test: isolate status checks from optional tools #29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| validate: | |
| name: Validate | |
| runs-on: macos-26 | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Checkout mac-sync | |
| uses: actions/checkout@v7 | |
| with: | |
| path: mac-sync | |
| fetch-depth: 0 | |
| - name: Compute SwiftPM cache fingerprint | |
| id: swiftpm-cache | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| { | |
| swift --version 2>&1 | |
| shasum -a 256 mac-sync/Package.swift | |
| shasum -a 256 mac-sync/Makefile | |
| } | shasum -a 256 | awk '{ printf "fingerprint=%s\n", $1 }' >> "$GITHUB_OUTPUT" | |
| - name: Cache SwiftPM build artifacts | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| mac-sync/.build | |
| mac-sync/.swiftpm | |
| ~/Library/Caches/org.swift.swiftpm | |
| key: ${{ runner.os }}-${{ runner.arch }}-macos26-swiftpm-v1-${{ steps.swiftpm-cache.outputs.fingerprint }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ runner.arch }}-macos26-swiftpm-v1- | |
| - name: Install Markdown lint | |
| run: npm install --global markdownlint-cli@0.48.0 | |
| - name: Print toolchain versions | |
| run: | | |
| swift --version | |
| xcodebuild -version | |
| markdownlint --version | |
| - name: Run local CI workflow | |
| if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' | |
| timeout-minutes: 35 | |
| run: make ci | |
| working-directory: mac-sync | |
| - name: Check SonarQube token | |
| id: sonar-token | |
| if: > | |
| (github.ref == 'refs/heads/main' || github.event_name == 'pull_request') && | |
| (github.event_name != 'pull_request' || | |
| (github.event.pull_request.head.repo.full_name == github.repository && | |
| github.actor != 'dependabot[bot]')) | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ -n "${SONAR_TOKEN:-}" ]]; then | |
| printf 'available=true\n' >> "$GITHUB_OUTPUT" | |
| elif [[ "${GITHUB_REF}" == "refs/heads/main" && "${GITHUB_EVENT_NAME}" == "push" ]]; then | |
| printf 'SONAR_TOKEN is required for release-eligible main builds.\n' >&2 | |
| exit 1 | |
| else | |
| printf 'available=false\n' >> "$GITHUB_OUTPUT" | |
| printf '::notice title=SonarQube skipped::SONAR_TOKEN is not configured; skipping SonarQube scan.\n' | |
| fi | |
| - name: Cache SonarQube packages | |
| if: steps.sonar-token.outputs.available == 'true' | |
| uses: actions/cache@v6 | |
| with: | |
| path: ~/.sonar/cache | |
| key: ${{ runner.os }}-sonar | |
| restore-keys: ${{ runner.os }}-sonar | |
| - name: Install Sonar Scanner CLI | |
| if: steps.sonar-token.outputs.available == 'true' | |
| env: | |
| SONAR_SCANNER_GPG_FINGERPRINT: 679F1EE92B19609DE816FDE81DB198F93525EC1A | |
| SONAR_SCANNER_VERSION: 8.1.0.6389 | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| case "$(uname -m)" in | |
| arm64) scanner_flavor="macosx-aarch64" ;; | |
| x86_64) scanner_flavor="macosx-x64" ;; | |
| *) | |
| printf 'Unsupported macOS architecture: %s\n' "$(uname -m)" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| scanner_name="sonar-scanner-cli-${SONAR_SCANNER_VERSION}-${scanner_flavor}" | |
| scanner_url="https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/${scanner_name}.zip" | |
| scanner_zip="${RUNNER_TEMP}/${scanner_name}.zip" | |
| scanner_signature="${scanner_zip}.asc" | |
| scanner_root="${RUNNER_TEMP}/sonar-scanner-cli" | |
| gpg_home="${RUNNER_TEMP}/sonar-scanner-gpg" | |
| rm -rf "$scanner_root" "$gpg_home" | |
| mkdir -p "$scanner_root" "$gpg_home" | |
| chmod 700 "$gpg_home" | |
| curl --fail --location --silent --show-error "$scanner_url" --output "$scanner_zip" | |
| curl --fail --location --silent --show-error "${scanner_url}.asc" --output "$scanner_signature" | |
| gpg --homedir "$gpg_home" --batch --keyserver hkps://keys.openpgp.org --recv-keys "$SONAR_SCANNER_GPG_FINGERPRINT" | |
| actual_fingerprint="$( | |
| gpg --homedir "$gpg_home" --batch --with-colons --fingerprint "$SONAR_SCANNER_GPG_FINGERPRINT" \ | |
| | awk -F: '$1 == "fpr" { print $10; exit }' | |
| )" | |
| if [[ "$actual_fingerprint" != "$SONAR_SCANNER_GPG_FINGERPRINT" ]]; then | |
| printf 'Unexpected Sonar Scanner signing key fingerprint: %s\n' "$actual_fingerprint" >&2 | |
| exit 1 | |
| fi | |
| gpg --homedir "$gpg_home" --batch --verify "$scanner_signature" "$scanner_zip" | |
| unzip -q "$scanner_zip" -d "$scanner_root" | |
| printf '%s\n' "${scanner_root}/sonar-scanner-${SONAR_SCANNER_VERSION}-${scanner_flavor}/bin" >> "$GITHUB_PATH" | |
| - name: SonarQube scan | |
| if: steps.sonar-token.outputs.available == 'true' | |
| timeout-minutes: 10 | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| SONAR_QUALITYGATE_WAIT: "true" | |
| run: make sonar-scan | |
| working-directory: mac-sync |