ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

env:
  # Validate the selected toolchain; do not silently download a newer compiler.
  GOTOOLCHAIN: local

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Vet and test (Go ${{ matrix.go }})
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - go: '1.27.3'
            version: '1.27.3'
          - go: '1.27.x'
            # Reject stale manifests and caches below the security baseline.
            version: '>=1.27.3 <1.28.0'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ matrix.version }}
          # Floating versions must not reuse an older cached security patch.
          check-latest: ${{ matrix.go == '1.27.x' }}
          cache: true
      - name: Verify formatting
        if: matrix.go == '1.27.x'
        run: make fmt-check
      - name: Verify dependency boundary
        if: matrix.go == '1.27.x'
        run: make dependency-boundary-check
      - name: Verify module files
        if: matrix.go == '1.27.x'
        run: make mod-check
      - name: Verify third-party notices
        if: matrix.go == '1.27.x'
        run: make notices-check
      - name: Vet
        run: make vet
      - name: Release contract regression tests
        if: matrix.go == '1.27.x'
        run: make release-recipe-check
      - name: Browser and pilot diagnostic regression tests (offline)
        if: matrix.go == '1.27.x'
        run: |
          python3 -m unittest scripts/stealth-browser/test_run_cover.py
          python3 scripts/stealth-browser/run_cover.py --self-test
          python3 scripts/stealth-campaign.py --self-test
          python3 scripts/stealth-pilot-config.py self-test
          sh -n scripts/stealth-pilot.sh
      - name: Test with coverage
        run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
      - name: Upload coverage
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage-go-${{ matrix.go }}
          path: coverage.out
          if-no-files-found: error

  macos-test:
    name: macOS test (Go 1.27.3)
    runs-on: macos-15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.27.3
          cache: true
      - name: Test
        run: go test -shuffle=on -count=1 ./...

  windows-udp-test:
    name: Windows UDP continuity (Go 1.27.3)
    runs-on: windows-2022
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.27.3
          cache: true
      - name: Exercise native UDP continuity and platform bind errors
        shell: pwsh
        run: |
          $testOutput = & go test ./internal/tunnel -run '^(TestWebTestAddressInUse|TestQUICDatagramClosedPortPreservesAssociation)$' -count=5 -timeout=60s -json
          $testExit = $LASTEXITCODE
          $testOutput | Write-Output
          if ($testExit -ne 0) { exit $testExit }
          $testEvents = @($testOutput | ForEach-Object { $_ | ConvertFrom-Json -ErrorAction Stop })
          foreach ($testName in @('TestWebTestAddressInUse', 'TestQUICDatagramClosedPortPreservesAssociation')) {
            $passes = @($testEvents | Where-Object { $_.Test -eq $testName -and $_.Action -eq 'pass' }).Count
            $skips = @($testEvents | Where-Object { $_.Test -eq $testName -and $_.Action -eq 'skip' }).Count
            if ($passes -ne 5 -or $skips -ne 0) {
              throw "$testName requires exactly 5 passes and 0 skips; got $passes passes and $skips skips"
            }
            Write-Output "Verified ${testName}: $passes passes, $skips skips"
          }
      - name: Exercise bounded web listener retries and rollback on Windows
        shell: pwsh
        run: |
          $retryTests = @('TestWebListenRetryRealUDPCollision', 'TestWebListenRetryPolicy', 'TestWebListenRetryCloseFailure')
          $testOutput = & go test ./internal/tunnel -run ('^(' + ($retryTests -join '|') + ')$') -count=3 -timeout=90s -json
          $testExit = $LASTEXITCODE
          $testOutput | Write-Output
          if ($testExit -ne 0) { exit $testExit }
          $testEvents = @($testOutput | ForEach-Object { $_ | ConvertFrom-Json -ErrorAction Stop })
          foreach ($testName in $retryTests) {
            $passes = @($testEvents | Where-Object { $_.Test -eq $testName -and $_.Action -eq 'pass' }).Count
            $skips = @($testEvents | Where-Object { $_.Test -eq $testName -and $_.Action -eq 'skip' }).Count
            if ($passes -ne 3 -or $skips -ne 0) {
              throw "$testName requires exactly 3 passes and 0 skips; got $passes passes and $skips skips"
            }
            Write-Output "Verified ${testName}: $passes passes, $skips skips"
          }
      - name: Exercise path handling and certificate creation on Windows
        shell: pwsh
        run: |
          $pathTests = @(
            'TestStaticHandlerServesGETAndHEAD', 'TestStaticHandlerUsesStandardErrors', 'TestStaticHandlerValidatesDirectory',
            'TestStaticFileSystemPathPolicy', 'TestStaticRootWindowsRelativePaths', 'TestCertificateTemporaryFileForDriveRelativeFilename',
            'TestCommandConfigWindowsPathKinds', 'TestInitCreatesPrivatePortableMatchingBundle', 'TestInitRefusesExistingPathsAndMissingParent',
            'TestCertConcurrentProcesses', 'TestCreateSelfSignedCertificate',
            'TestCreateSelfSignedCertificateWindowsDriveRelativePaths', 'TestCreateCertificatePairCleansOwnKeyAfterCertificateConflict'
          )
          $selection = '^(' + ($pathTests -join '|') + ')$'
          $testOutput = & go test ./internal/cover ./internal/security ./cmd/autocar -run $selection -count=1 -timeout=60s -json
          $testExit = $LASTEXITCODE
          $testOutput | Write-Output
          if ($testExit -ne 0) { exit $testExit }
          $testEvents = @($testOutput | ForEach-Object { $_ | ConvertFrom-Json -ErrorAction Stop })
          foreach ($testName in $pathTests) {
            $passes = @($testEvents | Where-Object { $_.Test -eq $testName -and $_.Action -eq 'pass' }).Count
            $skips = @($testEvents | Where-Object { $_.Test -eq $testName -and $_.Action -eq 'skip' }).Count
            if ($passes -ne 1 -or $skips -ne 0) {
              throw "$testName requires exactly 1 pass and 0 skips; got $passes passes and $skips skips"
            }
            Write-Output "Verified ${testName}: $passes passes, $skips skips"
          }

  race:
    name: Race detector
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '>=1.27.3 <1.28.0'
          check-latest: true
          cache: true
      - run: make race

  vulnerability-scan:
    name: Reachable vulnerability scan
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.27.3
          cache: true
      - name: Run govulncheck
        run: ./scripts/govulncheck.sh
      - name: Query original uTLS upstream advisories
        if: always()
        run: |
          ./scripts/govulncheck.sh --upstream-utls > "$RUNNER_TEMP/utls-upstream-advisories.json"
          ./scripts/check-upstream-advisories.sh "$RUNNER_TEMP/utls-upstream-advisories.json"
      - name: Preserve original uTLS advisory query
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: utls-upstream-advisories
          path: ${{ runner.temp }}/utls-upstream-advisories.json
          if-no-files-found: error
      - name: Query official QUIC source-lineage advisories
        if: always()
        run: |
          ./scripts/govulncheck.sh --upstream-quic > "$RUNNER_TEMP/quic-official-upstream-advisories.json"
          ./scripts/check-upstream-advisories.sh "$RUNNER_TEMP/quic-official-upstream-advisories.json"
      - name: Preserve official QUIC source-lineage advisory query
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: quic-official-upstream-advisories
          path: ${{ runner.temp }}/quic-official-upstream-advisories.json
          if-no-files-found: error

  build:
    name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: linux
            goarch: amd64
            artifact: autocar-linux-amd64
            binary: autocar
            archive: autocar-linux-amd64.tar.gz
          - goos: linux
            goarch: arm64
            artifact: autocar-linux-arm64
            binary: autocar
            archive: autocar-linux-arm64.tar.gz
          - goos: darwin
            goarch: arm64
            artifact: autocar-darwin-arm64
            binary: autocar
            archive: autocar-darwin-arm64.tar.gz
          - goos: windows
            goarch: amd64
            artifact: autocar-windows-amd64
            binary: autocar.exe
            archive: autocar-windows-amd64.zip
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '>=1.27.3 <1.28.0'
          check-latest: true
          cache: true
      - name: Cross-build
        env:
          CGO_ENABLED: "0"
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
        run: |
          mkdir -p dist/package
          BUILD_VERSION="ci-${GITHUB_SHA:0:12}"
          BUILD_DATE="$(git show -s --format=%cI HEAD)"
          go build -trimpath \
            -ldflags "-s -w -X github.com/cppla/autocar/internal/version.Version=${BUILD_VERSION} -X github.com/cppla/autocar/internal/version.Commit=${GITHUB_SHA} -X github.com/cppla/autocar/internal/version.Date=${BUILD_DATE}" \
            -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
          cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
          if [ "${{ matrix.goos }}" = "windows" ]; then
            (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
          else
            tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
          fi
          test -s "dist/${{ matrix.archive }}"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ matrix.artifact }}
          path: dist/${{ matrix.archive }}
          if-no-files-found: error

  container:
    name: Multi-platform container build
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Run container integration
        run: make integration-docker
      - name: Build OCI image index
        run: |
          docker buildx create --name autocar-ci --driver docker-container --use
          docker buildx inspect --bootstrap
          docker buildx build \
            --platform linux/amd64,linux/arm64 \
            --output type=oci,dest=/tmp/autocar-images.tar \
            .