Skip to content

ci(workflows): add run-test and run-lint toggles to go-ci - #19

Merged
scttbnsn merged 1 commit into
dev/repository-standardsfrom
ci/go-ci-run-test-lint-toggles
Aug 16, 2026
Merged

ci(workflows): add run-test and run-lint toggles to go-ci#19
scttbnsn merged 1 commit into
dev/repository-standardsfrom
ci/go-ci-run-test-lint-toggles

Conversation

@scttbnsn

@scttbnsn scttbnsn commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

Summary

  • go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo (e.g. drydock, pure TypeScript) that only wants the language-agnostic workflow-security (zizmor) job could not call this reusable workflow at all.
  • Add run-test and run-lint boolean inputs, defaulting to true, and gate the test and lint jobs with the same if: inputs.run-<x> idiom already used for run-govulncheck, run-workflow-security, run-codeql, run-qlty, run-goreleaser, and run-commit-message. This mirrors node-ci.yml's existing run-lint/run-test/run-build pattern (which defaults to false there, since Node CI has no fixed always-on job).
  • Defaults preserve behavior for every existing caller (portwing, sockguard, drydock) pinned at the current frozen SHA — nothing changes until a consumer adopts a new frozen SHA rolled deliberately.
  • No job in go-ci.yml uses needs: against test or lint and none reads their outputs, so toggling either off cannot cascade-skip or fail a downstream job — no always()/result-handling changes were needed.
  • Extended .github/tests/reusable_ci_contract_test.py to assert the two new inputs exist with type: boolean and default: true, keeping the reusable-workflow contract test authoritative.

Scoped to option 1 from #18 only. The node-ci.yml module-directory gap noted in the issue is a separate follow-up, untouched here.

Fixes: #18

Test plan

  • python3 .github/tests/reusable_ci_contract_test.py — all 11 tests pass
  • python3 .github/tests/community_health_contract_test.py, greptile_summon_contract_test.py, greptile_config_contract_test.py, quality_report_contract_test.py — pass (unaffected, run for regression safety)
  • actionlint .github/workflows/go-ci.yml — clean
  • zizmor --no-online-audits .github/workflows/go-ci.yml — no findings
  • Ruby YAML.parse_file on the workflow — parses

Summary by CodeRabbit

  • New Features

    • Added optional controls to enable or skip automated testing and linting in the Go CI workflow.
    • Both checks remain enabled by default.
  • Tests

    • Updated workflow validation to verify the new testing and linting controls.

go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo
that only wants the language-agnostic workflow-security (zizmor) job
couldn't call it. Add run-test/run-lint boolean inputs, mirroring the
existing run-govulncheck/run-workflow-security/etc. toggle pattern,
defaulting to true so existing callers see no behavior change.

Fixes: #18
@scttbnsn

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown
⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown

Review Change Stack

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f6fda2ed-5ac2-4648-95b1-cd1a3dc353f3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 84603abb-21ad-4181-abc1-cf0b3f1907d9

📥 Commits

Reviewing files that changed from the base of the PR and between e30a84d and 488b89e.

📒 Files selected for processing (2)
  • .github/tests/reusable_ci_contract_test.py
  • .github/workflows/go-ci.yml

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The reusable Go CI workflow now accepts run-test and run-lint boolean inputs. Both default to true. The test and lint jobs use these inputs as execution conditions. Contract tests validate the input definitions.

Changes

Go CI job controls

Layer / File(s) Summary
Workflow input contract
.github/workflows/go-ci.yml, .github/tests/reusable_ci_contract_test.py
The workflow defines run-test and run-lint as boolean inputs with true defaults. Contract tests validate their names, types, and defaults.
Conditional test and lint jobs
.github/workflows/go-ci.yml
The test job runs only when inputs.run-test is true. The lint job runs only when inputs.run-lint is true.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 488b8

The reusable Go CI workflow adds boolean toggles for its test and lint jobs while keeping both enabled by default, so existing consumers retain their behavior and Go-less repositories can disable those jobs when needed. No actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

  • CodesWhat/.github#13: Introduced the reusable Go CI workflow and its contract tests extended by this change.

Suggested reviewers: biggest-littlest, alargecompany

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The changes satisfy issue #18 by adding boolean run-test and run-lint inputs that default to true and gate the corresponding jobs.
Out of Scope Changes check ✅ Passed All changes support issue #18 and no unrelated code or workflow changes are present.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the addition of run-test and run-lint toggles to the Go CI workflow.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ci/go-ci-run-test-lint-toggles

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@biggest-littlest biggest-littlest left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Toggle pattern matches the existing run-* idiom, defaults preserve behavior for pinned callers, contract test updated.

@ALARGECOMPANY ALARGECOMPANY left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified no needs: edges on test/lint, so the if: gates can't cascade. Good to land.

@scttbnsn
scttbnsn merged commit 6e7a78d into dev/repository-standards Aug 16, 2026
4 checks passed
scttbnsn added a commit that referenced this pull request Aug 16, 2026
* docs(standards): add organization health defaults

Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks.

* ci(greptile): require manual review requests (#11)

* ci(workflows): add reusable CI foundation (#13)

* ci(workflows): add reusable CI foundation

* fix(workflows): harden reusable release contracts

* feat(quality): standardize long-run reporting (#15)

* feat(quality): add normalized reporting foundation

* test(quality): run reporting contracts in standards validation

* fix(quality): align report validator with schema

* test(quality): verify GitHub integration outputs

* fix(quality): enforce report contract boundaries

* fix(quality): decode reports as utf-8

* test(quality): pin fixture encoding

* ci(profile): make asset generation read-only (#10)

* ci(profile): make asset generation read-only

* fix(profile): restrict asset validation egress

* ci(review): add deduplicated Greptile summon (#9)

* ci(review): add deduplicated Greptile summon

* fix(review): serialize exact-head Greptile summons

* test(review): lock Greptile security controls

* ci(workflows): add run-test and run-lint toggles to go-ci (#19)

go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo
that only wants the language-agnostic workflow-security (zizmor) job
couldn't call it. Add run-test/run-lint boolean inputs, mirroring the
existing run-govulncheck/run-workflow-security/etc. toggle pattern,
defaulting to true so existing callers see no behavior change.

Fixes: #18
@scttbnsn
scttbnsn deleted the ci/go-ci-run-test-lint-toggles branch August 16, 2026 13:24
scttbnsn added a commit that referenced this pull request Aug 16, 2026
* ci(workflows): add module-directory input to node-ci

Mirrors go-ci's module-directory idiom: a string input defaulting to
"." threaded into each fixed script's env as MODULE_DIRECTORY, so a
repo with several independently-gated Node projects can call node-ci
once per project. The default preserves current behavior for existing
callers.

Extends the reusable CI contract test to assert the new input and its
threading, matching how run-test/run-lint were added for go-ci in #19.

* test(workflows): assert module-directory threads into all three node jobs
scttbnsn added a commit that referenced this pull request Aug 16, 2026
* docs(standards): add organization health defaults

Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks.

* ci(greptile): require manual review requests (#11)

* ci(workflows): add reusable CI foundation (#13)

* ci(workflows): add reusable CI foundation

* fix(workflows): harden reusable release contracts

* feat(quality): standardize long-run reporting (#15)

* feat(quality): add normalized reporting foundation

* test(quality): run reporting contracts in standards validation

* fix(quality): align report validator with schema

* test(quality): verify GitHub integration outputs

* fix(quality): enforce report contract boundaries

* fix(quality): decode reports as utf-8

* test(quality): pin fixture encoding

* ci(profile): make asset generation read-only (#10)

* ci(profile): make asset generation read-only

* fix(profile): restrict asset validation egress

* ci(review): add deduplicated Greptile summon (#9)

* ci(review): add deduplicated Greptile summon

* fix(review): serialize exact-head Greptile summons

* test(review): lock Greptile security controls

* ci(workflows): add run-test and run-lint toggles to go-ci (#19)

go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo
that only wants the language-agnostic workflow-security (zizmor) job
couldn't call it. Add run-test/run-lint boolean inputs, mirroring the
existing run-govulncheck/run-workflow-security/etc. toggle pattern,
defaulting to true so existing callers see no behavior change.

Fixes: #18

* ci(workflows): add module-directory input to node-ci (#22)

* ci(workflows): add module-directory input to node-ci

Mirrors go-ci's module-directory idiom: a string input defaulting to
"." threaded into each fixed script's env as MODULE_DIRECTORY, so a
repo with several independently-gated Node projects can call node-ci
once per project. The default preserves current behavior for existing
callers.

Extends the reusable CI contract test to assert the new input and its
threading, matching how run-test/run-lint were added for go-ci in #19.

* test(workflows): assert module-directory threads into all three node jobs
scttbnsn added a commit that referenced this pull request Aug 16, 2026
* docs(standards): add organization health defaults

Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks.

* ci(greptile): require manual review requests (#11)

* ci(workflows): add reusable CI foundation (#13)

* ci(workflows): add reusable CI foundation

* fix(workflows): harden reusable release contracts

* feat(quality): standardize long-run reporting (#15)

* feat(quality): add normalized reporting foundation

* test(quality): run reporting contracts in standards validation

* fix(quality): align report validator with schema

* test(quality): verify GitHub integration outputs

* fix(quality): enforce report contract boundaries

* fix(quality): decode reports as utf-8

* test(quality): pin fixture encoding

* ci(profile): make asset generation read-only (#10)

* ci(profile): make asset generation read-only

* fix(profile): restrict asset validation egress

* ci(review): add deduplicated Greptile summon (#9)

* ci(review): add deduplicated Greptile summon

* fix(review): serialize exact-head Greptile summons

* test(review): lock Greptile security controls

* ci(workflows): add run-test and run-lint toggles to go-ci (#19)

go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo
that only wants the language-agnostic workflow-security (zizmor) job
couldn't call it. Add run-test/run-lint boolean inputs, mirroring the
existing run-govulncheck/run-workflow-security/etc. toggle pattern,
defaulting to true so existing callers see no behavior change.

Fixes: #18

* ci(workflows): add module-directory input to node-ci (#22)

* ci(workflows): add module-directory input to node-ci

Mirrors go-ci's module-directory idiom: a string input defaulting to
"." threaded into each fixed script's env as MODULE_DIRECTORY, so a
repo with several independently-gated Node projects can call node-ci
once per project. The default preserves current behavior for existing
callers.

Extends the reusable CI contract test to assert the new input and its
threading, matching how run-test/run-lint were added for go-ci in #19.

* test(workflows): assert module-directory threads into all three node jobs

* docs(onboarding): record the qlty alignment baseline (#24)
scttbnsn added a commit that referenced this pull request Aug 16, 2026
* docs(standards): add organization health defaults

Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks.

* ci(greptile): require manual review requests (#11)

* ci(workflows): add reusable CI foundation (#13)

* ci(workflows): add reusable CI foundation

* fix(workflows): harden reusable release contracts

* feat(quality): standardize long-run reporting (#15)

* feat(quality): add normalized reporting foundation

* test(quality): run reporting contracts in standards validation

* fix(quality): align report validator with schema

* test(quality): verify GitHub integration outputs

* fix(quality): enforce report contract boundaries

* fix(quality): decode reports as utf-8

* test(quality): pin fixture encoding

* ci(profile): make asset generation read-only (#10)

* ci(profile): make asset generation read-only

* fix(profile): restrict asset validation egress

* ci(review): add deduplicated Greptile summon (#9)

* ci(review): add deduplicated Greptile summon

* fix(review): serialize exact-head Greptile summons

* test(review): lock Greptile security controls

* ci(workflows): add run-test and run-lint toggles to go-ci (#19)

go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo
that only wants the language-agnostic workflow-security (zizmor) job
couldn't call it. Add run-test/run-lint boolean inputs, mirroring the
existing run-govulncheck/run-workflow-security/etc. toggle pattern,
defaulting to true so existing callers see no behavior change.

Fixes: #18

* ci(workflows): add module-directory input to node-ci (#22)

* ci(workflows): add module-directory input to node-ci

Mirrors go-ci's module-directory idiom: a string input defaulting to
"." threaded into each fixed script's env as MODULE_DIRECTORY, so a
repo with several independently-gated Node projects can call node-ci
once per project. The default preserves current behavior for existing
callers.

Extends the reusable CI contract test to assert the new input and its
threading, matching how run-test/run-lint were added for go-ci in #19.

* test(workflows): assert module-directory threads into all three node jobs

* docs(onboarding): record the qlty alignment baseline (#24)

* docs(onboarding): align with the codified standards registry (#26)

* docs(onboarding): align with the codified standards registry

- docs(onboarding): name Codecov as the coverage cloud; Qlty Cloud App and
  maintainability badge stay, checks stay non-required
- docs(onboarding): trivy deprecated in favor of Grype, including the qlty
  plugin blocks in the two reference configs (drydock#753, portwing#135)
- docs(onboarding): CodeRabbit free Pro is public-only; private repos use
  cross-account human review
- docs(onboarding): add the greptile.json contract and the label-gated
  second-opinion caller

* docs(onboarding): reword the CodeRabbit private-repo claim as org policy

- docs(onboarding): free-plan private-repo reviews exist but are
  rate-limited and never fired here; the skip is policy, not a plan fact
- docs(onboarding): pair the Greptile caller with auto-applied CodeRabbit
  labeling so the second-opinion label is criteria-driven
scttbnsn added a commit that referenced this pull request Aug 16, 2026
* docs(standards): add organization health defaults

Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks.

* ci(greptile): require manual review requests (#11)

* ci(workflows): add reusable CI foundation (#13)

* ci(workflows): add reusable CI foundation

* fix(workflows): harden reusable release contracts

* feat(quality): standardize long-run reporting (#15)

* feat(quality): add normalized reporting foundation

* test(quality): run reporting contracts in standards validation

* fix(quality): align report validator with schema

* test(quality): verify GitHub integration outputs

* fix(quality): enforce report contract boundaries

* fix(quality): decode reports as utf-8

* test(quality): pin fixture encoding

* ci(profile): make asset generation read-only (#10)

* ci(profile): make asset generation read-only

* fix(profile): restrict asset validation egress

* ci(review): add deduplicated Greptile summon (#9)

* ci(review): add deduplicated Greptile summon

* fix(review): serialize exact-head Greptile summons

* test(review): lock Greptile security controls

* ci(workflows): add run-test and run-lint toggles to go-ci (#19)

go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo
that only wants the language-agnostic workflow-security (zizmor) job
couldn't call it. Add run-test/run-lint boolean inputs, mirroring the
existing run-govulncheck/run-workflow-security/etc. toggle pattern,
defaulting to true so existing callers see no behavior change.

Fixes: #18

* ci(workflows): add module-directory input to node-ci (#22)

* ci(workflows): add module-directory input to node-ci

Mirrors go-ci's module-directory idiom: a string input defaulting to
"." threaded into each fixed script's env as MODULE_DIRECTORY, so a
repo with several independently-gated Node projects can call node-ci
once per project. The default preserves current behavior for existing
callers.

Extends the reusable CI contract test to assert the new input and its
threading, matching how run-test/run-lint were added for go-ci in #19.

* test(workflows): assert module-directory threads into all three node jobs

* docs(onboarding): record the qlty alignment baseline (#24)

* docs(onboarding): align with the codified standards registry (#26)

* docs(onboarding): align with the codified standards registry

- docs(onboarding): name Codecov as the coverage cloud; Qlty Cloud App and
  maintainability badge stay, checks stay non-required
- docs(onboarding): trivy deprecated in favor of Grype, including the qlty
  plugin blocks in the two reference configs (drydock#753, portwing#135)
- docs(onboarding): CodeRabbit free Pro is public-only; private repos use
  cross-account human review
- docs(onboarding): add the greptile.json contract and the label-gated
  second-opinion caller

* docs(onboarding): reword the CodeRabbit private-repo claim as org policy

- docs(onboarding): free-plan private-repo reviews exist but are
  rate-limited and never fired here; the skip is policy, not a plan fact
- docs(onboarding): pair the Greptile caller with auto-applied CodeRabbit
  labeling so the second-opinion label is criteria-driven

* chore(repo): meet our own onboarding checklist (#28)

* chore(repo): meet our own onboarding checklist

- chore(repo): MIT LICENSE (infrastructure repos are MIT; products AGPL)
- docs(repo): root AGENTS.md with repo-specific rules and validation
- build(hooks): lefthook with commit-msg + pre-push mirroring CI via
  scripts/validate.sh

* fix(hooks): tighten the commit-msg exemptions and mirror zizmor's CI flags

- fix(hooks): merge/revert exemptions match git's generated subjects only,
  so a hand-typed 'Merge ...' subject no longer bypasses the check
- fix(hooks): require a non-whitespace character after the colon
- fix(hooks): zizmor runs --no-online-audits locally, matching CI's
  online-audits: false for local/CI parity

* fix(hooks): exempt only git-generated merge and revert subjects
scttbnsn added a commit that referenced this pull request Aug 17, 2026
* docs(standards): add organization health defaults

Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks.

* ci(greptile): require manual review requests (#11)

* ci(workflows): add reusable CI foundation (#13)

* ci(workflows): add reusable CI foundation

* fix(workflows): harden reusable release contracts

* feat(quality): standardize long-run reporting (#15)

* feat(quality): add normalized reporting foundation

* test(quality): run reporting contracts in standards validation

* fix(quality): align report validator with schema

* test(quality): verify GitHub integration outputs

* fix(quality): enforce report contract boundaries

* fix(quality): decode reports as utf-8

* test(quality): pin fixture encoding

* ci(profile): make asset generation read-only (#10)

* ci(profile): make asset generation read-only

* fix(profile): restrict asset validation egress

* ci(review): add deduplicated Greptile summon (#9)

* ci(review): add deduplicated Greptile summon

* fix(review): serialize exact-head Greptile summons

* test(review): lock Greptile security controls

* ci(workflows): add run-test and run-lint toggles to go-ci (#19)

go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo
that only wants the language-agnostic workflow-security (zizmor) job
couldn't call it. Add run-test/run-lint boolean inputs, mirroring the
existing run-govulncheck/run-workflow-security/etc. toggle pattern,
defaulting to true so existing callers see no behavior change.

Fixes: #18

* ci(workflows): add module-directory input to node-ci (#22)

* ci(workflows): add module-directory input to node-ci

Mirrors go-ci's module-directory idiom: a string input defaulting to
"." threaded into each fixed script's env as MODULE_DIRECTORY, so a
repo with several independently-gated Node projects can call node-ci
once per project. The default preserves current behavior for existing
callers.

Extends the reusable CI contract test to assert the new input and its
threading, matching how run-test/run-lint were added for go-ci in #19.

* test(workflows): assert module-directory threads into all three node jobs

* docs(onboarding): record the qlty alignment baseline (#24)

* docs(onboarding): align with the codified standards registry (#26)

* docs(onboarding): align with the codified standards registry

- docs(onboarding): name Codecov as the coverage cloud; Qlty Cloud App and
  maintainability badge stay, checks stay non-required
- docs(onboarding): trivy deprecated in favor of Grype, including the qlty
  plugin blocks in the two reference configs (drydock#753, portwing#135)
- docs(onboarding): CodeRabbit free Pro is public-only; private repos use
  cross-account human review
- docs(onboarding): add the greptile.json contract and the label-gated
  second-opinion caller

* docs(onboarding): reword the CodeRabbit private-repo claim as org policy

- docs(onboarding): free-plan private-repo reviews exist but are
  rate-limited and never fired here; the skip is policy, not a plan fact
- docs(onboarding): pair the Greptile caller with auto-applied CodeRabbit
  labeling so the second-opinion label is criteria-driven

* chore(repo): meet our own onboarding checklist (#28)

* chore(repo): meet our own onboarding checklist

- chore(repo): MIT LICENSE (infrastructure repos are MIT; products AGPL)
- docs(repo): root AGENTS.md with repo-specific rules and validation
- build(hooks): lefthook with commit-msg + pre-push mirroring CI via
  scripts/validate.sh

* fix(hooks): tighten the commit-msg exemptions and mirror zizmor's CI flags

- fix(hooks): merge/revert exemptions match git's generated subjects only,
  so a hand-typed 'Merge ...' subject no longer bypasses the check
- fix(hooks): require a non-whitespace character after the colon
- fix(hooks): zizmor runs --no-online-audits locally, matching CI's
  online-audits: false for local/CI parity

* fix(hooks): exempt only git-generated merge and revert subjects

* docs(community): org-default code of conduct + community checklist (#30)

* docs(community): add org-default code of conduct and community checklist items

CODE_OF_CONDUCT.md is Contributor Covenant 2.0 (drydock's tuned copy) with
the org contact security@codeswhat.com, cascading to every repo without a
local one. Onboarding checklist gains the cascade-first rule and the
Discussions on/off split for product vs meta repos.

* test(community): assert the code of conduct in the community-health contract
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants