ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: test (${{ matrix.os }}, go ${{ matrix.go }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        go: [oldstable, stable]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        id: go
        with:
          go-version: ${{ matrix.go }}
          cache: false
      # setup-go's built-in cache uses one key per OS and Go version, so every job on the same
      # runner shares a single immutable entry saved by whichever job finished first (and missing
      # this job's race/fuzz/cross builds). Keep one per job instead.
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cache/go-build
            ~/Library/Caches/go-build
          key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ github.job }}-go${{ steps.go.outputs.go-version }}
      - run: make test TESTFLAGS=-coverprofile=coverage.out
      - run: go tool cover -func=coverage.out | tail -1

  minimum-go:
    name: build with minimum Go (go.mod)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod # so `make min-go` needs no toolchain download
      - run: make min-go

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: stable
      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.13
          install-only: true
      # golangci-lint's gofmt formatter fails on unformatted files; shellcheck is on the runner.
      - run: make lint actionlint

  fuzz-targets:
    runs-on: ubuntu-latest
    outputs:
      targets: ${{ steps.list.outputs.targets }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - id: list
        run: |
          targets=$(make -s fuzz-targets | jq -Rsc 'split("\n") | map(select(. != ""))')
          test "$targets" != "[]"
          echo "targets=$targets" >> "$GITHUB_OUTPUT"

  # One job per target: they run side by side instead of back to back, each still getting a
  # full 30s on its own runner.
  fuzz:
    name: fuzz (${{ matrix.target }})
    needs: fuzz-targets
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJSON(needs.fuzz-targets.outputs.targets) }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        id: go
        with:
          go-version: stable
          cache: false
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cache/go-build
            ~/Library/Caches/go-build
          key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ github.job }}-go${{ steps.go.outputs.go-version }}
      - run: make fuzz FUZZ="$TARGET"
        env:
          TARGET: ${{ matrix.target }}

  vulncheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: stable
      - run: make vulncheck

  release-check:
    name: goreleaser snapshot
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        id: go
        with:
          go-version: stable
          cache: false
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cache/go-build
            ~/Library/Caches/go-build
          key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ github.job }}-go${{ steps.go.outputs.go-version }}
      - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: "~> v2"
          install-only: true
      - run: make snapshot
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
      - name: smoke test
        run: |
          ./dist/dotsync_linux_amd64_v1/dotsync version
          ./dist/dotsync_linux_amd64_v1/dotsync --help
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: snapshot
          path: |
            dist/*.tar.gz
            dist/*.deb
            dist/checksums.txt
          retention-days: 3

  # The .deb as users get it: lintian-clean, installable with apt on supported releases, and
  # served from a signed APT repository built by the same script as the real one.
  deb:
    needs: release-check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: snapshot
          path: dist
      - name: lintian
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq --no-install-recommends lintian
          lintian --display-level ">=pedantic" --fail-on error,warning,pedantic dist/*_amd64.deb
      - name: build a signed APT repository (throwaway key)
        run: |
          export GNUPGHOME="$RUNNER_TEMP/gnupg"
          mkdir -m 0700 "$GNUPGHOME"
          gpg --batch --passphrase '' --quick-gen-key "dotsync CI <ci@invalid>" rsa4096 sign 1d
          APT_SIGNING_KEY=$(gpg --armor --export-secret-keys) packaging/apt/build-repo.sh dist "$RUNNER_TEMP/apt"
      - name: install with apt
        run: |
          for image in ubuntu:22.04 ubuntu:24.04 debian:12 debian:13; do
            echo "::group::$image"
            docker run --rm -v "$RUNNER_TEMP/apt:/repo:ro" "$image" sh -euxc '
              install -d -m 0755 /etc/apt/keyrings
              cp /repo/dotsync.asc /etc/apt/keyrings/dotsync.asc
              sed "s|^URIs: .*|URIs: file:/repo|" /repo/dotsync.sources > /etc/apt/sources.list.d/dotsync.sources
              apt-get update -qq
              DEBIAN_FRONTEND=noninteractive apt-get install -y -qq dotsync
              dotsync version
              test "$(dpkg-query -W -f "\${Status}" dotsync)" = "install ok installed"
              dotsync update --version v0.0.1 2>&1 | grep -q "installed with apt"
              DEBIAN_FRONTEND=noninteractive apt-get remove -y -qq dotsync
              test ! -e /usr/bin/dotsync
            '
            echo "::endgroup::"
          done

  # The Homebrew formula the release publishes, installed from the snapshot archives and
  # checked the way Homebrew checks formulae.
  homebrew:
    needs: release-check
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, ubuntu-latest]
    runs-on: ${{ matrix.os }}
    env:
      HOMEBREW_NO_AUTO_UPDATE: "1"
      HOMEBREW_NO_INSTALL_CLEANUP: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: snapshot
          path: dist
      - name: install, test and audit the formula
        run: |
          if [ "$RUNNER_OS" = Linux ]; then eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"; fi
          set -- dist/dotsync_*_linux_amd64.tar.gz
          version=${1#dist/dotsync_}
          version=${version%_linux_amd64.tar.gz}
          brew tap-new --no-git local/dotsync
          packaging/homebrew/formula.sh "$version" dist/checksums.txt "file://$PWD/dist" \
            > "$(brew --repository local/dotsync)/Formula/dotsync.rb"
          brew install --formula local/dotsync/dotsync
          brew test local/dotsync/dotsync
          brew audit --strict --formula local/dotsync/dotsync
          brew style local/dotsync/dotsync
          dotsync update --version v0.0.1 2>&1 | grep -q "installed with Homebrew"
          test -f "$(brew --prefix)/share/man/man1/dotsync.1.gz"

  # One result for the whole workflow: a single check to require in branch protection, and on
  # dispatched runs (the release PR) a commit status, which the PR shows.
  ok:
    name: ci ok
    if: always()
    needs: [test, minimum-go, lint, fuzz-targets, fuzz, vulncheck, release-check, deb, homebrew]
    runs-on: ubuntu-latest
    permissions:
      statuses: write
    steps:
      - id: result
        env:
          RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          result=success
          for r in $RESULTS; do [ "$r" = success ] || result=failure; done
          echo "result=$result" >> "$GITHUB_OUTPUT"
      - if: github.event_name == 'workflow_dispatch'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: .github/actions
          persist-credentials: false
      - if: github.event_name == 'workflow_dispatch'
        uses: ./.github/actions/commit-status
        with:
          context: ci
          result: ${{ steps.result.outputs.result }}
      - run: test "$RESULT" = success
        env:
          RESULT: ${{ steps.result.outputs.result }}