Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Continuous Integration

GitHub Actions Workflows

Each Action pin uses a full commit SHA. A trailing comment shows the released version, for example actions/checkout@<sha> # v7.0.1. Someone can move a tag to point at different code. A commit SHA cannot change. SHA-pinning protects workflows against a compromised or mistakenly re-tagged Action release.

CI Workflow

This workflow runs when:

  • new commits are pushed to the main Git branch;
  • new Git tags are pushed;
  • Pull Requests are created or updated.

It runs three jobs. The Build job compiles SparkleMuffin. The Lint job checks Go and SQL sources. The Test job runs the Go unit and integration tests.

See Compiling, Running Static Analysis, and Running Tests.

Copywrite Workflow

This workflow runs when:

  • new commits are pushed to the main Git branch;
  • new Git tags are pushed;
  • Pull Requests are created or updated.

It checks that Go source files have a valid license header. It uses copywrite.

See Running Static Analysis.

Vulnerabilities Workflow

This workflow runs when:

  • new commits are pushed to the main Git branch;
  • new Git tags are pushed;
  • Pull Requests are created or updated.

It checks Go sources and go.mod for known vulnerabilities. It uses govulncheck.

See Running Static Analysis.

Documentation Workflow

This workflow runs when:

  • new commits are pushed to the main Git branch;
  • new Git tags are pushed;
  • Pull Requests are created or updated.

It generates the HTML documentation with mdBook. Then it checks the documentation for broken links with lychee.

When new commits reach the main Git branch and the CI workflow succeeds, this workflow uploads the documentation to GitHub Pages. Find it at SparkleMuffin Documentation.

See Generating Documentation.

Docker Workflow

This workflow runs when:

  • new commits are pushed to the main Git branch;
  • new Git tags are pushed.

It builds and tags the SparkleMuffin production Docker images. It pushes them to the GitHub Container Registry (GHCR) at ghcr.io/virtualtam/sparklemuffin.

Dependabot

Dependabot opens a Pull Request once a month to update:

  • GitHub Actions, grouped into a single Pull Request;
  • Go modules;
  • Node.js packages, for the frontend asset pipeline;
  • SQLFluff, pinned as a uv dependency in internal/repository/pyproject.toml.