ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  gazelle-check:
    name: Gazelle BUILD file check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-bazel-remote
        with:
          buildbuddy-api-key: ${{ secrets.BUILDBUDDY_API_KEY }}
      - run: bazel run --config=ci //:gazelle -- -mode=diff

  go-modules-check:
    name: Go module completeness check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - run: python3 meta/scripts/check_go_modules.py

  go-work-check:
    name: go.work consistency/completeness check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - run: python3 meta/scripts/check_go_work.py

  secrets-check:
    name: Secrets check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - run: python3 meta/scripts/check_secrets_dir.py

  no-cgo-check:
    name: No-cgo policy check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      # `go list -deps` is what surfaces transitive cgo, so the runner needs Go in PATH.
      # Use go.work as the source-of-truth — it's the workspace-level Go version directive
      # and matches the version Bazel installs in MODULE.bazel (per-module go.mod files
      # only declare each module's minimum, which can drift below the workspace version).
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.work
          # This step only runs `go list -deps` via check_no_cgo.py — no `go build`
          # of our code, no `go mod download`. With cache enabled (the default),
          # setup-go searches for go.mod/go.sum at the repo root to build a cache
          # key and warns when it can't find them (this is a Bazel monorepo with
          # per-module go.mod files, none at the root).
          cache: false
      - run: python3 meta/scripts/check_no_cgo.py

  # TEND(lang-expand): this job lints Go only. When a new language is adopted, add a sibling
  # job (e.g. ruff for Python) — do not extend this matrix, the linter is Go-specific.
  golangci-lint:
    name: golangci-lint (${{ matrix.module }})
    runs-on: ubuntu-latest
    needs: [go-modules-check]
    strategy:
      fail-fast: false
      matrix:
        module:
          - tools/network_infrastructure_maintenance
    steps:
      - uses: actions/checkout@v6

      - uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
        with:
          working-directory: ${{ matrix.module }}

  # Build and test runs once per supported target platform, on a runner whose host matches
  # the target. (Running tests natively per platform is the only way (without an emulation
  # layer we do not have) to actually exercise platform-specific code paths and catch regressions
  # early.) A failure on any matrix entry blocks the merge because build-and-test-all is a
  # required status check.
  #
  # If a future supported target lacks a matching GitHub-hosted runner, that entry would
  # build-only (drop `test`); none of our current targets are in that situation.
  build-and-test-per-target:
    name: Build and test (${{ matrix.platform }})
    runs-on: ${{ matrix.runner }}
    needs: [
      gazelle-check,
      go-modules-check,
      go-work-check,
      secrets-check,
      no-cgo-check,
      golangci-lint,
    ]
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux_x86_64
            runner: ubuntu-latest
          - platform: linux_arm64
            runner: ubuntu-24.04-arm
          - platform: darwin_arm64
            runner: macos-latest
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-bazel-remote
        with:
          buildbuddy-api-key: ${{ secrets.BUILDBUDDY_API_KEY }}
      # `--config=ci` brings in remote cache + BES; `--config=<platform>` pins the target
      # platform explicitly. Each row's runner matches its target arch — required for
      # Python (`@pypi` wheel resolution is host-bound; see CLAUDE.md "Python Purity Is
      # Not Enforced"). The matching runner also keeps test execution native: BB
      # executors of the same arch are registered as candidates via `--config=<platform>`,
      # darwin executes on the runner itself since BB has no macOS executors.
      - run: bazel test --config=ci --config=${{ matrix.platform }} //...

  build-and-test-all:
    name: Build and test (all targets)
    runs-on: ubuntu-latest
    needs: [build-and-test-per-target]
    if: always()
    steps:
      - name: Verify all build-and-test-per-target jobs passed
        run: |
          if [ "${{ needs.build-and-test-per-target.result }}" != "success" ]; then
            echo "build-and-test-all result: ${{ needs.build-and-test-per-target.result }}"
            exit 1
          fi
          echo "All build-and-test-per-target jobs passed"

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    needs: [build-and-test-all]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-bazel-remote
        with:
          buildbuddy-api-key: ${{ secrets.BUILDBUDDY_API_KEY }}
      # Coverage-specific flags (--combined_report, --experimental_fetch_all_coverage_outputs,
      # --strategy=CoverageReport=local under :remote_bb) live in .bazelrc under the `coverage`
      # command scope, so `bazel coverage //...` produces an identical report locally and in CI.
      #
      # Coverage runs on a single platform (linux_x86_64) by deliberate choice: it measures
      # source-line coverage, which is platform-independent for pure-Go code without build
      # tags. If we ever introduce platform-conditional code that needs per-target coverage
      # measurement, this job would become a matrix like build-and-test.
      #
      # TEND(lang-expand): `bazel coverage //...` picks up every language whose rules emit
      # coverage (rules_go does automatically; rules_python is wired via
      # `configure_coverage_tool = True` on `python.toolchain` in MODULE.bazel). When adopting
      # a new language, confirm its ruleset is wired into Bazel's coverage collection — e.g.
      # rules_java needs JaCoCo. If coverage output is silently missing for a language,
      # that's the thing to check.
      - run: bazel coverage --config=ci --config=linux_x86_64 //...
      - name: Locate merged lcov
        id: lcov
        run: echo "path=$(bazel info output_path)/_coverage/_coverage_report.dat" >> "$GITHUB_OUTPUT"
      - uses: codecov/codecov-action@v7
        with:
          files: ${{ steps.lcov.outputs.path }}
          disable_search: true
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}