ci: redesign pipeline with security hardening and best practices

iamralch · iamralch · commit 9c51bc173e40 · 2026-04-22T19:23:40.000+04:00
Pipeline redesign:
- Split into test, build, release, publish jobs with clear responsibilities
- test: go tests + coverage reporting
- build: nix matrix build (x86_64-linux, aarch64-darwin) with artifact upload
- release: release-please PR management
- publish: download artifacts and upload to GitHub release

Security hardening:
- Move all permissions to job level (least privilege)
- Restrict merge.yml from write-all to contents+pull-requests write
- Add concurrency control with cancel-in-progress for PRs
- Add job timeouts across all workflows

Workflow improvements:
- Replace github-script auto-merge with gh CLI (approve + merge --auto)
- Restrict auto-merge trigger to opened/reopened events only
- Add LGTM body to approval review
- Set dependabot[bot] as flake.lock PR author for auto-merge compatibility
- Add conventional commit message and PR title to flake.lock updates
- Add defaults: run: shell: bash to ci.yml and merge.yml
- Set use-flakehub: disabled and use-gha-cache: enabled on magic-nix-cache
- Use upload-artifact@v7 with archive: false and if-no-files-found: error
- Use download-artifact@v8 with skip-decompress: true and merge-multiple: true
- Add fail-fast: false to build matrix
- Group dependabot updates to reduce PR noise
- Move fetch-depth: 0 to release job only

Nix:
- Add doInstallCheck + installCheckPhase for smoke test on nix build

Coverage:
- Drop octocov push/report (Option B): remove generated badge.svg and
  report.json from repo, keep only PR comment reporting
- Remove stale coverage badge from README
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -6,6 +6,9 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
+    groups:
+      all-go-deps:
+        patterns: ["*"]
     labels:
       - "dependencies"
       - "go"
@@ -19,6 +22,9 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
+    groups:
+      all-actions:
+        patterns: ["*"]
     labels:
       - "dependencies"
       - "github-actions"
diff --git a/.github/octocov/badge.svg b/.github/octocov/badge.svg
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,69 +1,65 @@
 name: CI
 
-permissions:
-  contents: write
-  id-token: write
-  pull-requests: write
-
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
-  build:
+  test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@v22
 
       - name: Setup Nix Cache
         uses: DeterminateSystems/magic-nix-cache-action@v13
+        with:
+          use-flakehub: disabled
+          use-gha-cache: enabled
 
       - name: Run Tests
-        run: nix develop --command go tool ginkgo run -r -coverprofile=coverage.out -covermode=atomic ./...
+        run: |
+          nix develop --command go tool ginkgo run -r \
+            -coverprofile=coverage.out -covermode=atomic ./...
 
       - name: Run octocov
         uses: k1LoW/octocov-action@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-  release:
-    needs: build
-    if: github.event_name == 'push'
-    runs-on: ubuntu-latest
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Create Release PR
-        id: release
-        uses: googleapis/release-please-action@v4
-        with:
-          manifest-file: .github/config/release-please-manifest.json
-          config-file: .github/config/release-please-config.json
-          target-branch: main
-
-  build-release:
-    needs: release
-    if: ${{ needs.release.outputs.release_created }}
+  build:
+    needs: test
     strategy:
+      fail-fast: false
       matrix:
         include:
           - os: ubuntu-latest
             nix_system: x86_64-linux
           - os: macos-14
             nix_system: aarch64-darwin
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    timeout-minutes: 60
+    env:
+      BIN_PATH: sqlc-gen-queries-${{ matrix.nix_system }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -73,16 +69,68 @@ jobs:
 
       - name: Setup Nix Cache
         uses: DeterminateSystems/magic-nix-cache-action@v13
+        with:
+          use-flakehub: disabled
+          use-gha-cache: enabled
 
       - name: Build with Nix
         run: nix build . --system ${{ matrix.nix_system }}
 
-      - name: Prepare Release Assets
-        run: |
-          mkdir -p release && install -m 0755 result/bin/sqlc-gen-queries release/sqlc-gen-queries-${{ matrix.nix_system }}
+      - name: Prepare Binary
+        run: install -m 0755 result/bin/sqlc-gen-queries "$BIN_PATH"
+
+      - name: Upload Binary
+        uses: actions/upload-artifact@v7
+        with:
+          path: ${{ env.BIN_PATH }}
+          archive: false
+          if-no-files-found: error
+          retention-days: 1
+
+  release:
+    needs: build
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    permissions:
+      contents: write
+      id-token: write
+      pull-requests: write
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Create Release PR
+        id: release
+        uses: googleapis/release-please-action@v4
+        with:
+          manifest-file: .github/config/release-please-manifest.json
+          config-file: .github/config/release-please-config.json
+          target-branch: main
+
+  publish:
+    needs: release
+    if: needs.release.outputs.release_created
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    timeout-minutes: 10
+    steps:
+      - name: Download Binaries
+        uses: actions/download-artifact@v8
+        with:
+          pattern: sqlc-gen-queries-*
+          merge-multiple: true
+          skip-decompress: true
+          path: release/
 
       - name: Upload Release Assets
         uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ needs.release.outputs.tag_name }}
-          files: release/sqlc-gen-queries-${{ matrix.nix_system }}
+          files: release/*
diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml
@@ -2,28 +2,25 @@ name: Auto Merge
 
 on:
   pull_request:
+    types: [opened, reopened]
 
-permissions: write-all
+defaults:
+  run:
+    shell: bash
 
 jobs:
-  automerge:
-    if: ${{ github.actor == 'dependabot[bot]' }}
+  merge:
+    if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    timeout-minutes: 5
     steps:
-      - name: automerge
-        uses: actions/github-script@v9.0.0
-        with:
-          script: |
-            github.rest.pulls.createReview({
-              owner: context.payload.repository.owner.login,
-              repo: context.payload.repository.name,
-              pull_number: context.payload.pull_request.number,
-              event: 'APPROVE'
-            })
-            github.rest.pulls.merge({
-              owner: context.payload.repository.owner.login,
-              repo: context.payload.repository.name,
-              pull_number: context.payload.pull_request.number,
-              merge_method: "rebase",
-            })
-          github-token: ${{ github.token }}
+      - name: Enable auto-merge
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          gh pr review --approve --body "LGTM" "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
@@ -5,13 +5,13 @@ on:
     - cron: "0 0 * * 1"
   workflow_dispatch:
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   update:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -21,8 +21,17 @@ jobs:
 
       - name: Setup Nix Cache
         uses: DeterminateSystems/magic-nix-cache-action@v13
+        with:
+          use-flakehub: disabled
+          use-gha-cache: enabled
 
       - name: Update root flake.lock
         uses: DeterminateSystems/update-flake-lock@v28
         with:
           pr-labels: dependencies
+          pr-title: "chore(flake): update flake.lock"
+          commit-msg: "chore(flake): update flake.lock"
+          git-author-name: dependabot[bot]
+          git-author-email: dependabot[bot]@users.noreply.github.com
+          git-committer-name: dependabot[bot]
+          git-committer-email: dependabot[bot]@users.noreply.github.com
diff --git a/.octocov.yml b/.octocov.yml
@@ -9,9 +9,3 @@ comment:
   deletePrevious: true
 summary:
   if: true
-report:
-  if: is_default_branch
-  path: .github/octocov/report.json
-push:
-  if: is_default_branch
-  message: Update by octocov [skip ci]
diff --git a/README.md b/README.md
@@ -5,7 +5,6 @@
 [![License](https://img.shields.io/github/license/sqlc-contrib/sqlc-gen-queries)](LICENSE)
 [![Go](https://img.shields.io/badge/Go-1.25-00ADD8?logo=go&logoColor=white)](https://go.dev)
 [![sqlc](https://img.shields.io/badge/sqlc-compatible-blue)](https://sqlc.dev)
-[![Coverage](https://raw.githubusercontent.com/sqlc-contrib/sqlc-gen-queries/main/.github/octocov/badge.svg)](https://github.com/sqlc-contrib/sqlc-gen-queries/actions/workflows/ci.yml)
 
 A CLI tool that generates [sqlc](https://sqlc.dev)-compatible SQL queries from your database schema catalog. Point it at a schema catalog and a configuration file, and it produces ready-to-use query files for sqlc.
 
diff --git a/flake.nix b/flake.nix
@@ -21,6 +21,10 @@
           src = pkgs.lib.cleanSource ./.;
           subPackages = [ "cmd/sqlc-gen-queries" ];
           vendorHash = "sha256-XyCIXLDH378M+MDyNj0OiBU7bilbF7DzEpA85fNOCGE=";
+          doInstallCheck = true;
+          installCheckPhase = ''
+            $out/bin/sqlc-gen-queries --help
+          '';
           meta = with pkgs.lib; {
             description = "SQLC Queries Generator";
             license = licenses.mit;
