bastion 0.55.3

.gitea/workflows/ci.yml

@@ -16,7 +16,7 @@ on:
     branches: [main]
 
 env:
-  GO_IMAGE: golang@sha256:1ae0735f00daffa3aaf1363a5184c0d2dc55c78e3db4ec70241cdac97bf84b59
+  GO_IMAGE: golang@sha256:27f2d3b83cfc5803c8078f8e730af0f7c431bf067afaec8f60a36fb763187cba
   # The pull request's own head, or the pushed commit.
   WANT: ${{ gitea.event.pull_request.head.sha || gitea.sha }}
 
@@ -58,7 +58,10 @@ jobs:
             echo "== gofmt"; out="$(gofmt -l .)"; [ -z "$out" ] || { echo "$out"; exit 1; }
             for os in linux darwin windows; do echo "== go vet ($os)"; GOOS=$os go vet ./...; done
             echo "== go build"; go build -o /tmp/privatae-bastion .
-            echo "== go test"; go test -count=1 ./...'
+            if [ -f lab.go ]; then echo "== go vet -tags lab"; go vet -tags lab ./...; fi
+            echo "== go test"; go test -count=1 ./...
+            echo "== staticcheck"; sh ../deploy/staticcheck.sh
+            echo "== the GitHub release step, against a fake API"; python3 -I ../deploy/test_github_release.py'
       - name: the same for deploy/release-sign
         run: |
           docker run --rm --cpus 6 -e GOMAXPROCS=6 -v "$PWD":/src -w /src/deploy/release-sign \
@@ -80,9 +83,14 @@ jobs:
           test "$(git rev-parse HEAD)" = "$WANT"
       - name: no person's data in the tree
         # Reads files, runs nothing from the tree. The term check needs the
-        # maintainers' key, which a CI job never holds, so here it is skipped and
-        # the run says so; the entity-id, provenance, email and phone checks run.
-        run: python3 scripts/test_no_personal_data.py
+        # maintainers' key and the entity-id check the reserved ids, which a CI
+        # job never holds, so the job names files that do not exist: both
+        # classes are skipped and the run prints a NOTE for each; the
+        # provenance, email and phone checks run. Left at their defaults, a
+        # path that exists but cannot be read fails the run instead.
+        run: |
+          none="$PWD/.ci-holds-none/none"
+          NO_PERSONAL_DATA_KEY_FILE="$none" RESERVED_ENTITY_IDS_FILE="$none" python3 scripts/test_no_personal_data.py
       - name: every test the claims table cites exists
         # docs/claims.md names, for each security claim, the test that fails
         # if the claim stops being true. A renamed or deleted test would leave