.github/workflows/ci.yml

name: ci
on:
  push:
    branches:
      - main
  pull_request:
  merge_group:
env:
  # Default version of Go to use by CI workflows. This should be the latest
  # release of Go; developers likely use the latest release in development and
  # we want to catch any bugs (e.g. lint errors, race detection) with this
  # release before they are merged. The Go compatibility guarantees ensure
  # backwards compatibility with the previous two minor releases and we
  # explicitly test our code for these versions so keeping this at prior
  # versions does not add value.
  DEFAULT_GO_VERSION: "~1.27.0"
# Declare default permissions as read only.
permissions:
  contents: read
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 ## Needed for "Set internal/tools/go.mod timestamp" step.
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.DEFAULT_GO_VERSION }}
          check-latest: true
          cache-dependency-path: "**/go.sum"
      - name: Tools cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        env:
          cache-name: go-tools-cache
        with:
          path: .tools
          key: ${{ runner.os }}-${{ env.DEFAULT_GO_VERSION }}-${{ env.cache-name }}-${{ hashFiles('./internal/tools/**') }}
      # The step below is needed to not rebuild all the build tools.
      - name: Set internal/tools timestamps
        run: |
          git ls-files \
            internal/tools/go.mod \
            internal/tools/semconvkit \
            internal/tools/verifyreadmes \
          | while IFS= read -r filename; do
              unixtime=$(git log -1 --format="%at" -- "${filename}")
              touchtime=$(date -d @"${unixtime}" +'%Y%m%d%H%M.%S')
              touch -t "${touchtime}" "${filename}"
              ls -la --time-style=full-iso "${filename}"
            done
      - name: Generate
        run: make generate
      - name: Run linters
        run: make toolchain-check license-check lint verify-readmes verify-mods
      - name: Build
        run: make build
      - name: Check clean repository
        run: make check-clean-work-tree

  govulncheck:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 ## Needed for "Set internal/tools/go.mod timestamp" step.
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.DEFAULT_GO_VERSION }}
          check-latest: true
          cache-dependency-path: "**/go.sum"
      - name: Tools cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        env:
          cache-name: go-tools-cache
        with:
          path: .tools
          key: ${{ runner.os }}-${{ env.DEFAULT_GO_VERSION }}-${{ env.cache-name }}-${{ hashFiles('./internal/tools/**') }}
      # The step below is needed to not rebuild all the build tools.
      - name: Set internal/tools timestamps
        run: |
          git ls-files \
            internal/tools/go.mod \
            internal/tools/semconvkit \
            internal/tools/verifyreadmes \
          | while IFS= read -r filename; do
              unixtime=$(git log -1 --format="%at" -- "${filename}")
              touchtime=$(date -d @"${unixtime}" +'%Y%m%d%H%M.%S')
              touch -t "${touchtime}" "${filename}"
              ls -la --time-style=full-iso "${filename}"
            done
      - name: Run govulncheck
        run: make govulncheck

  test-bench:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Environment
        run: |
          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.DEFAULT_GO_VERSION }}
          cache-dependency-path: "**/go.sum"
      - name: Run benchmarks to check functionality
        run: make test-bench

  test-tools:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Environment
        run: |
          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.DEFAULT_GO_VERSION }}
          cache-dependency-path: "**/go.sum"
      - name: Run tests for internal tools
        run: make test-tools

  test-race:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.DEFAULT_GO_VERSION }}
          check-latest: true
          cache-dependency-path: "**/go.sum"
      - name: Run tests with race detector
        run: make test-race

  test-concurrent-safe:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.DEFAULT_GO_VERSION }}
          check-latest: true
          cache-dependency-path: "**/go.sum"
      - name: Run ConcurrentSafe tests multiple times with race detector
        run: make test-concurrent-safe

  test-coverage:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.DEFAULT_GO_VERSION }}
          check-latest: true
          cache-dependency-path: "**/go.sum"
      - name: Run coverage tests
        run: make test-coverage
      - name: Store coverage test output
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage-artifacts-${{ env.DEFAULT_GO_VERSION }}
          path: coverage.txt

  codecov:
    runs-on: ubuntu-latest
    needs: [test-coverage]
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: coverage-artifacts-${{ env.DEFAULT_GO_VERSION }}
      - name: Upload coverage report
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          fail_ci_if_error: true
          files: ./coverage.txt
          verbose: true

  compatibility-test:
    strategy:
      matrix:
        go-version: ["1.27.0", "1.26.0"]
        platform:
          - {os: ubuntu-latest, goos: aix, goarch: ppc64, target: cross-build}
          - {os: macos-latest, goos: darwin, goarch: amd64, target: test-short}
          - {os: macos-latest, goos: darwin, goarch: arm64, target: test-short}
          - {os: ubuntu-latest, goos: js, goarch: wasm, target: cross-build}
          - {os: ubuntu-latest, goos: linux, goarch: "386", target: test-short}
          - {os: ubuntu-latest, goos: linux, goarch: amd64, target: test-short}
          - {os: ubuntu-22.04-arm, goos: linux, goarch: arm64, target: test-short}
          - {os: ubuntu-latest, goos: linux, goarch: ppc64le, target: cross-build}
          - {os: ubuntu-latest, goos: linux, goarch: riscv64, target: cross-build}
          - {os: ubuntu-latest, goos: linux, goarch: arm, goarm: "7", target: cross-build}
          - {os: ubuntu-latest, goos: linux, goarch: s390x, target: cross-build}
          - {os: windows-latest, goos: windows, goarch: "386", target: test-short}
          - {os: windows-latest, goos: windows, goarch: amd64, target: test-short}
          - {os: ubuntu-latest, goos: windows, goarch: arm64, target: cross-build}
    runs-on: ${{ matrix.platform.os }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ matrix.go-version }}
          check-latest: true
          cache-dependency-path: "**/go.sum"
      - name: Run compatibility check
        env:
          GOOS: ${{ matrix.platform.goos }}
          GOARCH: ${{ matrix.platform.goarch }}
          GOARM: ${{ matrix.platform.goarm }}
        run: make ${{ matrix.platform.target }}

  test-compatibility:
    runs-on: ubuntu-latest
    needs: [compatibility-test]
    if: always()
    steps:
      - name: Test if compatibility-test passed
        run: |
          echo ${{ needs.compatibility-test.result }}
          test ${{ needs.compatibility-test.result }} == "success"