Build Docker Image ----
|
|
build:
|
|
name: Build Docker Image
|
|
needs: [test, security]
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' # Only build on push, not PRs
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
outputs:
|
|
image_tag: ${{ steps.meta.outputs.tags }}
|
|
image_digest: ${{ steps.build.outputs.digest }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Set up Docker Buildx for multi-platform builds
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
# Login to GHCR
|
|
- name: Login to GHCR
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Extract metadata (tags, labels)
|
|
- name: Extract metadata
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
tags: |
|
|
type=ref,event=branch
|
|
type=ref,event=pr
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=sha
|
|
|
|
# Build and push
|
|
- name: Build and push
|
|
id: build
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
VERSION=${{ github.ref_name }}
|
|
COMMIT_SHA=${{ github.sha }}
|
|
BUILD_DATE=${{ github.event.head_commit.timestamp }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
# Scan Docker image with Trivy
|
|
- name: Scan Docker image
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
|
|
format: 'table'
|
|
exit-code: '1'
|
|
severity: 'CRITICAL,HIGH'
|
|
|
|
# ---- Stage 4: Validate Helm Chart ----
|
|
helm-validate:
|
|
name: Validate Helm Chart
|
|
needs: test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Helm
|
|
uses: azure/setup-helm@v3
|
|
with:
|
|
version: 'v3.14.0'
|
|
|
|
- name: Set up kubeval
|
|
run: |
|
|
curl -sfL https://github.com/yannh/kubeconform/releases/download/v0.6.4/kubeconform-linux-amd64.tar.gz | tar -xz
|
|
chmod +x kubeconform && mv kubeconform /usr/local/bin/
|
|
|
|
- name: Lint Helm chart
|
|
run: helm lint deploy/helm/gochat/
|
|
|
|
- name: Template and validate Helm chart
|
|
run: |
|
|
helm template gochat deploy/helm/gochat/ \
|
|
--values deploy/helm/gochat/values.yaml \
|
|
--values deploy/helm/gochat/values-production.yaml \
|
|
| kubeconform -summary -kubernetes-version 1.29.0
|
|
|
|
# ---- Stage 5: Deploy to Staging ----
|
|
deploy-staging:
|
|
name: Deploy to Staging
|
|
needs: [build, helm-validate]
|
|
runs-on: ubuntu-latest
|
|
if: github.ref == 'refs/heads/develop'
|
|
environment: staging
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Deploy to staging
|
|
uses: stefanprodan/helm-gh-action@v1.7.0
|
|
with:
|
|
context: ./deploy/helm/gochat
|
|
chart-ref: ./deploy/helm/gochat
|
|
cluster-config: staging-k8s-config
|
|
kube-config: ${{ secrets.KUBE_CONFIG_STAGING }}
|
|
namespace: gochat-staging
|
|
values: values.yaml
|
|
value-files: >-
|
|
values-staging.yaml
|
|
release-name: gochat-staging
|
|
atomic: true
|
|
|
|
# Post-deploy health check
|
|
- name: Health check
|
|
run: |
|
|
chmod +x scripts/health_check.sh
|
|
GOCHAT_HOST=gochat-staging GOCHAT_PORT=3000 ./scripts/health_check.sh --full --timeout 30
|
|
|
|
# ---- Stage 6: Deploy to Production ----
|
|
deploy-production:
|
|
name: Deploy to Production
|
|
needs: [build, helm-validate]
|
|
runs-on: ubuntu-latest
|
|
if: startsWith(github.ref, 'refs/heads/release/')
|
|
environment: production
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Deploy to production
|
|
uses: stefanprodan/helm-gh-action@v1.7.0
|
|
with:
|
|
context: ./deploy/helm/gochat
|
|
chart-ref: ./deploy/helm/gochat
|
|
cluster-config: production-k8s-config
|
|
kube-config: ${{ secrets.KUBE_CONFIG_PRODUCTION }}
|
|
namespace: gochat-production
|
|
values: values.yaml
|
|
value-files: >-
|
|
values-production.yaml
|
|
release-name: gochat-production
|
|
atomic: true
|
|
|
|
# Post-deploy health check
|
|
- name: Health check
|
|
run: |
|
|
chmod +x scripts/health_check.sh
|
|
GOCHAT_HOST=gochat-production GOCHAT_PORT=3000 ./scripts/health_check.sh --full --timeout 30 |