ci.yml

name: CI

on:
  push:
    branches: [develop, main]
  pull_request:
    branches: [develop, main]

permissions:
  contents: read

# A superseded pull-request run tells us nothing once new commits arrive, so
# cancel it. Runs on develop and main are never cancelled: those are the ones
# whose result we go back and read.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Every job runs on GitHub's standard hosted runners, which are free and
  # unmetered for public repositories. That also keeps fork pull requests off
  # our own hardware: this repository has dozens of forks, and a self-hosted
  # runner would be executing their code.
  #
  # Actions are pinned to full commit SHAs, since tags move under you.
  # Dependabot's github-actions ecosystem updates the SHA and its trailing
  # version comment together, which is what makes the pins maintainable.
  #
  # persist-credentials is off everywhere: no job pushes.
  #
  # timeout-minutes is set on every job so a hung one cannot burn through
  # GitHub's six-hour default.
  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.27.1'

      # gofmt is checked over the tracked sources only. The vendor tree is
      # third-party code we do not reformat, and `make format` would rewrite
      # the files rather than report them.
      - name: Check gofmt
        run: |
          unformatted=$(gofmt -l $(git ls-files '*.go' | grep -v '^vendor/'))
          if [ -n "$unformatted" ]; then
            echo "These files need gofmt:"
            echo "$unformatted"
            exit 1
          fi

      - name: Run go vet
        run: go vet -mod=vendor ./...

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.27.1'

      # `make go-tests` builds the daemon, agent, schema, crypt and report
      # binaries first and then runs `go test -race` with the repository root
      # and bin/ on PATH. The agent suite shells out to shield-pipe, so those
      # binaries have to exist before the tests run; calling `go test` on its
      # own leaves five agent specs failing with exit status 127.
      - name: Run unit tests with the race detector
        run: make go-tests

  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: [lint, test]
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.27.1'

      # The repository vendors its dependencies, so the build must not need to
      # reach the network. `go mod verify` checks the module cache against
      # go.sum, and building with -mod=vendor proves the vendor tree is
      # complete and consistent with go.mod.
      - name: Verify vendored dependencies
        run: |
          go mod verify
          go build -mod=vendor ./...

      - name: Build every binary and plugin
        run: make build

  plugin-tests:
    name: Plugin Tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: [lint, test]
    # Eight of the 134 plugin specs in t/plugins already fail on develop: they
    # assert the compact "USAGE: ..." help that the plugin framework printed
    # for `-h` before it was changed to print the long help for both flags.
    # Deciding whether the framework or the expectations are wrong is a
    # separate change, so this job reports without blocking a merge. Drop
    # continue-on-error once those eight are settled.
    continue-on-error: true
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.27.1'

      - name: Run plugin tests
        run: make plugin-tests

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.27.1'

      # govulncheck reports only the advisories whose vulnerable symbols this
      # code actually reaches, so it is the gate that can stay
      # red-means-broken rather than red-means-someone-published-a-CVE.
      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          "$(go env GOPATH)/bin/govulncheck" ./...

      # Installed from the pinned release rather than through trivy-action:
      # the action's own installer resolves "latest" unless pinned twice, and
      # a plain binary drop keeps this job's moving parts visible.
      - name: Install trivy
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
            | sudo sh -s -- -b /usr/local/bin v0.74.0

      # Gating on HIGH and CRITICAL only, so an unfixable low-severity
      # advisory cannot hold CI red with nothing to remediate. The vendor tree
      # is skipped for misconfiguration scanning: it carries upstream
      # projects' own Dockerfiles, which we neither build nor ship.
      # Suppressions with their justifications live in .trivyignore.
      - name: Scan repository
        run: >-
          trivy fs
          --scanners vuln,secret,misconfig
          --severity HIGH,CRITICAL
          --exit-code 1
          --skip-dirs .git
          --skip-dirs vendor
          --skip-dirs tmp
          .