ci(tpagectl): add CI pipeline and cross-platform builds #613

Merged

fuzzy merged 2 commits from ci/tpagectl-pipeline into main 2026-08-08 17:13:34 +00:00

Conversation 3 Commits 2 Files changed 3 +127 -65

automation commented 2026-08-08 16:30:30 +00:00

Owner

Copy link

What

Implements Phase 8 CI pipeline (roadmap #293).

• Build and test on every push (#289) — .forgejo/workflows/ci.yml now triggers on push (all branches) as well as pull_request; the "Check for Go changes" gate is event-aware (PR → diff vs base; push → always runs). The test job additionally builds cmd/tpagectl and enforces the ≥80% tpagectl coverage gate (from #287).
• Lint with golangci-lint (#290) — retained (golangci-lint v2.12.0 job).
• Cross-platform binaries (#291) — new CI build job compiling tpagectl + thwap-pagesd for linux/darwin/windows on amd64/arm64 (CGO_ENABLED=0, version ldflags for tpagectl), uploading artifacts via actions/upload-artifact.
• Artifacts to Forgejo releases (#292) — release.yml expands the matrix to linux/darwin/windows/freebsd/openbsd × amd64/arm64, builds both binaries (tpagectl carries -X main.version/commit/date from the tag), and publishes all to the Forgejo release.

Why

Roadmap task #293, the last item in Phase 8.

Testing

• All 8 tpagectl targets cross-compile locally (linux/darwin/windows/freebsd/openbsd × amd64/arm64, CGO_ENABLED=0)
• All daemon targets (incl. new darwin/windows) cross-compile locally
• Workflow YAML parses; pre-commit "Validate Forgejo Actions files" and "check yaml" pass
• go test -race ./..., golangci-lint, pre-commit clean (workflows can't be executed locally)

Breaking Changes

None (CI-only changes).

Notes

CI enforces the tpagectl coverage gate (≥80%) introduced in #287. The release matrix keeps freebsd/openbsd alongside the roadmap's linux/darwin/windows.

Closes #289
Closes #290
Closes #291
Closes #292
Closes #293

## What Implements Phase 8 CI pipeline (roadmap #293). - **Build and test on every push (#289)** — `.forgejo/workflows/ci.yml` now triggers on `push` (all branches) as well as `pull_request`; the "Check for Go changes" gate is event-aware (PR → diff vs base; push → always runs). The test job additionally builds `cmd/tpagectl` and enforces the ≥80% tpagectl **coverage gate** (from #287). - **Lint with golangci-lint (#290)** — retained (golangci-lint v2.12.0 job). - **Cross-platform binaries (#291)** — new CI build job compiling `tpagectl` + `thwap-pagesd` for **linux/darwin/windows** on amd64/arm64 (`CGO_ENABLED=0`, version ldflags for tpagectl), uploading artifacts via `actions/upload-artifact`. - **Artifacts to Forgejo releases (#292)** — `release.yml` expands the matrix to **linux/darwin/windows/freebsd/openbsd** × amd64/arm64, builds **both** binaries (tpagectl carries `-X main.version/commit/date` from the tag), and publishes all to the Forgejo release. ## Why Roadmap task #293, the last item in Phase 8. ## Testing - [x] All 8 tpagectl targets cross-compile locally (`linux/darwin/windows/freebsd/openbsd` × amd64/arm64, CGO_ENABLED=0) - [x] All daemon targets (incl. new darwin/windows) cross-compile locally - [x] Workflow YAML parses; pre-commit "Validate Forgejo Actions files" and "check yaml" pass - [x] `go test -race ./...`, `golangci-lint`, pre-commit clean (workflows can't be executed locally) ## Breaking Changes None (CI-only changes). ## Notes CI enforces the tpagectl coverage gate (≥80%) introduced in #287. The release matrix keeps freebsd/openbsd alongside the roadmap's linux/darwin/windows. Closes #289 Closes #290 Closes #291 Closes #292 Closes #293

automation added 1 commit 2026-08-08 16:30:30 +00:00

ci(tpagectl): add CI pipeline and cross-platform builds ... fb2b3a15e1

- ci.yml now triggers on every push as well as pull requests (#289), with
  the Go-changes gate made event-aware. The test job also builds tpagectl,
  and enforces the >= 80% tpagectl coverage gate (from #287). A new
  cross-platform build job compiles tpagectl + thwap-pagesd for
  linux/darwin/windows on amd64/arm64 and uploads artifacts (#291).
- golangci-lint job retained (#290).
- release.yml expands the matrix to linux/darwin/windows/freebsd/openbsd
  on amd64/arm64, builds both binaries (tpagectl with version ldflags from
  the tag), and uploads everything to the Forgejo release (#292).

All eight tpagectl and daemon targets verified to cross-compile locally.

Closes #289
Closes #290
Closes #291
Closes #292
Closes #293

fuzzy scheduled this pull request to auto merge when all checks succeed 2026-08-08 16:32:36 +00:00

the.auditor referenced this pull request 2026-08-08 16:49:43 +00:00

Windows release artifacts lack .exe extension #614

the.auditor approved these changes 2026-08-08 16:49:55 +00:00

Dismissed

the.auditor left a comment

Copy link

Clean CI pipeline. The event-aware "Check for Go changes" gate (push → always, PR → 3-dot diff vs base with the base branch fetched) is correct, the test job runs -race with -covermode=atomic plus vet/gofmt and inlines the ≥80% tpagectl coverage gate consistently with make coverage, and the cross-build matrices (6 CI + 10 release targets, CGO_ENABLED=0, tag-derived -X main.version/commit/date ldflags) are sound. Approving; one release-quality suggestion filed.

Suggestions

1. .forgejo/workflows/release.yml (and the CI build job) – Windows artifacts are named without .exe. Append .exe for matrix.os == 'windows' in both matrices. Filed as #614.

Questions

• darwin builds use CGO_ENABLED=0, but the macOS Keychain backend (go-keychain) is cgo-based; a no-cgo darwin binary may compile yet lack a functional keychain backend, degrading to the documented 0600 config fallback. Confirming that's acceptable.
• on: push: (all branches) plus pull_request triggers CI twice on PR branches — redundant but harmless.
• action-gh-release via full GitHub URL requires runner egress to github.com; consistent with the existing GitHub-hosted actions, worth keeping in mind for the LAN instance.

Praise

• The push/pull_request gate duplication is handled cleanly with the event-name branch, and fetch-depth: 0 makes the diff reliable.
• Release ldflags correctly map tag/commit/timestamp to main.version/commit/date.
• Artifact flattening avoids filename collisions across the matrix.

Clean CI pipeline. The event-aware "Check for Go changes" gate (push → always, PR → 3-dot diff vs base with the base branch fetched) is correct, the test job runs `-race` with `-covermode=atomic` plus vet/gofmt and inlines the ≥80% tpagectl coverage gate consistently with `make coverage`, and the cross-build matrices (6 CI + 10 release targets, `CGO_ENABLED=0`, tag-derived `-X main.version/commit/date` ldflags) are sound. Approving; one release-quality suggestion filed. ## Suggestions 1. `.forgejo/workflows/release.yml` (and the CI build job) – Windows artifacts are named without `.exe`. Append `.exe` for `matrix.os == 'windows'` in both matrices. Filed as #614. ## Questions - `darwin` builds use `CGO_ENABLED=0`, but the macOS Keychain backend (`go-keychain`) is cgo-based; a no-cgo darwin binary may compile yet lack a functional keychain backend, degrading to the documented 0600 config fallback. Confirming that's acceptable. - `on: push:` (all branches) plus `pull_request` triggers CI twice on PR branches — redundant but harmless. - `action-gh-release` via full GitHub URL requires runner egress to github.com; consistent with the existing GitHub-hosted actions, worth keeping in mind for the LAN instance. ## Praise - The `push`/`pull_request` gate duplication is handled cleanly with the event-name branch, and `fetch-depth: 0` makes the diff reliable. - Release ldflags correctly map tag/commit/timestamp to `main.version/commit/date`. - Artifact flattening avoids filename collisions across the matrix.

fuzzy added 1 commit 2026-08-08 16:52:48 +00:00

ci: use thwap-actions docker-build and golang-release actions ... e8e10ecc3f

Replace the hand-rolled cross-platform build matrix and release upload
with the org's reusable Forgejo actions:

- ci.yml: the cross-platform build job now uses
  thwap-actions/golang-release to build tpagectl for
  linux/darwin/windows/freebsd/openbsd x amd64/arm64 (artifacts only, no
  release without a token). A new docker job uses
  thwap-actions/docker-build to build (and push on main with registry
  credentials) the thwap-pagesd image from the repo Dockerfile.
- release.yml: uses golang-release for both tpagectl and thwap-pagesd
  with the tag version and github.token, uploading binaries + checksums
  to the Forgejo release.

Test/lint jobs are unchanged.

fuzzy dismissed the.auditor's review 2026-08-08 16:52:48 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

automation commented 2026-08-08 16:52:54 +00:00

Author

Owner

Copy link

Reworked the CI/release to use the org's reusable Forgejo actions instead of hand-rolled docker/matrix logic (commit e8e10ec):

• thwap-actions/golang-release replaces the manual cross-platform matrix in ci.yml (tpagectl for linux/darwin/windows/freebsd/openbsd × amd64/arm64; artifacts only, no release without a token) and drives release.yml for both tpagectl and thwap-pagesd with the tag version + github.token, uploading binaries and checksums to the Forgejo release.
• thwap-actions/docker-build replaces any docker-in-CI concerns: a new docker job builds the thwap-pagesd image from the repo Dockerfile (linux/amd64+arm64) on PR/main, and pushes to git.lan.thwap.org/thwap/thwap-pagesd on main when THWAP_REGISTRY_USER/THWAP_REGISTRY_PASS are configured.

Test/lint jobs are unchanged. Verified locally that the exact golang-release build command compiles from ./cmd/tpagectl and that the workflow YAML passes pre-commit.

Reworked the CI/release to use the org's reusable Forgejo actions instead of hand-rolled docker/matrix logic (commit `e8e10ec`): - **`thwap-actions/golang-release`** replaces the manual cross-platform matrix in `ci.yml` (tpagectl for linux/darwin/windows/freebsd/openbsd × amd64/arm64; artifacts only, no release without a token) and drives `release.yml` for **both** `tpagectl` and `thwap-pagesd` with the tag version + `github.token`, uploading binaries and checksums to the Forgejo release. - **`thwap-actions/docker-build`** replaces any docker-in-CI concerns: a new `docker` job builds the `thwap-pagesd` image from the repo Dockerfile (linux/amd64+arm64) on PR/main, and pushes to `git.lan.thwap.org/thwap/thwap-pagesd` on main when `THWAP_REGISTRY_USER`/`THWAP_REGISTRY_PASS` are configured. Test/lint jobs are unchanged. Verified locally that the exact `golang-release` build command compiles from `./cmd/tpagectl` and that the workflow YAML passes pre-commit.

the.auditor referenced this pull request 2026-08-08 16:56:17 +00:00

CI pins reusable thwap-actions at mutable @main refs #615

the.auditor approved these changes 2026-08-08 16:56:26 +00:00

the.auditor left a comment

Copy link

Re-review at e8e10ec. The rework to the org's reusable LAN-hosted actions (thwap-actions/golang-release, thwap-actions/docker-build) is an improvement: it replaces the hand-rolled matrices, adds a multi-arch Docker build, builds/releases both binaries across 10 platforms, and drops the earlier github.com-egress concern for releases. Test/lint jobs and the ≥80% coverage gate are unchanged and correct. Approving; one pipeline-hygiene suggestion filed.

Suggestions

1. .forgejo/workflows/ci.yml / release.yml – The reusable actions are referenced at mutable @main refs. Pin to an immutable release tag (@v1) so CI/release behavior is reproducible and not silently changed by updates to those branches. Filed as #615.

Notes

• Release binaries embed main.version + main.commit but no longer main.date, so tpagectl version reports built: unknown in releases (the pre-rework version injected the tag timestamp).
• The docker job runs on every push to every branch with no "Check for Go changes" gate — it builds the multi-arch image even for docs-only pushes.
• #614 (.exe extension) is now delegated to golang-release internals — confirm the action names Windows artifacts appropriately, otherwise it stands.

Praise

• Replacing the double-maintained matrices with org-standard actions reduces drift; the release path now covers both binaries uniformly with the tag version.
• Registry credentials flow through vars/secrets only on main pushes, keeping fork/PR builds push-free.
• The push/pull_request event-aware Go-changes gate remains correct across all jobs.

Re-review at `e8e10ec`. The rework to the org's reusable LAN-hosted actions (`thwap-actions/golang-release`, `thwap-actions/docker-build`) is an improvement: it replaces the hand-rolled matrices, adds a multi-arch Docker build, builds/releases both binaries across 10 platforms, and drops the earlier github.com-egress concern for releases. Test/lint jobs and the ≥80% coverage gate are unchanged and correct. Approving; one pipeline-hygiene suggestion filed. ## Suggestions 1. `.forgejo/workflows/ci.yml` / `release.yml` – The reusable actions are referenced at mutable `@main` refs. Pin to an immutable release tag (`@v1`) so CI/release behavior is reproducible and not silently changed by updates to those branches. Filed as #615. ## Notes - Release binaries embed `main.version` + `main.commit` but no longer `main.date`, so `tpagectl version` reports `built: unknown` in releases (the pre-rework version injected the tag timestamp). - The `docker` job runs on every push to every branch with no "Check for Go changes" gate — it builds the multi-arch image even for docs-only pushes. - #614 (`.exe` extension) is now delegated to `golang-release` internals — confirm the action names Windows artifacts appropriately, otherwise it stands. ## Praise - Replacing the double-maintained matrices with org-standard actions reduces drift; the release path now covers both binaries uniformly with the tag version. - Registry credentials flow through `vars`/`secrets` only on main pushes, keeping fork/PR builds push-free. - The `push`/`pull_request` event-aware Go-changes gate remains correct across all jobs.

fuzzy merged commit e8e10ecc3f into main 2026-08-08 17:13:34 +00:00

fuzzy deleted branch ci/tpagectl-pipeline 2026-08-08 17:13:34 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

the.auditor

Labels

Clear labels   

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

thwap/thwap-pagesd!613

No description provided.