name: CI

# Runner-native workflow: the self-hosted act_runner's job containers have no
# Node.js, so JavaScript actions (actions/checkout, actions/setup-go, ...)
# fail with "Cannot find: node in PATH". Every step here is a plain shell
# run-step inside a golang container instead.

on:
  push:
    branches:
      - main
  pull_request:

# Cancel superseded runs for the same ref to save runner capacity.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint
    runs-on: docker
    container:
      image: golang:1.25-alpine
    steps:
      - name: Checkout
        run: |
          apk add -q --no-cache git make protobuf protobuf-dev curl
          git init -q .
          git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
          git fetch -q --depth 1 origin ${{ gitea.sha }}
          git checkout -q FETCH_HEAD

      # api/grpc/pb/ is gitignored and generated at build time, so anything
      # that compiles this module - including the linter, which type-checks
      # packages - needs the generated code in place first.
      - name: Generate protobuf code
        run: |
          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
          export PATH="$PATH:$(go env GOPATH)/bin"
          make proto-gen

      # Installed via `go install` (module proxy + sumdb verification): the
      # official install.sh tarball download hit checksum mismatches on this
      # runner.
      - name: Run golangci-lint
        run: |
          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
          "$(go env GOPATH)/bin/golangci-lint" run ./...

  test:
    name: Test
    runs-on: docker
    container:
      image: golang:1.25-alpine
    steps:
      - name: Checkout
        run: |
          apk add -q --no-cache git make protobuf protobuf-dev gcc musl-dev
          git init -q .
          git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
          git fetch -q --depth 1 origin ${{ gitea.sha }}
          git checkout -q FETCH_HEAD

      - name: Generate protobuf code
        run: |
          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
          export PATH="$PATH:$(go env GOPATH)/bin"
          make proto-gen

      # -race needs cgo, hence gcc/musl-dev above. tests/e2e uses
      # testcontainers-go (needs a Docker daemon) and is excluded; run it
      # locally with: go test -race ./tests/e2e/...
      # coverage.out is left in the workspace; artifact upload is omitted
      # until the instance's artifact storage is confirmed working.
      - name: Run tests (excluding e2e)
        run: |
          go test -race -covermode=atomic -coverprofile=coverage.out \
            $(go list ./... | grep -v '/tests/e2e')

  vuln:
    name: Vulnerability scan
    runs-on: docker
    container:
      image: golang:1.25-alpine
    # Advisory: govulncheck also reports Go-stdlib findings that are only
    # fixable by toolchain updates; flip to blocking once triaged.
    continue-on-error: true
    steps:
      - name: Checkout
        run: |
          apk add -q --no-cache git make protobuf protobuf-dev
          git init -q .
          git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
          git fetch -q --depth 1 origin ${{ gitea.sha }}
          git checkout -q FETCH_HEAD

      # govulncheck also loads and type-checks the module's packages, so the
      # generated protobuf code has to exist first.
      - name: Generate protobuf code
        run: |
          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
          export PATH="$PATH:$(go env GOPATH)/bin"
          make proto-gen

      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          "$(go env GOPATH)/bin/govulncheck" ./...