Skip to content
CI

fix: return api error instead of decode failure for non-object error bodies #4478

Sign in to view logs

fix: return api error instead of decode failure for non-object error bodies

fix: return api error instead of decode failure for non-object error bodies #4478

Workflow file for this run

.github/workflows/ci.yml at 2bf06cc
name: CI
on:
push:
branches:
- '**'
- '!gh-readonly-queue/**'
- '!integrated/**'
- '!generated'
- '!codegen/**'
pull_request:
merge_group:
types:
- checks_requested
# The monthly Go version review opens its draft with GITHUB_TOKEN. GitHub
# requires approval before running pull_request workflows for that draft, so
# that workflow explicitly dispatches this validation on its generated branch.
workflow_dispatch:
# The vulnerability database changes even when this repository does not.
# This schedule runs only the govulncheck job below; lint and tests remain
# push-triggered. 10:23 UTC avoids GitHub's busy top-of-hour window.
schedule:
- cron: '23 10 * * *'
permissions:
contents: read
jobs:
lint:
timeout-minutes: 10
name: lint
runs-on: ubuntu-latest
# Run on the PR event even for same-repository branches. The stable
# aggregate check at the bottom cannot safely depend on a separate push
# workflow run, and every PR should receive the same merge-gating signal.
if: >-
github.event_name == 'push' ||
github.event_name == 'pull_request' ||
github.event_name == 'merge_group' ||
github.event_name == 'workflow_dispatch'
# Prevent Go's automatic toolchain selection from hiding an accidental
# increase above the minimum declared in go.mod.
env:
GOTOOLCHAIN: local
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
with:
persist-credentials: false
- name: Setup current stable Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
# The lint runner must be built by a Go release at least as new as
# every release it analyzes. Minimum-version coverage remains in the
# test matrix below.
go-version: '1.26.x'
check-latest: true
- name: Run lints
run: ./scripts/lint
- name: Check go.mod is tidy
run: ./scripts/check-go-mod
test:
timeout-minutes: 15
name: test (Go ${{ matrix.go-version }})
runs-on: ubuntu-latest
if: >-
github.event_name == 'push' ||
github.event_name == 'pull_request' ||
github.event_name == 'merge_group' ||
github.event_name == 'workflow_dispatch'
strategy:
fail-fast: false
matrix:
# Test the latest patch in the previous and current stable Go lines.
# Keep this matrix synchronized with GO_VERSION_POLICY.md. The monthly
# Codex review proposes both changes together when a Go release lands.
go-version:
- '1.25.x'
- '1.26.x'
# setup-go installs the selected matrix version first. "local" then stops
# the go command from silently switching to a newer toolchain.
env:
GOTOOLCHAIN: local
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
with:
persist-credentials: false
- name: Setup go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ matrix.go-version }}
# A version range can otherwise reuse an older matching toolcache
# entry immediately after a patched Go release becomes available.
check-latest: true
- name: Bootstrap
env:
SKIP_BREW: "1"
run: ./scripts/bootstrap
- name: Verify mock-server installation integrity
run: ./scripts/test-mock
- name: Test root module
run: ./scripts/test
- name: Test examples module
working-directory: examples
run: go test ./...
- name: Test external consumer
working-directory: internal/testdata/consumer
# This nested module catches accidental reliance on internal packages
# and proves representative core and Azure imports compose externally.
# readonly also prevents a disposable CI checkout from hiding stale
# module metadata by rewriting go.mod or go.sum during the test.
run: go test -mod=readonly ./...
vulnerability:
timeout-minutes: 15
name: govulncheck
runs-on: ubuntu-latest
# PR scans catch dependency/call-graph changes. The nightly scan catches
# newly published advisories against an otherwise unchanged commit.
if: >-
github.event_name == 'pull_request' ||
github.event_name == 'merge_group' ||
github.event_name == 'schedule' ||
github.event_name == 'workflow_dispatch'
env:
GOTOOLCHAIN: local
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
with:
persist-credentials: false
- name: Setup current stable Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
# Scan with a patched current toolchain so old standard-library
# findings do not obscure dependency findings. Resolve the range
# against Go's official feed: its vulnerability database can publish
# new advisories before setup-go's version mirror lists the fix.
go-version: '1.26.x'
check-latest: true
go-download-base-url: https://go.dev/dl
- name: Install govulncheck
# Keep the scanner in its own module so Dependabot can update it without
# adding development-tool dependencies to SDK users' module graph.
working-directory: tools
run: go install golang.org/x/vuln/cmd/govulncheck
- name: Scan root module
run: govulncheck ./...
- name: Scan examples module
working-directory: examples
run: govulncheck ./...
go_version_tests:
timeout-minutes: 5
name: test (all supported Go versions)
runs-on: ubuntu-latest
if: >-
always() &&
(github.event_name == 'pull_request' ||
github.event_name == 'merge_group' ||
github.event_name == 'workflow_dispatch')
needs:
- test
steps:
- name: Require every supported Go version
env:
TEST_RESULT: ${{ needs.test.result }}
run: |
if [[ "$TEST_RESULT" != "success" ]]; then
echo "Supported Go version tests ended with: $TEST_RESULT"
exit 1
fi