name: CI

# Gitea Actions reads workflows from .gitea/workflows/ and executes them with
# a GitHub-Actions-compatible engine (act_runner). Standard actions/* steps
# work as long as the runner can resolve github.com (either directly or via a
# configured actions mirror on the Gitea instance) - see notes at the bottom
# of this file for offline/mirrored setups.

on:
  push:
    branches:
      - main
  pull_request:

# Cancel superseded runs for the same ref to save runner capacity.
# Gitea Actions accepts both the `gitea.*` and `github.*` context aliases;
# `github.*` is used here since it's the more portable spelling.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # api/grpc/pb/ is gitignored and generated at build time (see
      # .gitignore and the Dockerfile), so anything that compiles this
      # module - including the linter, which type-checks packages - needs
      # the generated code in place first.
      - name: Generate protobuf code
        uses: ./.gitea/actions/generate-proto

      # Installing the pinned binary via the official install script is more
      # portable across Gitea Actions runner images than golangci-lint-action,
      # which assumes a GitHub-hosted runner environment (it works, but the
      # install script approach has fewer surprises on self-hosted runners
      # and lets us pin an exact version without depending on the action's
      # own release cadence).
      - name: Install golangci-lint
        run: |
          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \
            sh -s -- -b "$(go env GOPATH)/bin" v2.12.2
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      - name: Run golangci-lint
        run: golangci-lint run ./...

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # api/grpc/pb/ is gitignored and generated at build time; without this
      # the module won't compile (pkg/client, internal/service, etc. import
      # the generated package).
      - name: Generate protobuf code
        uses: ./.gitea/actions/generate-proto

      # tests/e2e uses testcontainers-go and requires a Docker daemon that
      # isn't guaranteed to be available/usable on Gitea Actions runners, so
      # it is excluded from CI here via `go list ... | grep -v`. Run it
      # locally (or on a runner with Docker-in-Docker configured) with:
      #   go test -race ./tests/e2e/...
      - name: Run tests (excluding e2e)
        run: |
          go test -race -covermode=atomic -coverprofile=coverage.out \
            $(go list ./... | grep -v '/tests/e2e')
        # coverage.out is left in the workspace for inspection; artifact
        # upload is intentionally omitted since actions/upload-artifact
        # support varies by Gitea version/configuration - add it back once
        # your instance's artifact storage is confirmed working.

  vuln:
    name: Vulnerability scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # govulncheck also loads and type-checks the module's packages, so the
      # generated protobuf code has to exist first.
      - name: Generate protobuf code
        uses: ./.gitea/actions/generate-proto

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: govulncheck ./...