sneak
b4d013cb34
Multistage build per policy: a fail-fast lint stage on the pinned golangci-lint image runs fmt-check and lint, the builder stage reuses its linter binary (which also forces stage ordering), runs make check, and builds; the runtime stage is pinned alpine with just the binary. CI runs docker build . on push with the checkout action pinned by commit SHA. All image references pinned by sha256 digest with version/date comments.
10 lines
248 B
YAML
10 lines
248 B
YAML
name: check
|
|
on: [push]
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# actions/checkout v4.2.2, 2026-02-22
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
|
- run: docker build .
|