code-health.yml

---
name: Code Health
on:
  push:
    branches:
      - main
  pull_request:
permissions:
  pull-requests: write  # For PR-specific operations
  issues: write        # For commenting functionality
jobs:
  golangci:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
          cache: false # see https://github.com/golangci/golangci-lint-action/issues/807
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6.1.1
        with:
          version: v1.61.0
          args: --timeout 3m0s
  licensecheck:
    name: licensecheck
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: make devtools
      - run: ./build/ci/check-licenses.sh
  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - name: Generate docs
        run: make gen-docs > /dev/null
      - name: Check for uncommitted files
        run: |
          export FILES=
          FILES=$(git ls-files -o -m --directory --exclude-standard --no-empty-directory)
          export LINES=
          LINES=$(echo "$FILES" | awk 'NF' | wc -l)
          if [ "$LINES" -ne 0 ]; then
            echo "Detected files that need to be committed:"
            echo "${FILES//^/ }"
            echo ""
            echo "Try running: make gen-docs"
            exit 1
          fi
  actionlint:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Download actionlint
        id: get_actionlint
        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
        shell: bash
      - name: Check workflow files
        run: |
          echo "::add-matcher::.github/actionlint-matcher.json"
          ${{ steps.get_actionlint.outputs.executable }} -color
        shell: bash
  mocks:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - name: Install go-mock
        run: go install github.com/golang/mock/mockgen@latest
      - name: Generate mocks
        run: make gen-mocks
      - name: Check for uncommitted files
        run: |
          export FILES=
          FILES=$(git ls-files -o -m --directory --exclude-standard --no-empty-directory)
          export LINES=
          LINES=$(echo "$FILES" | awk 'NF' | wc -l)
          if [ "$LINES" -ne 0 ]; then
            echo "Detected files that need to be committed:"
            echo "${FILES//^/ }"
            echo ""
            echo "Try running: make gen-mocks"
            exit 1
          fi
  shellcheck:
    name: shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Run ShellCheck
        uses: bewuethr/shellcheck-action@v2
  tidy:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - name: Run 'go mod tidy'
        run: go mod tidy
      - name: Check for uncommitted files
        run: |
          export FILES=
          FILES=$(git ls-files -o -m --directory --exclude-standard --no-empty-directory)
          export LINES=
          LINES=$(echo "$FILES" | awk 'NF' | wc -l)
          if [ "$LINES" -ne 0 ]; then
            echo "Detected files that need to be committed:"
            echo "${FILES//^/ }"
            echo ""
            echo "Try running: go mod tidy"
            exit 1
          fi
  unit-tests:
    env:
      COVERAGE: coverage.out
      TEST_CMD: gotestsum --junitfile unit-tests.xml --format standard-verbose --
      UNIT_TAGS: unit
      INTEGRATION_TAGS: integration
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        if: ${{ matrix.os=='ubuntu-latest' }}
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: go install gotest.tools/gotestsum@latest
      - run: make unit-test
      - name: Test Summary
        id: test_summary
        uses: test-summary/action@v2.4
        with:
          paths: unit-tests.xml
        if: always() && matrix.os == 'ubuntu-latest'
      - name: Upload coverage file
        if: matrix.os == 'ubuntu-latest' && github.event_name == 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-file
          path: coverage.out
  fuzz-tests:
    env:
      COVERAGE: coverage.out
      TEST_CMD: gotestsum --format standard-verbose --
      UNIT_TAGS: unit
      INTEGRATION_TAGS: integration
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: go install gotest.tools/gotestsum@latest
      - run: make fuzz-normalizer-test