ci.yml

name: CI

on:
  push:
    branches: [main, master]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "LICENSE"
  pull_request:
    branches: [main, master]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "LICENSE"

permissions:
  contents: read

# Cancel in-progress runs for the same ref
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # ---- Go test matrix ----
  test:
    name: Test (Go ${{ matrix.go-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        go-version: ["1.24", "1.25"]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
          cache: true

      - name: Vet
        run: go vet ./...

      - name: Test
        run: go test -race -coverprofile=coverage.out -covermode=atomic ./...

      - name: Coverage threshold
        env:
          MIN_COVERAGE: "70.0"
        run: |
          total=$(go tool cover -func=coverage.out | awk '/^total:/ {gsub(/%/, "", $3); print $3}')
          awk -v total="$total" -v min="$MIN_COVERAGE" 'BEGIN {
            if (total + 0 < min + 0) {
              printf "coverage %.1f%% is below required %.1f%%\n", total, min
              exit 1
            }
            printf "coverage %.1f%% meets required %.1f%%\n", total, min
          }'

      - name: Coverage report
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage-go-${{ matrix.go-version }}
          path: coverage.out
          if-no-files-found: error


  # ---- Lint ----
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24"
          cache: true

      - name: Lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: latest
          args: --timeout=5m

  # ---- Binary build check ----
  build:
    name: Build (${{ matrix.binary }})
    runs-on: ${{ matrix.os }}
    needs: test
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            binary: warpshift-linux-amd64
            goos: linux
            goarch: amd64
          - os: ubuntu-latest
            binary: warpshift-linux-arm64
            goos: linux
            goarch: arm64
          - os: windows-latest
            binary: warpshift-windows-amd64.exe
            goos: windows
            goarch: amd64
          - os: macos-latest
            binary: warpshift-darwin-amd64
            goos: darwin
            goarch: amd64
          - os: macos-latest
            binary: warpshift-darwin-arm64
            goos: darwin
            goarch: arm64
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24"
          cache: true
      - name: Set version info
        id: version
        shell: bash
        run: echo "short_sha=${GITHUB_SHA::8}" >> $GITHUB_OUTPUT

      - name: Build
        shell: bash
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
        run: |
          go build -trimpath -ldflags="-s -w -X main.version=ci-${{ steps.version.outputs.short_sha }}" -o "${{ matrix.binary }}" ./cmd/warpshift

      - name: Verify binary
        shell: bash
        run: |
          if [ ! -f "${{ matrix.binary }}" ]; then
            echo "Binary not found: ${{ matrix.binary }}"
            exit 1
          fi
          echo "Built: $(ls -lh ${{ matrix.binary }})"

      - name: Upload binary
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.binary }}
          path: ${{ matrix.binary }}
          if-no-files-found: error

  # ---- Docker image build verification ----
  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Set version info
        id: version
        shell: bash
        run: echo "short_sha=${GITHUB_SHA::8}" >> $GITHUB_OUTPUT

      - name: Build Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          load: false
          build-args: |
            VERSION=ci-${{ steps.version.outputs.short_sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ---- CodeQL security analysis ----
  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    needs: test
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24"
          cache: true

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: go

      - name: Build
        run: go build ./...

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4