.github/workflows/ here holds codeql.yml and release.yml, and nothing else. Nothing builds, vets, or runs the tests on push or pull request.
That leaves a real exposure, and it is the one ditto's own CI workflow describes in its header: CodeQL is static analysis and never compiles a test, and the release workflow's only pre-build hook is go mod tidy. The test suite therefore runs only on a laptop. A commit that broke a test can be tagged, released, and promoted to apt behind a green checkmark, and Dependabot's dependency bumps merge without anything having exercised the code against the new versions.
The fix already exists
ditto and xfiles both carry .github/workflows/ci.yml — checks gofmt, runs go vet ./..., runs go test ./..., on every push and PR against main. Copying that file into this repo is the whole change. It pins nothing repo-specific; it takes go-version: stable.
The drift is already measurable
gofmt -l . in this repo currently reports:
Formatting is only the visible symptom — the untested-commit exposure is the reason to care — but it maps exactly onto which repos have the workflow. ditto and xfiles, the two with ci.yml, report zero unformatted files. The four without it have all drifted: xql (8), xensus (5), blick-cli (2), nved (1).
Adding the workflow will fail its first run until the listed files are formatted, so gofmt -w . belongs in the same change.
.github/workflows/here holdscodeql.ymlandrelease.yml, and nothing else. Nothing builds, vets, or runs the tests on push or pull request.That leaves a real exposure, and it is the one ditto's own CI workflow describes in its header: CodeQL is static analysis and never compiles a test, and the release workflow's only pre-build hook is
go mod tidy. The test suite therefore runs only on a laptop. A commit that broke a test can be tagged, released, and promoted to apt behind a green checkmark, and Dependabot's dependency bumps merge without anything having exercised the code against the new versions.The fix already exists
dittoandxfilesboth carry.github/workflows/ci.yml— checksgofmt, runsgo vet ./..., runsgo test ./..., on every push and PR againstmain. Copying that file into this repo is the whole change. It pins nothing repo-specific; it takesgo-version: stable.The drift is already measurable
gofmt -l .in this repo currently reports:Formatting is only the visible symptom — the untested-commit exposure is the reason to care — but it maps exactly onto which repos have the workflow.
dittoandxfiles, the two withci.yml, report zero unformatted files. The four without it have all drifted: xql (8), xensus (5), blick-cli (2), nved (1).Adding the workflow will fail its first run until the listed files are formatted, so
gofmt -w .belongs in the same change.