name: build
concurrency:
  group: ${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true
on:
  push:
    branches:
      - "main"
  pull_request:
    paths:
      - "go.*"
      - "**/*.go"
      - "**/*.golden"
      - "Taskfile.yml"
      - "Dockerfile"
      - ".github/workflows/*.yml"
      # XXX: these dirs might have yml, txt, and golden files that when changed
      # need to trigger CI as well
      - "cmd/**/*"
      - "pkg/**/*"
      - "internal/**/*"
permissions:
  contents: read
jobs:
  license-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: stable
      - uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - run: task licenses:check
  semgrep:
    uses: caarlos0/meta/.github/workflows/semgrep.yml@c7f17af352dac91fa6c785d06ebac8547f1abdd3 # v0.1.0
  ruleguard:
    uses: caarlos0/meta/.github/workflows/ruleguard.yml@c7f17af352dac91fa6c785d06ebac8547f1abdd3 # v0.1.0
    with:
      args: "-disable largeloopcopy"
  test:
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    env:
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    steps:
      - run: df -h
        if: matrix.os == 'ubuntu-latest'
      - name: "node-cleanup"
        # this should increase free space from ~21gb to ~38gb
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
          sudo docker image prune --all --force
          sudo docker builder prune -a
      - run: df -h
        if: matrix.os == 'ubuntu-latest'
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
        if: matrix.os == 'ubuntu-latest'
      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        if: matrix.os == 'ubuntu-latest'
        with:
          driver-opts: network=host
      - name: setup-snapcraft
        if: matrix.os == 'ubuntu-latest'
        run: sudo snap install snapcraft --classic
      - uses: crazy-max/ghaction-upx@c83f378efc804f828e988debb88ed6116feb2368 # v4.0.0
        with:
          install-only: true
      - name: setup-makeself-flatpak
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt update -q
          sudo apt install -yq makeself flatpak flatpak-builder
          sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
          sudo flatpak install -y --noninteractive flathub org.freedesktop.Platform/x86_64/24.08 org.freedesktop.Sdk/x86_64/24.08 org.freedesktop.Platform/aarch64/24.08 org.freedesktop.Sdk/aarch64/24.08
      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
        if: matrix.os == 'ubuntu-latest'
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}
      - run: nix profile add nixpkgs#pkgs.nixfmt nixpkgs#alejandra
        if: matrix.os == 'ubuntu-latest'
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
      - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
      - uses: cargo-bins/cargo-binstall@dc19f1e48450eefe5a29b8da6c6b00a87d730b37 # v1.18.1
      - name: setup-cargo
        run: |
          rustup default stable
          cargo binstall cargo-zigbuild
      - uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1.4.1
      - if: matrix.os == 'windows-latest'
        run: 'echo "C:\Users\runneradmin\.local\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append'
      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
        with:
          cosign-release: "v3.0.3"
      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
      - run: task setup
      - run: task build
      - run: task test
      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        if: matrix.os == 'ubuntu-latest'
        with:
          file: ./coverage.txt
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      - run: git diff
        if: ${{ always() }}
      - run: df -h
        if: ${{ always() && matrix.os == 'ubuntu-latest' }}
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - run: go run . check
