ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    # Every Monday: find vulnerabilities that became known since the last push.
    - cron: "17 5 * * 1"

permissions:
  contents: read

concurrency:
  # A new push to a pull request cancels the older run for it.
  # Each push to main gets its own group, so those runs are never cancelled.
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  test:
    name: test (${{ matrix.go }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # go.mod: the oldest Go we support (the go line in go.mod).
        # stable: the newest Go release.
        go: [go.mod, stable]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: ${{ matrix.go == 'go.mod' && 'go.mod' || '' }}
          go-version: ${{ matrix.go == 'stable' && 'stable' || '' }}
      - name: Check formatting
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "These files are not formatted with gofmt:"
            echo "$unformatted"
            exit 1
          fi
      - run: go vet ./...
      # The tests need git. GitHub sets CI=true, and then a test fails
      # instead of skips when git is missing.
      - run: git --version
      - run: go test -race ./...
      - name: Build static binaries
        run: |
          for arch in amd64 arm64; do
            CGO_ENABLED=0 GOOS=linux GOARCH="$arch" go build -trimpath -o "/tmp/pullgate-$arch" ./cmd/pullgate
          done

  e2e:
    name: end-to-end test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: git --version
      - run: go vet -tags e2e ./test/e2e/...
      - name: End-to-end test
        # A local bare repo with two commits, the real binary, the listener
        # against a fake Telegram server, a tap, and the apply of the
        # second commit (DESIGN.md section 14).
        run: go test -race -tags e2e ./test/e2e/...

  units:
    name: example units
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check the example scripts and units
        run: |
          set -eu
          for f in contrib/examples/*/*.sh; do sh -n "$f"; done
          # The binary is not installed here; every other message fails.
          out="$(systemd-analyze verify --man=no contrib/systemd/* 2>&1 || true)"
          echo "$out"
          if echo "$out" | grep -v "Command /usr/local/bin/pullgate is not executable" | grep -q .; then
            exit 1
          fi

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          # Dependabot does not update this version. Update it by hand.
          version: v2.14.0
          # With the tag e2e, the files of the end-to-end test are checked too.
          args: --build-tags e2e

  vuln:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          # Release binaries are built with the newest Go, so check the
          # standard library of that version.
          go-version: stable
      - name: govulncheck
        # Dependabot does not update this version. Update it by hand.
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...

  vuln-release:
    name: vuln (latest release)
    # Weekly only. The published binaries contain the Go standard library
    # they were built with, so check the binaries themselves. A finding here
    # needs a new release (see docs/releasing.md).
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: stable
          cache: false
      - name: govulncheck on the binaries of the latest release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          tag="$(gh release list --repo "$GITHUB_REPOSITORY" --exclude-drafts \
            --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName // empty')"
          if [ -z "$tag" ]; then
            echo "No release yet. Nothing to check."
            exit 0
          fi
          dir="${RUNNER_TEMP}/release"
          gh release download "$tag" --repo "$GITHUB_REPOSITORY" --dir "$dir" \
            --pattern 'pullgate_*_linux_*.tar.gz'
          status=0
          for tarball in "$dir"/*.tar.gz; do
            out="${tarball%.tar.gz}"
            mkdir -p "$out"
            tar -xzf "$tarball" -C "$out" pullgate
            echo "== ${tag}: $(basename "$tarball")"
            go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 -mode=binary "$out/pullgate" || status=1
          done
          exit "$status"