validate.yaml

# Tests & Lint - runs go test -race + coverage, golangci-lint, and the
# workflow/action lint pass (actionlint over .github/workflows plus shellcheck
# over the composite actions' scripts).
#
# Triggers:
#   push: branches main  standalone run on every push to trunk - this is what
#                        populates the ?branch=main status badge.
#   pull_request         gate every PR before merge.
#   workflow_call        invoked by orchestrate.yaml (keep - do not remove).
#   workflow_dispatch    manual standalone run against any ref.
#
# The push/pull_request triggers give this workflow runs of its own so its
# status badge renders; a workflow_call-only workflow has no standalone runs
# to badge.
name: Tests & Lint

on:
  workflow_call:
    inputs:
      dry_run:
        description: 'Dry run mode'
        type: boolean
        required: false
        default: false
    outputs:
      result:
        description: 'Validation result (success/failure)'
        value: ${{ jobs.validate.outputs.result }}
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # Release tags must be visible so the DefaultCLIVersion release-lag
          # guard runs instead of skipping on a tag-less shallow checkout, and
          # the history since the last release tag must be complete so the
          # CHANGELOG [Unreleased] freshness guard runs instead of skipping on
          # a shallow checkout.
          fetch-tags: true
          fetch-depth: 0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true

      # actionlint must be on PATH so the emitted-workflow enforcement guard
      # (TestActionlint_FeatureMatrix and the census-driven sweep) genuinely runs
      # instead of skipping. Pinned to the same SHA the workflow-lint job uses so
      # the guard and the repo's own workflow lint agree on the actionlint version.
      - name: Install actionlint
        run: go install github.com/rhysd/actionlint/cmd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca  # v1.7.12

      - name: Run tests
        run: go test -v -race -coverprofile=coverage.out ./...

      - name: Check coverage
        run: |
          go tool cover -func=coverage.out
          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | tr -d '%')
          echo "Total coverage: ${COVERAGE}%"

      - name: Check coverage threshold
        run: |
          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | tr -d '%')
          echo "Total coverage: ${COVERAGE}%"
          awk -v cov="$COVERAGE" 'BEGIN {
            if (cov + 0 < 80) {
              printf "Coverage %s%% is below the 80%% threshold\n", cov
              exit 1
            }
            printf "Coverage %s%% meets the 80%% threshold\n", cov
          }'

      # The e2e module is excluded from the root -race run above; its harness
      # contains real concurrency (scenario slots, runner, multi-repo), so run
      # its Docker-free tests under the race detector here.
      - name: Run e2e harness tests (race)
        working-directory: e2e
        run: go test -short -race ./harness/...

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.10.1

  workflow-lint:
    name: Workflow Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true

      # actionlint parses every workflow and runs shellcheck (preinstalled on
      # ubuntu runners) over the embedded run blocks. SC2129 (grouped-redirect
      # style) fires in the generated orchestrate/promote workflows; that
      # style change belongs to the generator, so the rule is excluded here
      # rather than hand-editing generated files into drift.
      - name: Run actionlint
        env:
          SHELLCHECK_OPTS: -e SC2129
        run: go run github.com/rhysd/actionlint/cmd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca -color  # v1.7.12

      # actionlint only covers workflows, not composite actions, so the
      # actions' extracted scripts are linted directly.
      - name: Run shellcheck on action scripts
        run: shellcheck .github/actions/*/*.sh

  vuln:
    name: Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Run govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 ./...  # v1.3.0

      - name: Run govulncheck (e2e module)
        working-directory: e2e
        run: go run golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 ./...  # v1.3.0

  validate:
    name: Validation Gate
    needs: [test, lint, workflow-lint, vuln]
    runs-on: ubuntu-latest
    outputs:
      result: ${{ steps.result.outputs.result }}
    steps:
      - name: Check results
        id: result
        run: |
          echo "result=success" >> "$GITHUB_OUTPUT"
          echo "Validation passed"