Fixes several CI workflow issues in ci.yml

.github/release.yml

@@ -0,0 +1,35 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking-change
+    - title: New Features
+      labels:
+        - enhancement
+        - feature
+    - title: Bug Fixes
+      labels:
+        - bug
+        - fix
+    - title: Security
+      labels:
+        - security
+    - title: Documentation
+      labels:
+        - documentation
+        - docs
+    - title: CI / Build
+      labels:
+        - cicd
+        - build
+        - chore
+    - title: Dependencies
+      labels:
+        - dependencies
+        - go-deps
+    - title: Other Changes
+      labels:
+        - "*"

.github/workflows/ci.yml

@@ -30,8 +30,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libpcsclite-dev
 
-      - name: Setup dev environment
-        run: make dev
+      - name: Check go.mod and go.sum are tidy
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
 
       - name: Check formatting
         run: |
@@ -68,9 +70,15 @@ jobs:
           sudo apt-get install -y libpcsclite-dev
 
       - name: Run tests
+        # Tests scoped to externalcas: the top-level package is a step-ca plugin entry
+        # point with no independently testable logic.
         run: |
-          make dev
-          go test -v -race ./...
+          go test -v -race -coverprofile=coverage.txt ./externalcas
+
+      - name: Upload coverage results to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
 
   security-scan:
     name: Security Scan
@@ -89,9 +97,6 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libpcsclite-dev
 
-      - name: Setup dev environment
-        run: make dev
-
       - name: Run gosec
         run: |
           go install github.com/securego/gosec/v2/cmd/gosec@latest
@@ -100,7 +105,7 @@ jobs:
       - name: Run govulncheck
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck -C ./externalcas ./...
+          govulncheck ./...
 
   build:
     name: Build (${{ matrix.os }}_${{ matrix.arch }})
@@ -133,6 +138,10 @@ jobs:
         env:
           GOOS: ${{ matrix.os }}
           GOARCH: ${{ matrix.goarch }}
+          # CGO is disabled for arm64 because the runner is x86 and cross-compiling
+          # with CGO requires a cross-compiler toolchain. The arm64 binary is therefore
+          # built without CGO. If a CGO dependency is ever added, the arm64 build will
+          # fail here and the matrix must be updated to use a native arm64 runner.
           CGO_ENABLED: ${{ matrix.arch == 'arm64' && '0' || '1' }}
           MATRIX_OS: ${{ matrix.os }}
           MATRIX_ARCH: ${{ matrix.arch }}
@@ -252,6 +261,7 @@ jobs:
           generate_release_notes: true
           files: |
             dist/step-ca_linux_*
+            dist/*.bundle
             dist/SHA256SUMS
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docs.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
     paths:
-      - 'docs/**'
+    - 'docs/**'
   workflow_dispatch:
 
 permissions:
@@ -22,32 +22,32 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          submodules: true # pulls in docs/themes/hugo-book
-          fetch-depth: 0 # required for enableGitInfo = true
+    - name: Checkout
+      uses: actions/checkout@v7
+      with:
+        submodules: true # pulls in docs/themes/hugo-book
+        fetch-depth: 0 # required for enableGitInfo = true
 
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v3.2.1
-        with:
-          hugo-version: 'latest'
-          extended: true # required for SCSS compilation in hugo-book theme
+    - name: Setup Hugo
+      uses: peaceiris/actions-hugo@v3.2.1
+      with:
+        hugo-version: '0.164.0'
+        extended: true # required for SCSS compilation in hugo-book theme
 
-      - name: Configure Pages
-        id: pages
-        uses: actions/configure-pages@v6
+    - name: Configure Pages
+      id: pages
+      uses: actions/configure-pages@v6
 
-      - name: Build
-        env:
-          BASE_URL: ${{ steps.pages.outputs.base_url }}
-        run: hugo --environment public --minify --baseURL "$BASE_URL/"
-        working-directory: docs
+    - name: Build
+      env:
+        BASE_URL: ${{ steps.pages.outputs.base_url }}
+      run: hugo --environment public --minify --baseURL "$BASE_URL/"
+      working-directory: docs
 
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
-        with:
-          path: docs/public
+    - name: Upload artifact
+      uses: actions/upload-pages-artifact@v5
+      with:
+        path: docs/public
 
   deploy:
     name: Deploy
@@ -60,6 +60,6 @@ jobs:
       pages: write
       id-token: write
     steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4
+    - name: Deploy to GitHub Pages
+      id: deployment
+      uses: actions/deploy-pages@v4

.gitignore

@@ -17,3 +17,6 @@ COMPARISON.md
 .python-version
 .ansible
 pyproject.toml
+.claude
+.zed
+dcv-dev.json

.pre-commit-config.yaml

@@ -1,24 +1,44 @@
 ---
 exclude: ^docs/
 repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.2.0
-    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: check-yaml
-      - id: check-added-large-files
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.2.0
+  hooks:
+  - id: trailing-whitespace
+  - id: end-of-file-fixer
+  - id: check-yaml
+  - id: check-added-large-files
+
+- repo: local
+  hooks:
+  - id: go-test
+    name: go test
+    entry: go test -race ./externalcas
+    language: system
+    pass_filenames: false
+    types: [go]
 
-  - repo: local
+-   repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
     hooks:
-      - id: go-test
-        name: go test
-        entry: go test -race ./externalcas
-        language: system
-        pass_filenames: false
-        types: [go]
+    - id: gitleaks
+
+- repo: local
+  hooks:
+  - id: govulncheck
+    name: govulncheck
+    entry: govulncheck
+    args: ["-C", "./externalcas", "./..."]
+    language: system
+    types: [go]
+    pass_filenames: false
 
-  -   repo: https://github.com/gitleaks/gitleaks
-      rev: v8.30.1
-      hooks:
-        - id: gitleaks
+- repo: local
+  hooks:
+  - id: staticcheck
+    name: staticcheck
+    entry: staticcheck
+    args: ["./externalcas"]
+    language: system
+    types: [go]
+    pass_filenames: false

Makefile

@@ -10,17 +10,20 @@ BUILD_TIME  ?= $(shell date -u '+%Y-%m-%d %H:%M UTC')
 
 default: build
 
+test:
+	go test -race ./externalcas
+
 clean:
-	@echo "🧹 Cleaning build cache..."
+	@echo "Cleaning build cache..."
 	go clean -cache
 	rm -f step-ca
 	rm -rf db
 
 check-deps:
-	@echo "🔍 Checking for libpcsclite-dev dependency..."
+	@echo "Checking for libpcsclite-dev dependency..."
 	@OS_NAME=$$(uname -s); \
 	if [ "$$OS_NAME" = "Darwin" ]; then \
-		echo "🍏 macOS - Skipping dependency check"; \
+		echo "🍎 MacOS - Skipping dependency check"; \
 	elif [ -f /etc/os-release ]; then \
 		. /etc/os-release; \
 		if echo "$$ID" | grep -Eqi 'ubuntu|debian'; then \
@@ -42,13 +45,13 @@ check-deps:
 	fi
 
 dev: clean check-deps
-	@echo "⬇️ Downloading dependencies to create dev environment..."
+	@echo "Setting up dependencies for development..."
 	mkdir db
 	go mod tidy
-	@echo "✅ Ready"
+	@echo "✔ OK"
 
 build: clean check-deps
-	@echo "⚙️ Building ACME proxy with Step CA..."
+	@echo "Building acme-proxy with step-ca..."
 	mkdir db
 	go build -ldflags="-s -w -X main.Version=$(VERSION) -X 'main.BuildTime=$(BUILD_TIME)'" -v -o $(APP_NAME) .
-	@echo "✅ Done"
+	@echo "✔ OK"