ci.yml

name: CI

# Run on pushes to main and on pull requests (any base branch). Feature-branch
# pushes are covered by their pull request, which avoids duplicate runs.
on:
  push:
    branches: [main]
  pull_request:

# Minimum permissions required for CI workflow (secure by default).
# See: https://docs.github.com/en/actions/security-guides/automatic-token-validation
permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  # Pinned tool versions — bump deliberately.
  GOVULNCHECK_VERSION: v1.9.0
  STATICCHECK_VERSION: v0.8.2

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          # Always build and test with the newest patched Go release so stdlib
          # security fixes land without a go.mod change (go.mod states the minimum).
          go-version: stable
          check-latest: true
          cache: true

      - name: Check formatting
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "The following files are not gofmt-formatted:"
            echo "$unformatted"
            exit 1
          fi

      - name: Check go.mod / go.sum are tidy
        run: go mod tidy -diff

      - name: Check embedded config example is in sync
        run: diff -u config.toml.example cmd/static-web/config.toml.example

      - name: Build
        run: go build ./...

      - name: Vet
        run: go vet ./...

      - name: Staticcheck
        run: go run honnef.co/go/tools/cmd/staticcheck@${STATICCHECK_VERSION} ./...

      - name: Test
        run: go test -race ./...

      - name: Run govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION} ./...