ci.yml

# CI workflow for nodeup.
#
# Runs on every push to main and every pull request. Three jobs:
#
#   1. lint       — golangci-lint with .golangci.yml + commitlint on the PR
#                   commits. We keep lint separate from test so a lint
#                   flake doesn't hide test results.
#   2. test       — go test ./... across linux/macos/windows matrix with
#                   the race detector and coverage. Coverage is uploaded
#                   to Codecov (if a token is configured).
#   3. build      — go build for every supported GOOS/GOARCH. Catches
#                   platform-specific build errors that the test matrix
#                   would miss (e.g., Windows-only files referencing a
#                   linux-only symbol via a build-tag mistake).
#
# See .github/workflows/release.yml for the tag-triggered release flow.

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  # commitlint-github-action@v5 reads the PR's commit list via the
  # GitHub API; `pull-requests: read` is required for that. Without it
  # the action crashes with "Resource not accessible by integration"
  # (covered by PR #1's lint failure).
  pull-requests: read

# Cancel in-progress runs for the same branch / PR when a new commit
# is pushed. Saves CI minutes.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint (ubuntu)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0 # full history for commitlint

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: '1.24'
          cache: true

      - name: golangci-lint
        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
        with:
          # Pin golangci-lint to a version built against Go >= 1.24.
          # When go.mod's `go` directive advances, bump this accordingly.
          #
          # We track the v2 line (.golangci.yml targets the v2 schema
          # via `version: "2"`). v2.12.2 matches the version Homebrew
          # currently installs, so a contributor's local `make lint`
          # result agrees byte-for-byte with CI. See #62 for why the
          # v1 line was abandoned.
          version: v2.12.2
          args: --timeout=5m

      - name: commitlint
        uses: wagoid/commitlint-github-action@9763196e10f27aef304c9b8b660d31d97fce0f99 # v5
        with:
          # NOTE: input name is camelCase `configFile`, not kebab-case.
          # The wrong name silently falls back to the action's defaults.
          configFile: .commitlintrc.yml
        env:
          # GITHUB_TOKEN is needed for the action to fetch PR commits
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: 'go.mod'
          cache: true

      - name: Run tests
        shell: bash
        run: |
          go test -race \
            -coverprofile coverage.out \
            -covermode atomic \
            ./...

      - name: Upload coverage
        if: matrix.os == 'ubuntu-latest'
        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
        with:
          file: coverage.out
          flags: unittests
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  build:
    name: Build (${{ matrix.goos }}/${{ matrix.goarch }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - { goos: linux,   goarch: amd64 }
          - { goos: linux,   goarch: arm64 }
          - { goos: darwin,  goarch: amd64 }
          - { goos: darwin,  goarch: arm64 }
          - { goos: windows, goarch: amd64 }
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: 'go.mod'
          cache: true

      - name: Build
        shell: bash
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: '0'
        run: |
          mkdir -p dist
          out=dist/nodeup
          if [ "$GOOS" = "windows" ]; then out=dist/nodeup.exe; fi
          go build -trimpath -ldflags "-s -w" -o "$out" ./cmd/nodeup
          ls -la dist/