GitHub Actions CI/CD Complete Guide: Go Builds, Branch Strategies, and Auto-Deploy

# .github/workflows/ci.yml
name: CI Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

concurrency:
  group: ci-BRANCH_REF
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Run tests
        run: echo "Running tests..."

on:
  push:
    branches:
      - main
      - 'release/**'
    paths:
      - 'src/**'
      - 'go.mod'
      - 'go.sum'
    paths-ignore:
      - '**.md'
      - 'docs/**'

on:
  schedule:
    # Run at 2:00 AM UTC on weekdays
    - cron: '0 2 * * 1-5'

concurrency:
  group: deploy-production
  cancel-in-progress: false  # Don't cancel in-progress deploys

# For PR builds, cancel previous runs on the same PR
concurrency:
  group: pr-build-PR_NUMBER
  cancel-in-progress: true

# 1. Checkout code
- uses: actions/checkout@v4

# 2. Setup Go
- uses: actions/setup-go@v5
  with:
    go-version: '1.22'
    cache: true

# 3. Cache dependencies
- uses: actions/cache@v4
  with:
    path: ~/go/pkg/mod
    key: go-mod-HASH_OF_GO_SUM

# 4. Upload artifact
- uses: actions/upload-artifact@v4
  with:
    name: binary
    path: ./bin/

# 5. Download artifact
- uses: actions/download-artifact@v4

# 6. Docker build and push
- uses: docker/build-push-action@v6
  with:
    push: true
    tags: myapp:latest

# 7. Login to container registry
- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: GITHUB_ACTOR
    password: GITHUB_TOKEN_SECRET

# 8. Setup Docker Buildx
- uses: docker/setup-buildx-action@v3

# 9. GitHub release
- uses: softprops/action-gh-release@v2

# 10. Slack notification
- uses: slackapi/slack-github-action@v2

# 11. Setup Node.js
- uses: actions/setup-node@v4

# 12. Setup Python
- uses: actions/setup-python@v5

# 13. golangci-lint
- uses: golangci/golangci-lint-action@v6

# 14. CodeQL analysis
- uses: github/codeql-action/analyze@v3

# 15. Deploy to K8s
- uses: azure/k8s-deploy@v5

# 16. AWS credentials
- uses: aws-actions/configure-aws-credentials@v4

# 17. GCP auth
- uses: google-github-actions/auth@v2

# 18. Terraform
- uses: hashicorp/setup-terraform@v3

# 19. Create PR comment
- uses: peter-evans/create-or-update-comment@v4

# 20. Label PR
- uses: actions/labeler@v5

jobs:
  deploy:
    environment: production
    steps:
      - name: Deploy
        env:
          API_KEY: SECRETS_API_KEY_REF
          DB_PASSWORD: SECRETS_DB_PASSWORD_REF
        run: ./deploy.sh

jobs:
  deploy-aws:
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions
          aws-region: us-east-1

jobs:
  deploy-staging:
    environment: staging
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh staging

  deploy-production:
    needs: deploy-staging
    environment:
      name: production
      url: https://myapp.example.com
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh production

# Production build with all optimizations
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
  go build \
  -ldflags="-s -w -X main.version=1.2.3 -X main.commit=abc123 -X main.buildTime=2026-03-23T10:00:00Z" \
  -trimpath \
  -o ./bin/myapp \
  ./cmd/server/

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [linux, darwin, windows]
        goarch: [amd64, arm64]
        exclude:
          - goos: windows
            goarch: arm64
      fail-fast: false

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Build
        env:
          GOOS: matrix-goos-value
          GOARCH: matrix-goarch-value
        run: |
          BINARY_NAME="myapp-matrix-goos-value-matrix-goarch-value"
          if [ "matrix-goos-value" = "windows" ]; then
            BINARY_NAME="myapp-matrix-goos-value-matrix-goarch-value.exe"
          fi
          go build -ldflags="-s -w" -trimpath -o "./dist/BINARY_NAME_VAR" ./cmd/server/

      - uses: actions/upload-artifact@v4
        with:
          name: binary-matrix-goos-value-matrix-goarch-value
          path: ./dist/

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: testdb
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Unit tests with coverage
        run: |
          go test -v -race -coverprofile=coverage.out -covermode=atomic ./...
          go tool cover -func=coverage.out

      - name: Integration tests
        env:
          DATABASE_URL: postgres://test:test@localhost:5432/testdb?sslmode=disable
        run: |
          go test -v -tags=integration -count=1 ./tests/integration/...

      - name: Benchmark tests
        run: |
          go test -bench=. -benchmem -run=^$ ./... | tee benchmark.txt

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          files: ./coverage.out
          token: CODECOV_TOKEN_REF

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: v1.57
          args: --timeout=5m

      - name: go vet
        run: go vet ./...

      - name: staticcheck
        uses: dominikh/staticcheck-action@v1
        with:
          version: '2024.1'

      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

run:
  timeout: 5m
  go: '1.22'

linters:
  enable:
    - errcheck
    - gosimple
    - govet
    - ineffassign
    - staticcheck
    - unused
    - bodyclose
    - gocritic
    - gofumpt
    - gosec
    - misspell
    - prealloc
    - revive
    - unconvert

linters-settings:
  gocritic:
    enabled-checks:
      - nestingReduce
      - truncateCmp
      - unnamedResult
  gosec:
    excludes:
      - G104 # Unhandled errors
  revive:
    rules:
      - name: unexported-return
        disabled: true

issues:
  exclude-rules:
    - path: _test\.go
      linters:
        - gosec
        - errcheck

steps:
  - uses: actions/setup-go@v5
    with:
      go-version: '1.22'
      cache: true # Built-in module cache

  # Additional build cache for faster compilation
  - uses: actions/cache@v4
    with:
      path: |
        ~/.cache/go-build
        ~/go/pkg/mod
      key: go-build-OS-HASH_OF_GO_SUM
      restore-keys: |
        go-build-OS-

# Stage 1: Build
FROM golang:1.22-alpine AS builder

RUN apk add --no-cache git ca-certificates tzdata

WORKDIR /app

# Cache dependencies
COPY go.mod go.sum ./
RUN go mod download && go mod verify

# Build
COPY . .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build \
    -ldflags="-s -w -X main.version=VERSION_ARG -X main.commit=COMMIT_ARG" \
    -trimpath \
    -o /app/server \
    ./cmd/server/

# Stage 2: Runtime
FROM scratch

COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=builder /app/server /server

EXPOSE 8080

ENTRYPOINT ["/server"]

jobs:
  docker:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: GITHUB_ACTOR_REF
          password: GITHUB_TOKEN_REF

      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/OWNER/myapp
          tags: |
            type=sha
            type=ref,event=branch
            type=semver,pattern=v{{version}}
            type=semver,pattern=v{{major}}.{{minor}}

      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: steps-meta-outputs-tags
          labels: steps-meta-outputs-labels
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=v1.2.3
            COMMIT=GITHUB_SHA_REF

# .goreleaser.yml
version: 2

before:
  hooks:
    - go mod tidy
    - go generate ./...

builds:
  - id: server
    main: ./cmd/server/
    binary: myapp
    env:
      - CGO_ENABLED=0
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    ldflags:
      - -s -w
      - -X main.version={{.Version}}
      - -X main.commit={{.Commit}}
      - -X main.date={{.Date}}

archives:
  - format: tar.gz
    name_template: 'myapp_{{.Version}}_{{.Os}}_{{.Arch}}'
    format_overrides:
      - goos: windows
        format: zip

dockers:
  - image_templates:
      - 'ghcr.io/OWNER/myapp:{{.Version}}'
      - 'ghcr.io/OWNER/myapp:latest'
    dockerfile: Dockerfile.goreleaser
    build_flag_templates:
      - '--label=org.opencontainers.image.version={{.Version}}'

changelog:
  sort: asc
  filters:
    exclude:
      - '^docs:'
      - '^test:'
      - '^ci:'

release:
  github:
    owner: myorg
    name: myapp

name: Release
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  packages: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - uses: goreleaser/goreleaser-action@v6
        with:
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: GITHUB_TOKEN_SECRET_REF

# Branch protection via GitHub API / Settings

# Main branch protection
branches:
  main:
    protection:
      required_status_checks:
        strict: true
        contexts:
          - 'ci/lint'
          - 'ci/test'
          - 'ci/build'
      required_pull_request_reviews:
        required_approving_review_count: 2
        dismiss_stale_reviews: true
        require_code_owner_reviews: true
      restrictions:
        users: []
        teams: ['core-maintainers']
      enforce_admins: true
      required_linear_history: true
      allow_force_pushes: false
      allow_deletions: false

# .github/CODEOWNERS

# Default owners for everything
* @myorg/backend-team

# Go source code
/cmd/ @myorg/go-team
/internal/ @myorg/go-team
/pkg/ @myorg/go-team

# Infrastructure
/.github/ @myorg/devops-team
/deploy/ @myorg/devops-team
/terraform/ @myorg/devops-team
Dockerfile @myorg/devops-team

# Documentation
/docs/ @myorg/docs-team
*.md @myorg/docs-team

# API definitions
/api/ @myorg/api-team @myorg/backend-team

Ruleset configuration example:
  Name: production-protection
  Target: branches matching "main" and "release/**"
  Rules:
    - Require pull request before merge (2 approvals)
    - Require status checks: lint, test, build
    - Require signed commits
    - Block force pushes
    - Require linear history
  Bypass: Repository admins during emergencies

myapp/
  cmd/
    server/
      main.go
  internal/
    handler/
    service/
    repository/
  pkg/
    middleware/
  api/
    openapi.yaml
  deploy/
    k8s/
      deployment.yaml
      service.yaml
      ingress.yaml
    docker/
      Dockerfile
  .github/
    workflows/
      ci.yml
      deploy.yml
      release.yml
    CODEOWNERS
  .golangci.yml
  .goreleaser.yml
  go.mod
  go.sum
  Makefile

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'docs/**'
  pull_request:
    branches: [main]

concurrency:
  group: ci-REF_NAME
  cancel-in-progress: true

env:
  GO_VERSION: '1.22'
  GOLANGCI_LINT_VERSION: v1.57
  REGISTRY: ghcr.io
  IMAGE_NAME: myorg/myapp

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: GO_VERSION_ENV

      - uses: golangci/golangci-lint-action@v6
        with:
          version: GOLANGCI_LINT_VERSION_ENV

      - name: Check formatting
        run: |
          if [ -n "$(gofmt -l .)" ]; then
            echo "Files not formatted:"
            gofmt -l .
            exit 1
          fi

      - name: Verify dependencies
        run: |
          go mod verify
          go mod tidy
          git diff --exit-code go.mod go.sum

  test:
    name: Test
    runs-on: ubuntu-latest
    needs: lint
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: testdb
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: GO_VERSION_ENV

      - name: Unit tests
        run: |
          go test -v -race -count=1 \
            -coverprofile=coverage.out \
            -covermode=atomic \
            ./...

      - name: Integration tests
        env:
          DATABASE_URL: postgres://test:test@localhost:5432/testdb?sslmode=disable
          REDIS_URL: redis://localhost:6379
        run: |
          go test -v -tags=integration -count=1 ./tests/integration/...

      - name: Coverage report
        run: |
          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}')
          echo "Total coverage: COVERAGE_VAR"
          # Fail if coverage drops below threshold
          COVERAGE_NUM=$(echo "COVERAGE_VAR" | tr -d '%')
          if (( $(echo "COVERAGE_NUM_VAR < 70" | bc -l) )); then
            echo "Coverage below 70% threshold"
            exit 1
          fi

      - uses: codecov/codecov-action@v4
        with:
          files: ./coverage.out

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: GO_VERSION_ENV

      - name: Vulnerability check
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      - name: License check
        run: |
          go install github.com/google/go-licenses@latest
          go-licenses check ./...

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [test, security]
    outputs:
      image-tag: steps-meta-outputs-version
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: GITHUB_ACTOR_REF
          password: GITHUB_TOKEN_REF

      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: REGISTRY_ENV/IMAGE_NAME_ENV
          tags: |
            type=sha,prefix=
            type=ref,event=branch
            type=ref,event=pr

      - uses: docker/build-push-action@v6
        with:
          context: .
          file: ./deploy/docker/Dockerfile
          push: PUSH_CONDITION
          tags: steps-meta-outputs-tags
          labels: steps-meta-outputs-labels
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=GITHUB_SHA_SHORT
            COMMIT=GITHUB_SHA_REF

# .github/workflows/deploy.yml
name: Deploy

on:
  workflow_run:
    workflows: ['CI']
    branches: [main]
    types: [completed]

concurrency:
  group: deploy-ENVIRONMENT
  cancel-in-progress: false

jobs:
  deploy-staging:
    if: github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.myapp.example.com
    steps:
      - uses: actions/checkout@v4

      - name: Configure kubectl
        uses: azure/setup-kubectl@v4

      - name: Set K8s context
        uses: azure/k8s-set-context@v4
        with:
          method: kubeconfig
          kubeconfig: SECRETS_KUBECONFIG_STAGING_REF

      - name: Deploy to staging
        run: |
          kubectl set image deployment/myapp \
            myapp=ghcr.io/myorg/myapp:COMMIT_SHA \
            -n staging
          kubectl rollout status deployment/myapp -n staging --timeout=300s

      - name: Run smoke tests
        run: |
          sleep 10
          curl -sf https://staging.myapp.example.com/healthz || exit 1

  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://myapp.example.com
    steps:
      - uses: actions/checkout@v4

      - name: Configure kubectl
        uses: azure/setup-kubectl@v4

      - name: Set K8s context
        uses: azure/k8s-set-context@v4
        with:
          method: kubeconfig
          kubeconfig: SECRETS_KUBECONFIG_PRODUCTION_REF

      - name: Deploy to production
        run: |
          kubectl set image deployment/myapp \
            myapp=ghcr.io/myorg/myapp:COMMIT_SHA \
            -n production
          kubectl rollout status deployment/myapp -n production --timeout=300s

      - name: Verify deployment
        run: |
          curl -sf https://myapp.example.com/healthz || exit 1

      - name: Notify on failure
        if: failure()
        uses: slackapi/slack-github-action@v2
        with:
          webhook: SECRETS_SLACK_WEBHOOK_REF
          webhook-type: incoming-webhook
          payload: |
            {
              "text": "Production deployment FAILED for commit COMMIT_SHA_SHORT"
            }

# deploy/k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: ghcr.io/myorg/myapp:latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          env:
            - name: LOG_LEVEL
              value: 'info'
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: myapp-secrets
                  key: database-url

# deploy/k8s/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  type: ClusterIP
  selector:
    app: myapp
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP

# .github/workflows/reusable-go-ci.yml
name: Reusable Go CI

on:
  workflow_call:
    inputs:
      go-version:
        description: 'Go version to use'
        required: false
        type: string
        default: '1.22'
      coverage-threshold:
        description: 'Minimum coverage percentage'
        required: false
        type: number
        default: 70
    secrets:
      CODECOV_TOKEN:
        required: false

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: inputs-go-version
      - run: go test -race -coverprofile=coverage.out ./...
      - run: go vet ./...

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]

jobs:
  go-ci:
    uses: myorg/.github/.github/workflows/reusable-go-ci.yml@main
    with:
      go-version: '1.22'
      coverage-threshold: 80
    secrets:
      CODECOV_TOKEN: SECRETS_CODECOV_TOKEN_REF

on:
  push:
    paths:
      - 'services/api/**'
      - 'shared/pkg/**'
      - 'go.mod'
      - 'go.sum'
    paths-ignore:
      - '**.md'
      - 'docs/**'

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      api: steps-filter-outputs-api
      web: steps-filter-outputs-web
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            api:
              - 'services/api/**'
              - 'shared/**'
            web:
              - 'services/web/**'
              - 'shared/**'

  build-api:
    needs: changes
    if: needs.changes.outputs.api == 'true'
    runs-on: ubuntu-latest
    steps:
      - run: echo "Building API service"

  build-web:
    needs: changes
    if: needs.changes.outputs.web == 'true'
    runs-on: ubuntu-latest
    steps:
      - run: echo "Building Web service"

# .github/workflows/rollback.yml
name: Rollback

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        type: choice
        options:
          - staging
          - production
      revision:
        description: 'Revision to rollback to (leave empty for previous)'
        required: false
        type: string

jobs:
  rollback:
    runs-on: ubuntu-latest
    environment: inputs-environment
    steps:
      - name: Configure kubectl
        uses: azure/setup-kubectl@v4

      - name: Rollback deployment
        run: |
          if [ -z "REVISION_INPUT" ]; then
            kubectl rollout undo deployment/myapp -n TARGET_ENV
          else
            kubectl rollout undo deployment/myapp \
              --to-revision=REVISION_INPUT -n TARGET_ENV
          fi
          kubectl rollout status deployment/myapp -n TARGET_ENV --timeout=300s

      - name: Verify rollback
        run: |
          curl -sf https://TARGET_ENV.myapp.example.com/healthz || exit 1

      - name: Notify
        uses: slackapi/slack-github-action@v2
        with:
          webhook: SECRETS_SLACK_WEBHOOK_REF
          webhook-type: incoming-webhook
          payload: |
            {
              "text": "Rollback completed for TARGET_ENV environment"
            }

- uses: actions/cache@v4
  with:
    path: ~/.cache/go-build
    key: go-build-OS-HASH_OF_ALL_GO_FILES
    restore-keys: |
      go-build-OS-

- uses: docker/build-push-action@v6
  with:
    cache-from: type=gha
    cache-to: type=gha,mode=max

  lint ------+
             |
  test ------+--> build --> deploy-staging --> deploy-production
             |
  security --+

jobs:
  lint:
    runs-on: ubuntu-latest
    # No dependencies, runs immediately

  test:
    runs-on: ubuntu-latest
    # No dependencies, runs in parallel with lint

  security:
    runs-on: ubuntu-latest
    # No dependencies, runs in parallel with lint and test

  build:
    needs: [lint, test, security]
    # Waits for all three to complete

  deploy-staging:
    needs: build

  deploy-production:
    needs: deploy-staging

jobs:
  build:
    runs-on: [self-hosted, linux, x64, gpu]
    steps:
      - uses: actions/checkout@v4
      - run: nvidia-smi # GPU access on self-hosted

# docker-compose.yml for self-hosted runner
version: '3.8'
services:
  runner:
    image: myoung34/github-runner:latest
    environment:
      REPO_URL: https://github.com/myorg/myrepo
      RUNNER_TOKEN: your-registration-token
      RUNNER_NAME: custom-runner-1
      RUNNER_WORKDIR: /tmp/github-runner
      LABELS: self-hosted,linux,x64
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

# Add timing to key steps
- name: Build with timing
  run: |
    START_TIME=$(date +%s)
    go build -o ./bin/myapp ./cmd/server/
    END_TIME=$(date +%s)
    DURATION=$((END_TIME - START_TIME))
    echo "Build took DURATION_VAR seconds"
    echo "build_duration=DURATION_VAR" >> GITHUB_OUTPUT_FILE

# Install act
brew install act

# Run default event (push)
act

# Run specific workflow
act -W .github/workflows/ci.yml

# Run specific job
act -j test

# Use specific event
act pull_request

# Pass secrets
act -s GITHUB_TOKEN=your-token

# Use larger runner image
act -P ubuntu-latest=catthehacker/ubuntu:full-latest