Run the latest-dependencies Go job weekly as well as on every PR

Merged
JE
6d ago
+112-66

Why

#997 added "Go Tests (latest dependencies)": the Go module with every dependency upgraded to its latest release, so an upstream release that breaks the SDK fails in CI before a consumer finds it. It only runs when something in this repository changes, though, and the thing it watches for lands upstream with no change here. A quiet week runs nothing. The operator's call on #997 was that it shouldn't be required, and that it should get a weekly run.

What

  • The job's steps move, unchanged, into .github/workflows/go-latest-deps.yml, which has three triggers:
    • workflow_call: test.yml calls it as go-latest-deps, so it still runs on every PR and every push to main.
    • schedule: Monday 08:00 UTC, after security.yml (06:00) and CodeQL (07:00).
    • workflow_dispatch: to re-run by hand, e.g. to confirm a fix for a scheduled failure.
  • Only this job runs weekly. The rest of test.yml stays as it is.
  • Scheduled failures show up the way this repository's other scheduled workflows (Live Canary, Scorecard, CodeQL, Security) report theirs: a failed run on the Actions tab and GitHub's notification for failed scheduled runs. None of those workflows opens issues or posts anywhere, so this one doesn't either. One addition: the upgrade step writes the module versions that moved into the job summary, so a red scheduled run shows which release to suspect.
  • Permissions: {} at the workflow level and contents: read on the job and on the caller. Actions are pinned to the same SHAs as test.yml.
  • The call uses the $/ self-repository form, the same as smithy-verify (#861). .github/actionlint.yaml's scoped ignore now names go-latest-deps as well as smithy-verify.
  • The dependabot client_golang ignore comment now points at the new file.

Check name

A job called through workflow_call reports as <caller job> / <callee job>, so the PR check is now go-latest-deps / Go Tests (latest dependencies). That follows smithy / Verify Smithy spec. It isn't in the main-gate ruleset's required checks and this PR doesn't touch them.

Verification

eval "$(mise hook-env)"
actionlint                     # 1.7.12: clean
zizmor --offline .github/workflows/go-latest-deps.yml .github/workflows/test.yml   # 1.30.0: no findings

The actionlint ignore matters. With go-latest-deps removed from its alternation, actionlint fails on test.yml:569 (reusable workflow call "$/.github/workflows/go-latest-deps.yml" ... is not following the format). With it there, the run is clean.

This PR's own CI runs the workflow_call path, i.e. the go-latest-deps / Go Tests (latest dependencies) check below. GitHub only offers schedule and workflow_dispatch for workflow files on the default branch, so those two paths can't run until this merges. After merging, run it once with:

gh workflow run go-latest-deps.yml --repo basecamp/basecamp-sdk --ref main
gh run list --repo basecamp/basecamp-sdk --workflow go-latest-deps.yml --limit 1

Summary by cubic

Runs the "Go Tests (latest dependencies)" job weekly on a schedule and on manual dispatch, in addition to every PR and push, so an upstream release that breaks the SDK turns CI red within days even when nothing changes in this repository.

The job's steps move unchanged from test.yml into .github/workflows/go-latest-deps.yml, which test.yml calls as before. Scheduled failures surface as a failed run on the Actions tab, and the upgrade step now writes the versions that moved into the job summary. The PR check name becomes go-latest-deps / Go Tests (latest dependencies); it stays unrequired.