ci.yml

# SPDX-License-Identifier: Apache-2.0
# Copyright (C) 2026 Amutable GmbH

name: ci

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 0 * * *'
  workflow_dispatch:

permissions: {}

env:
  ACTIONLINT_VERSION: "v1.7.9"
  GOLANGCI_LINT_VERSION: "v2.15.0"
  JUST_VERSION: "1.53.0"
  LIBPATHRS_VERSION: "0.2.5"
  ZIZMOR_VERSION: "1.26.1"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    name: go build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-24.04, ubuntu-24.04-arm ]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - uses: ./.github/actions/setup-libpathrs
        with:
          version: ${{ env.LIBPATHRS_VERSION }}
      - name: install just
        run: cargo install --locked "just@${JUST_VERSION}"
      - name: build
        run: just build-all

  build-container:
    name: docker build
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: install just
        run: cargo install --locked "just@${JUST_VERSION}"
      - name: build in container
        run: just build-all-in-container

  rpm-build:
    name: rpmbuild (--${{ matrix.sysupdate }} sysupdate, --${{ matrix.insecure }} insecure)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    container:
      # Track the current stable Fedora release, which should have new enough
      # go and libpathrs packages to satisfy the BuildRequires of our spec.
      image: registry.fedoraproject.org/fedora:latest@sha256:b013b98e4f4c43b46fb59b71b9d3d1f4f33df503ff84b1ea3415cafc32ead87c
    strategy:
      fail-fast: false
      matrix:
        sysupdate: [ with, without ]
        insecure: [ with, without ]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: install build dependencies
        run: |
          dnf install -y --setopt=install_weak_deps=False rpm-build dnf5-plugins
          dnf builddep -y contrib/rpm/quarry.spec
      - name: rpmbuild (--${{ matrix.sysupdate }} sysupdate, --${{ matrix.insecure }} insecure)
        env:
          SYSUPDATE: ${{ matrix.sysupdate }}
          INSECURE: ${{ matrix.insecure }}
        run: |
          topdir="$(mktemp -d)"
          version="$(rpmspec --srpm -q --qf '%{version}' contrib/rpm/quarry.spec)"
          mkdir -p "$topdir/SOURCES"
          tar --exclude-vcs -czf "$topdir/SOURCES/quarry-${version}.tar.gz" .
          rpmbuild -ba \
              --define "_topdir $topdir" \
              "--$SYSUPDATE" sysupdate \
              "--$INSECURE" insecure \
              contrib/rpm/quarry.spec

  go-test:
    name: go test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-24.04, ubuntu-24.04-arm ]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - uses: ./.github/actions/setup-libpathrs
        with:
          version: ${{ env.LIBPATHRS_VERSION }}
      - name: install just
        run: cargo install --locked "just@${JUST_VERSION}"
      - name: test
        run: just test

  go-lint:
    name: golangci-lint
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - uses: ./.github/actions/setup-libpathrs
        with:
          version: ${{ env.LIBPATHRS_VERSION }}
      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}

  go-modcheck:
    name: go mod tidy
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: check go.mod is tidy
        run: go mod tidy -diff

  lint-shell:
    name: shellcheck
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: install just
        run: cargo install --locked "just@${JUST_VERSION}"
      - name: shellcheck
        run: just lint-shell

  go-vuln:
    name: govulncheck
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          # Scan with the latest stable toolchain -- stdlib vulnerabilities are
          # attributed to the toolchain doing the scan, so scanning with an
          # older pinned toolchain would flag already-fixed stdlib issues.
          go-version: stable
      - uses: ./.github/actions/setup-libpathrs
        with:
          version: ${{ env.LIBPATHRS_VERSION }}
      - name: install just
        run: cargo install --locked "just@${JUST_VERSION}"
      - name: govulncheck
        run: just vuln

  gha-actionlint:
    name: actionlint
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: actionlint
        run: go run "github.com/rhysd/actionlint/cmd/actionlint@${ACTIONLINT_VERSION}"

  gha-zizmor:
    name: zizmor
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
        with:
          version: ${{ env.ZIZMOR_VERSION }}
          advanced-security: false
          annotations: true

  complete:
    name: complete
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions: {}
    # Run even if some needed jobs failed or were skipped (but not if the
    # whole run was cancelled), otherwise this job would be marked as skipped
    # and skipped jobs satisfy required status checks.
    if: ${{ !cancelled() }}
    needs:
      - build
      - build-container
      - rpm-build
      - go-test
      - go-vuln
      - go-modcheck
      - go-lint
      - lint-shell
      - gha-actionlint
      - gha-zizmor
    steps:
      - name: check that all jobs succeeded
        env:
          NEEDS_JSON: ${{ toJSON(needs) }}
        run: jq --exit-status 'all(.[]; .result == "success")' <<<"$NEEDS_JSON"