Skip to content

ci: add golangci-lint and coverage gate #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cursor merged 3 commits into from
Jul 26, 2026
Merged

ci: add golangci-lint and coverage gate #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e70bd4c
ci: add golangci-lint and 65% coverage gate
cursoragent Jul 26, 2026
f64d7ad
ci: fix workflow YAML indentation for lint and coverage jobs
cursoragent Jul 26, 2026
d13f4d1
ci: fix workflow YAML indentation for lint and coverage jobs
cursoragent Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 57 additions & 10 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,72 @@ name: CI

on:
push:
branches:
- main
branches: [main]
pull_request:
workflow_dispatch:

permissions:
contents: read
Comment on lines +9 to +10

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- .github/workflows/ci.yml (relevant lines) ---\n'
nl -ba .github/workflows/ci.yml | sed -n '1,140p'

printf '\n--- search for golangci-lint action usage ---\n'
rg -n "golangci|only-new-issues|pull-requests|permissions:" .github/workflows -S

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 262

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- .github/workflows/ci.yml (relevant lines) ---'
nl -ba .github/workflows/ci.yml | sed -n '1,140p'

echo
echo '--- golangci-lint action references ---'
rg -n "golangci|only-new-issues|pull-requests|permissions:" .github/workflows -S || true

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 261

🌐 Web query:

golangci-lint-action only-new-issues pull-requests permission GitHub Actions

💡 Result:

When using the only-new-issues option in the golangci-lint-action, you should grant read access to pull requests in your GitHub Actions workflow permissions [1][2]. Specifically, the action requires the pull-requests: read permission to fetch the necessary diff information from the GitHub API [1][3]. The recommended configuration in your workflow file is as follows [1][2]: permissions: contents: read # Optional: allow read access to pull requests. Use with only-new-issues option. pull-requests: read The action uses this permission to retrieve the diff of the pull request content (or push content) via the GitHub API, which it then processes using the --new-from-patch option to report only newly introduced issues [1][2]. If you do not provide this permission, the action may fail to correctly identify or filter for only the new issues [1].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- .github/workflows/ci.yml (relevant lines) ---'
sed -n '1,140p' .github/workflows/ci.yml | cat -n

echo
echo '--- golangci-lint references ---'
rg -n "golangci|only-new-issues|pull-requests|permissions:" .github/workflows -S || true

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 2656

Add pull-requests: read for only-new-issues. contents: read leaves PR access at none, and this mode needs the pull request API on PR runs or linting can fail before it starts.

Proposed fix 
 permissions:
   contents: read
+  pull-requests: read
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
contents: read
permissions:
contents: read
pull-requests: read
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 9 - 10, Update the workflow-level
permissions alongside contents: read to grant pull-requests: read, ensuring
only-new-issues can access pull request data during PR runs.


concurrency:
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

env:
COVER_MIN: "65"

jobs:
lint:
name: Go lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
fetch-depth: 0

- uses: actions/setup-go@v5
with:
go-version-file: go.mod
cache: true

- name: golangci-lint
uses: golangci/golangci-lint-action@v8
with:
version: latest
only-new-issues: true
args: --timeout=5m

test:
name: Go tests + coverage
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6
with:
persist-credentials: false

- uses: actions/setup-go@v5
with:
go-version: '1.26'
go-version-file: go.mod
cache: true

- name: Run tests with coverage
env:
GOWORK: off
run: go test $(go list ./pkg/pluginsdk/... | grep -v '/runtimedefault$') -count=1 -covermode=atomic -coverprofile=coverage.out
Comment on lines +54 to +57

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== ci.yml relevant section ==\n'
nl -ba .github/workflows/ci.yml | sed -n '1,140p'

printf '\n== search for coverage/protobuf filtering ==\n'
rg -n --hidden -S "coverage\.raw|coverage\.out|pb\.go|runtimedefault|coverprofile|go test .*cover" .github/workflows . || true

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 242

🌐 Web query:

GitHub Actions default shell Linux bash pipefail documentation run step

💡 Result:

In GitHub Actions, the shell used for run steps depends on whether you explicitly specify a shell and whether the runner is on a Linux/macOS or Windows platform [1]. The default behavior on Linux and macOS is as follows: 1. Unspecified shell: If no shell is specified for a run step on a Linux or macOS runner, GitHub Actions uses a default command equivalent to bash -e {0} [1]. This default mode does not include the pipefail option [1][2]. If bash is not found on the system path, it falls back to sh -e {0} [1]. 2. Explicit bash shell: If you explicitly specify shell: bash in your workflow, GitHub Actions uses the command bash --noprofile --norc -eo pipefail {0} [1]. This explicitly includes the pipefail option, which ensures that a pipeline returns a non-zero exit code if any command in the pipeline fails [1][2]. To ensure that your run steps utilize pipefail behavior, it is recommended to explicitly set the shell to bash [2]: - name: Example step shell: bash run: | command_that_might_fail | command_that_succeeds If you require custom shell behavior beyond the defaults provided, you can specify a custom template string for the shell option, such as shell: bash -eo pipefail {0} [3][2]. Note that for jobs running inside a container, the default shell is typically sh rather than bash unless otherwise configured [4].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== ci.yml section ==\n'
sed -n '45,70p' .github/workflows/ci.yml

printf '\n== search for coverage/protobuf filtering ==\n'
grep -RIn --exclude-dir=.git -E 'coverage\.raw|coverage\.out|pb\.go|runtimedefault|coverprofile|go test .*cover' .github/workflows .

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 3461

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== ci.yml section ==\n'
sed -n '45,70p' .github/workflows/ci.yml

printf '\n== coverage/protobuf references under repository ==\n'
grep -RIn --exclude-dir=.git -E 'coverage\.raw|coverage\.out|pb\.go|runtimedefault|coverprofile|go test .*cover' .

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 3166

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== scripts/check-coverage.sh ==\n'
sed -n '1,160p' scripts/check-coverage.sh

printf '\n== coverage/raw post-processing references ==\n'
grep -RIn --exclude-dir=.git -E 'coverage\.raw|awk .*pb\.go|sed .*pb\.go|filter.*pb\.go' scripts .github/workflows || true

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 919

Keep coverage generation fail-closed and drop generated protobufs. The current step still writes .pb.go entries into coverage.out, and the go list | grep substitution runs under the default bash -e shell without pipefail, so a go list failure can still fall through to go test with a partial package set.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 54 - 57, Update the “Run tests with
coverage” workflow step to exclude generated .pb.go files from coverage.out and
make package discovery fail closed: enable pipefail so go list or grep failures
stop the step rather than producing a partial package list. Preserve the
existing runtimedefault exclusion and coverage test behavior.


- name: Run tests
run: go test ./...
- name: Enforce coverage floor
run: ./scripts/check-coverage.sh coverage.out

- name: Build example plugin
run: go build ./examples/hello-scheduled-task
- name: Build examples
run: |
go build ./examples/hello-scheduled-task
go build ./examples/hello-runtime-host

- name: Build hello-runtime-host example
run: go build ./examples/hello-runtime-host
- name: Upload coverage profile
if: always()
uses: actions/upload-artifact@v5
with:
name: coverage-out
path: coverage.out
if-no-files-found: ignore
29 changes: 29 additions & 0 deletions .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
version: "2"

run:
timeout: 5m

formatters:
enable:
- gofmt
- goimports

settings:
goimports:
local-prefixes:
- github.com/prairie-server/prairie-plugin-sdk

linters:
enable:
- errcheck
- govet
- ineffassign
- misspell
- staticcheck
- unused

exclusions:
rules:
- path: _test\.go
linters:
- errcheck
21 changes: 21 additions & 0 deletions scripts/check-coverage.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
#!/usr/bin/env bash
# Fail if total statement coverage is below COVER_MIN (percent).
set -euo pipefail
COVER_MIN="${COVER_MIN:-70}"
Comment on lines +2 to +4

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Align the fallback with the documented 65% floor.

CI sets COVER_MIN=65, but standalone execution defaults to 70, so local runs can reject coverage that passes CI. Use 65 as the fallback or centralize the threshold.

Proposed fix 
-COVER_MIN="${COVER_MIN:-70}"
+COVER_MIN="${COVER_MIN:-65}"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Fail if total statement coverage is below COVER_MIN (percent).
set -euo pipefail
COVER_MIN="${COVER_MIN:-70}"
# Fail if total statement coverage is below COVER_MIN (percent).
set -euo pipefail
COVER_MIN="${COVER_MIN:-65}"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-coverage.sh` around lines 2 - 4, Update the COVER_MIN fallback
in the coverage-check script from 70 to the documented 65 percent floor, while
preserving the ability for an explicitly set COVER_MIN value to override it.

PROFILE="${1:-coverage.out}"
if [[ ! -f "$PROFILE" ]]; then
echo "coverage profile missing: $PROFILE" >&2
exit 1
fi
total="$(go tool cover -func="$PROFILE" | awk '/^total:/{gsub(/%/,"",$3); print $3}')"
if [[ -z "$total" ]]; then
echo "could not parse total coverage from $PROFILE" >&2
exit 1
fi
awk -v total="$total" -v min="$COVER_MIN" 'BEGIN {
if (total+0 < min+0) {
printf "coverage %.1f%% is below required %.1f%%\n", total, min > "/dev/stderr"
exit 1
}
printf "coverage %.1f%% (min %.1f%%)\n", total, min
Comment on lines +15 to +20

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
awk -v min='abc' 'BEGIN { print min+0 < 65+0 ? "fail" : "pass" }'

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 176

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
wc -l scripts/check-coverage.sh
cat -n scripts/check-coverage.sh | sed -n '1,80p'

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 1015

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
wc -l scripts/check-coverage.sh
cat -n scripts/check-coverage.sh | sed -n '1,120p'

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 1015

🏁 Script executed:

python3 - <<'PY'
import subprocess, textwrap

cases = [
    ("80", "abc"),
    ("80", "-5"),
    ("80", "70"),
    ("50", "70"),
]
for total, minv in cases:
    script = textwrap.dedent(f"""\
    awk -v total='{total}' -v min='{minv}' 'BEGIN {{
      if (total+0 < min+0) {{
        print "reject"
      }} else {{
        print "accept"
      }}
    }}'
    """)
    out = subprocess.check_output(["bash", "-lc", script], text=True).strip()
    print(total, minv, "=>", out)
PY

Repository: Prairie-Server/prairie-plugin-sdk

Length of output: 236

Reject malformed COVER_MIN values before the compare. min+0 coerces abc and negative inputs to 0, so invalid thresholds can pass the gate. Validate COVER_MIN is numeric and within 0..100 first.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-coverage.sh` around lines 15 - 20, Validate COVER_MIN before
invoking the awk comparison, requiring a numeric value between 0 and 100 and
rejecting malformed or negative thresholds with a nonzero exit. Update the
coverage-check flow around the awk BEGIN block so only validated COVER_MIN
values reach the existing total-versus-min comparison.

}'
Loading