ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          # Full history, not the default shallow clone — SonarQube's own
          # recommendation, for accurate blame/new-code-period data on
          # the scan step below.
          fetch-depth: 0

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          check-latest: true
          # No go.sum exists — this module has zero external
          # dependencies (see go.mod) — so cache-dependency-path must
          # be set explicitly or setup-go silently skips caching
          # (with an annoying "supported file pattern: go.sum"
          # warning) on every run. go.mod still exists and rarely
          # changes, so it's a fine cache key for the build cache.
          cache-dependency-path: go.mod

      - name: gofmt
        run: |
          fmt_out="$(gofmt -l .)"
          if [ -n "$fmt_out" ]; then
            echo "The following files are not gofmt-formatted:"
            echo "$fmt_out"
            exit 1
          fi

      - name: go vet
        run: go vet ./...

      - name: go build
        run: go build ./...

      - name: go test (race)
        run: go test -race -coverprofile=coverage.out ./...

      - name: coverage summary
        run: go tool cover -func=coverage.out | tail -1

      # Uploads the same coverage.out the step above already produced —
      # a second, independent coverage view (trend graphs, per-PR diff
      # comments, the README badge) alongside SonarQube's own gate
      # below, not a replacement for it. CODECOV_TOKEN is a repo secret
      # from codecov.io's own repo settings (Settings > General >
      # Repository Upload Token), after enabling this repo there.
      - name: Codecov upload
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage.out
          fail_ci_if_error: false

      # A second run, in Go's own -json event format rather than
      # coverage.out, purely for SonarQube's test-execution reporting
      # (pass/fail/skip counts and duration — see
      # sonar.go.tests.reportPaths in sonar-project.properties) — a
      # distinct signal from coverage, which the step above already
      # covers. Not folded into one invocation: `go test -json` encodes
      # the ordinary human-readable output (including the per-package
      # coverage summary above) as JSON events instead, which would
      # make this job's own log far harder to skim.
      - name: go test (json, for SonarQube test reporting)
        run: go test -race ./... -json > report.json

      # Config lives in sonar-project.properties (organization,
      # projectKey, sonar.go.coverage.reportPaths=coverage.out — the
      # file the step above just produced). CI-based analysis, not
      # SonarCloud's own Automatic Analysis — the latter never runs
      # this repo's tests, so it can't see coverage at all; that's the
      # whole reason this step exists.
      - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          check-latest: true
          cache-dependency-path: go.mod

      # Config lives in .golangci.yml — gosec (security), bodyclose,
      # plus golangci-lint's own "standard" set (errcheck, staticcheck,
      # govet, ineffassign, unused, gosimple). gofmt is enforced
      # separately above, not duplicated here.
      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.12

  govulncheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      # Manages its own Go toolchain internally and defaults to the
      # latest available Go — which matters here specifically: this
      # module has zero third-party dependencies (see go.mod), so
      # every finding this can plausibly report is a standard-library
      # CVE fixed in a newer Go patch release, not something a code
      # change here can fix. Always scanning under the latest patch is
      # what keeps this signal meaningful instead of permanently red
      # for a fix that already shipped upstream — deliberately not
      # pinned to go.mod's own minimum via go-version-file, which
      # would work against that.
      - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0