go, gradle, lint: small shared workflows #10

2026-11-08T14:55:21Z

james.maes commented

2026-11-08 14:55:21 +00:00

Three small shared workflows, same conventions as node/maven/android (workflow_call, runner input, container + workspace volume, HOME=/tmp, builtin:checkout).

go.yaml: golang:<go-version>-bookworm, GOTOOLCHAIN=local; go mod verify, gofmt (tracked files), go vet, optional golangci-lint 2.15.0 (sha256-pinned), go test (optional -race, test-args), extra commands; on v* tags release-commands then artifacts + SHA256SUMS on the Gitea release (job token; re-runs replace assets).
gradle.yaml: gradle:jdk<java-version> (image Gradle unused); wrapper verification (services.gradle.org distribution, official wrapper jar for that version, distributionSha256Sum equal to the official checksum); tasks lines; artifacts on v* tags.
lint.yaml: opt-in shellcheck 0.11.0, yamllint 1.38.0 (hash-locked), JSON parse, ruff 0.17.1, OpenTofu 1.13.2 fmt/validate (-backend=false), markdownlint-cli2 0.24.0 (exact version, tree frozen by npm --before), ansible-lint (image digest, own job), commands, exclude; git pathspec globs over tracked files; git-crypt files always skipped.

Proven on branches pinned to this branch: license-tool (go, incl. a throwaway prerelease tag with 5 archives + SHA256SUMS, since deleted), qqq-app-developer-intellij-plugin and intellij-commentator-plugin (gradle), qqq-meta-manager, qqq-templates-hub, gamut, standards, terraform-proxmox-talos, Praetor (lint); ansible-lint job mechanics probed on Galaxy-Cloud-Init (temporary branch, deleted). README documents all three.

🤖 Generated with Claude Code

Three small shared workflows, same conventions as node/maven/android (workflow_call, `runner` input, container + workspace volume, HOME=/tmp, builtin:checkout). - **go.yaml**: `golang:<go-version>-bookworm`, `GOTOOLCHAIN=local`; go mod verify, gofmt (tracked files), go vet, optional golangci-lint 2.15.0 (sha256-pinned), go test (optional `-race`, `test-args`), extra `commands`; on `v*` tags `release-commands` then `artifacts` + SHA256SUMS on the Gitea release (job token; re-runs replace assets). - **gradle.yaml**: `gradle:jdk<java-version>` (image Gradle unused); wrapper verification (services.gradle.org distribution, official wrapper jar for that version, `distributionSha256Sum` equal to the official checksum); `tasks` lines; `artifacts` on `v*` tags. - **lint.yaml**: opt-in shellcheck 0.11.0, yamllint 1.38.0 (hash-locked), JSON parse, ruff 0.17.1, OpenTofu 1.13.2 fmt/validate (-backend=false), markdownlint-cli2 0.24.0 (exact version, tree frozen by npm --before), ansible-lint (image digest, own job), `commands`, `exclude`; git pathspec globs over tracked files; git-crypt files always skipped. Proven on branches pinned to this branch: license-tool (go, incl. a throwaway prerelease tag with 5 archives + SHA256SUMS, since deleted), qqq-app-developer-intellij-plugin and intellij-commentator-plugin (gradle), qqq-meta-manager, qqq-templates-hub, gamut, standards, terraform-proxmox-talos, Praetor (lint); ansible-lint job mechanics probed on Galaxy-Cloud-Init (temporary branch, deleted). README documents all three. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 5 commits 2026-11-08 14:55:21 +00:00

go, gradle, lint: small shared workflows 7674d24f20

go.yaml: gofmt, go vet, optional golangci-lint (pinned, sha256-verified),
go test (optional race), extra gate commands, and on v* tags release
commands plus artifacts with SHA256SUMS on the Gitea release.

gradle.yaml: verified Gradle wrapper (official jar and distribution
checksum), ./gradlew task lines, artifacts on v* tags.

lint.yaml: opt-in shellcheck, yamllint, JSON, ruff, tofu fmt/validate,
markdownlint and ansible-lint; every tool pinned and checksum- or
digest-verified; git-crypt files always skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

gradle: gradle:jdk<N> image (checkout needs git); lint: markdownlint in the lint job 194fc721d6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lint: name ansible.cfg explicitly; README: Go, Gradle and Lint 55e4f9f71a

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

go, gradle: release with the job token 1df074d058

The org PACKAGES_TOKEN got HTTP 403 on the release lookup (license-tool
proof tag); the job token with contents: write creates and fills the
release, so the workflows need no secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

go, gradle: a release without the asset yet is not an error 964d4a8a22

grep finds no asset to replace on a fresh release; under pipefail that
ended the step silently.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

james.maes merged commit fc670fdee9 into main

2026-11-08 14:56:13 +00:00

james.maes deleted branch small-workflows

2026-11-08 14:56:13 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/ci-workflows#10