ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel in-progress CI runs on the same ref when a newer commit
# arrives. Per-ref grouping means a PR getting two pushes in quick
# succession only runs CI once on the latest sha; same for a series
# of main-branch merges. Doesn't affect release.yml — tag-build
# cancellation could leave half-uploaded signed artefacts.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions:
  contents: read

# Two tiers: fast PR gate, post-merge validation.
#
# Pull requests run only the cheap gates — non-race `go test`, lint,
# govulncheck, the bundled-wasm determinism check (plus gitleaks + CodeQL in
# their own workflows) — so PR feedback is fast. `push: main` adds the slow
# `-race` test (the early race signal on main).
#
# There is deliberately NO cross-compile build job here. GoReleaser
# (release.yml) cross-compiles + signs every target at release time, and a
# platform break fails the release run rather than publishing — so a separate
# compile-only matrix would only duplicate that gate, never add to it.
# release.yml also re-runs the `-race` suite before building, so a data race
# can't reach a release either. The tag ruleset requires `test`/`lint`
# (present on the merge commit from push:main) + CodeQL + gitleaks; it must
# NOT require any `build (...)` context (none is produced anymore).
# Accepted trade-off: data races are caught post-merge, and a platform-specific
# compile break surfaces at release time (a failed release attempt), not on
# the PR or on push:main.
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26.6"
          cache: true

      - name: Build bundled wasm (EP-0042 Part B — built from source, not committed)
        run: bash plugins/bundled/build.sh

      - name: Download dependencies
        run: go mod download

      # PRs run the fast non-race suite; push:main runs the full -race
      # suite (the post-merge race gate). -race requires cgo; release
      # binaries are built pure-Go (CGO_ENABLED=0) by GoReleaser.
      - name: Run tests
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            CGO_ENABLED=1 go test -race ./...
          else
            go test ./...
          fi

      - name: govulncheck
        # Pin a version instead of @latest so the go.sum cache catches
        # the download — otherwise sum.golang.org hiccups fail CI.
        # Retry once on transient network errors.
        run: |
          set -e
          for i in 1 2 3; do
            go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 && break
            echo "retry $i: govulncheck install hiccup, sleeping"
            sleep 10
          done
          govulncheck ./...

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26.6"
          cache: true

      - name: Build bundled wasm (EP-0042 Part B — built from source, not committed)
        run: bash plugins/bundled/build.sh

      - name: golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
        with:
          version: v2.11.4
          args: --timeout=5m

  official-plugins-abi:
    name: Official plugins ABI
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Check out stado
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Check out official plugins
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: foobarto/stado-plugins
          path: .tmp/official-plugins

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26.6"
          cache: true

      - name: Build bundled wasm
        run: bash plugins/bundled/build.sh

      - name: Check every released official plugin against this host ABI
        run: |
          set -euo pipefail
          mapfile -t released < <(
            jq -r '.plugins[] | select(.status == "released") | .path' \
              .tmp/official-plugins/plugin-inventory.json | LC_ALL=C sort
          )
          if [ "${#released[@]}" -eq 0 ]; then
            echo "::error::official released-plugin inventory is empty"
            exit 1
          fi
          plugin_dirs=()
          for plugin in "${released[@]}"; do
            plugin_dirs+=(".tmp/official-plugins/${plugin}/dist")
          done
          go run ./cmd/stado plugin abi-check "${plugin_dirs[@]}"

  # EP-0042 D3 / item-7: the bundled wasm is built from source at
  # build/release time and go:embed'd, so the binary-level signature only
  # covers reproducible bytes if the rebuild is byte-for-byte deterministic.
  # Build it twice and compare shas; a mismatch means a non-deterministic
  # build crept in (historically these corrupted //go:wasmexport arities).
  # Not in the tag ruleset's required set — informational gate on PR/main.
  wasm-determinism:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26.6"
          cache: true

      - name: Verify bundled wasm rebuild is deterministic
        run: |
          set -euo pipefail
          # Each build uses a fresh, isolated GOCACHE so the second run can't
          # replay the first run's cached package/link outputs — otherwise the
          # gate could hash cache hits and miss compiler-stage nondeterminism
          # (the failure mode this is meant to catch). Both builds compile cold.
          GOCACHE="${RUNNER_TEMP}/gocache-1" bash plugins/bundled/build.sh
          sha256sum internal/plugins/bundled/wasm/*.wasm | sort > "${RUNNER_TEMP}/wasm-sha-1.txt"
          rm -f internal/plugins/bundled/wasm/*.wasm
          GOCACHE="${RUNNER_TEMP}/gocache-2" bash plugins/bundled/build.sh
          sha256sum internal/plugins/bundled/wasm/*.wasm | sort > "${RUNNER_TEMP}/wasm-sha-2.txt"
          if ! diff -u "${RUNNER_TEMP}/wasm-sha-1.txt" "${RUNNER_TEMP}/wasm-sha-2.txt"; then
            echo "::error::bundled wasm rebuild is non-deterministic (EP-0042 D3) — release artefacts would not be reproducible from source"
            exit 1
          fi
          echo "bundled wasm rebuild is deterministic ($(wc -l < "${RUNNER_TEMP}/wasm-sha-1.txt") artefacts)"