snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

.github/workflows/ci.yaml

@@ -0,0 +1,242 @@
+name: CI
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - "*"
+  pull_request:
+  merge_group:
+
+# Cancel in-progress runs in current workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Run lints and checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ory/ci/checkout@master
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - name: Update npm to a non-buggy version
+        run: sudo npm i -g npm@9.5.0
+      - name: Lint buf
+        run: make buf-lint
+      - run: go list -json > go.list
+      - name: Run nancy
+        uses: sonatype-nexus-community/nancy-github-action@395e2fb168f674f96502e5652103d112899ea369
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run golangci-lint
+        if: ${{ github.ref_type != 'tag' }}
+        uses: golangci/golangci-lint-action@v9
+        env:
+          GOGC: 100
+        with:
+          version: latest
+          args: --timeout 10m0s
+          only-new-issues: "true"
+      - name: Test documentation examples
+        run: make test-docs-samples
+      - name: Test OPL typelib
+        run: cd contrib/namespace-type-lib && npm ci && npm test
+
+  test:
+    name: Run tests
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_DB: keto
+          POSTGRES_PASSWORD: test
+          POSTGRES_USER: test
+        ports:
+          - 5432:5432
+      mysql:
+        image: mysql:9.6
+        env:
+          MYSQL_ROOT_PASSWORD: test
+        ports:
+          - 3306:3306
+    env:
+      TEST_DATABASE_POSTGRESQL: postgres://test:test@localhost:5432/keto?sslmode=disable
+      TEST_DATABASE_MYSQL: mysql://root:test@(localhost:3306)/mysql?parseTime=true&multiStatements=true
+      TEST_DATABASE_COCKROACHDB: cockroach://root@localhost:26257/defaultdb?sslmode=disable
+    steps:
+      - run: |
+          docker create --name cockroach -p 26257:26257 \
+            cockroachdb/cockroach:latest-v25.4 start-single-node --insecure
+          docker start cockroach
+        name: Start CockroachDB
+      - uses: ory/ci/checkout@master
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - name: Test gen/go package
+        run: go -C gen/go test ./...
+      - name: Test Keto
+        run: |
+          go test -coverprofile coverage.txt  ./...
+          grep -v "ory/keto/internal/httpclient" coverage.txt > coverage_cleared.txt
+          mv coverage_cleared.txt coverage.txt
+      - run: |
+          go tool goveralls -service=github -coverprofile=coverage.txt
+        env:
+          COVERALLS_TOKEN: ${{ github.token }}
+
+  test-race:
+    name: Run race tests
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: "1"
+    steps:
+      - uses: ory/ci/checkout@master
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - run: |
+          go test -race -short ./...
+
+  docs-cli:
+    runs-on: ubuntu-latest
+    name: Build CLI docs
+    needs:
+      - test
+      - test-race
+      - validate
+    steps:
+      - uses: ory/ci/docs/cli-next@master
+        with:
+          token: ${{ secrets.ORY_BOT_PAT }}
+          output-dir: docs/keto/cli
+
+  release:
+    name: Generate release
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    needs:
+      - test
+      - test-race
+      - validate
+    steps:
+      - uses: ory/ci/releaser@master
+        with:
+          token: ${{ secrets.ORY_BOT_PAT }}
+          goreleaser_key: ${{ secrets.GORELEASER_KEY }}
+          cosign_pwd: ${{ secrets.COSIGN_PWD }}
+          docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+  newsletter-draft:
+    name: Draft newsletter
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    needs:
+      - release
+    steps:
+      - uses: ory/ci/newsletter@master
+        with:
+          mailchimp_list_id: f605a41b53
+          mailchmip_segment_id: 6479489
+          mailchimp_api_key: ${{ secrets.MAILCHIMP_API_KEY }}
+          draft: "true"
+          ssh_key: ${{ secrets.ORY_BOT_SSH_KEY }}
+
+  slack-approval-notification:
+    name: Pending approval Slack notification
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    needs:
+      - newsletter-draft
+    steps:
+      - uses: ory/ci/newsletter/slack-notify@master
+        with:
+          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+
+  newsletter-send:
+    name: Send newsletter
+    runs-on: ubuntu-latest
+    needs:
+      - newsletter-draft
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    environment: production
+    steps:
+      - uses: ory/ci/newsletter@master
+        with:
+          mailchimp_list_id: f605a41b53
+          mailchmip_segment_id: 6479489
+          mailchimp_api_key: ${{ secrets.MAILCHIMP_API_KEY }}
+          draft: "false"
+          ssh_key: ${{ secrets.ORY_BOT_SSH_KEY }}
+
+  buf:
+    name: Run buf actions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ory/ci/checkout@master
+        with:
+          path: current-repo
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: current-repo/go.mod
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+      - name: Lint and Build
+        run: |
+          make buf
+        working-directory: current-repo
+      - name: Format Docs (required because buf generates the proto docs)
+        run: |
+          make format
+        working-directory: current-repo
+      - name: Push build
+        run: |
+          git config --local user.email "60093411+ory-bot@users.noreply.github.com"
+          git config --local user.name "ory-bot"
+          git add gen
+          git commit -a -m "autogen: build buf" && git push "https://${GITHUB_ACTOR}:${{ secrets.ORY_BOT_PAT }}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF#"refs/heads/"}" || true
+        working-directory: current-repo
+      - if: ${{ github.ref_name == 'master' || github.ref_type == 'tag' }}
+        uses: ory/ci/checkout@master
+        with:
+          repository: ory/docs
+          path: docs
+          fetch-depth: 0
+          token: ${{ secrets.ORY_BOT_PAT }}
+      - if: ${{ github.ref_name == 'master' || github.ref_type == 'tag' }}
+        name: Push generated files to ory/docs
+        env:
+          GITHUB_TOKEN: ${{ secrets.ORY_BOT_PAT }}
+        run: |
+          echo "---
+          title: Protocol buffers API
+          ---
+
+          <!-- This file is generated. Please edit the .proto files instead to update the documentation -->" > "docs/docs/keto/reference/proto-api.mdx"
+          cat "current-repo/gen/doc/buf.md" >> "docs/docs/keto/reference/proto-api.mdx"
+          cd docs
+          if git diff --exit-code; then
+            echo "No changes to commit"
+            exit 0
+          fi
+
+          git config --local user.email "60093411+ory-bot@users.noreply.github.com"
+          git config --local user.name "ory-bot"
+
+          git stash
+          git pull --rebase origin master
+          git stash apply
+          git add docs/keto/reference/proto-api.mdx
+          git commit -m "autogen: update Keto protobuf docs"
+          git push origin HEAD:master
+        shell: bash