wow-look-at-my/Go Safe Build
Build Go projects with coverage enforcement - fails if coverage is below threshold
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| json | Output coverage report as JSON | no | false |
| generate | Run go:generate directives matching this hash | no | "" |
| working-directory | Working directory for the build | no | . |
| binary | Path to a pre-built go-toolchain binary (skips release download) | no | "" |
| os | Comma-separated list of target operating systems (e.g. linux,darwin,windows) | no | linux,darwin,windows |
| arch | Comma-separated list of target architectures (e.g. amd64,arm64) | no | amd64,arm64 |
| targets | Comma-separated exact build targets, each an os/arch pair (e.g. darwin/amd64) or the special value "cosmo" (one fat APE built with the gosmopolitan toolchain, plus per-platform slot copies). When non-empty this replaces the os/arch inputs. | no | "" |
| cgo | Enable CGO (disabled by default for static binaries) | no | false |
| autorelease | Automatically publish to buildhost on every branch push (requires id-token: write permission; with deployments: write it also registers a GitHub Deployment, skipped with a warning otherwise) | no | true |
| autorelease_args | Extra publish options forwarded to the buildhost publish, as whitespace- or comma-separated key=value pairs (e.g. "create_service=true"). Recognized keys: create_service (true|false -- declare that the published binary runs as a background service; each download format materializes it, e.g. brew formulas gain a `service do` block and generated debs ship an auto-enabled systemd user unit). Unknown keys fail the build. Empty (the default) forwards nothing -- the publish request is byte-identical to before this input existed. | no | "" |
| allow-source-build | Allow building go-toolchain from source when the buildhost binary is unavailable. When false (default), the build fails fast instead of silently falling back to a source build. | no | false |
| timeout | Timeout in minutes for the go-toolchain build step | no | 10 |
| wait-ci | Wait for the latest go-toolchain CI run to finish before downloading the release binary | no | false |
| codeql | Run CodeQL security-and-quality analysis around the build (requires security-events: write permission, and the consumer repo must NOT have GitHub default CodeQL setup enabled) | no | false |
Outputs
no outputs