ci.yml

name: CI
on:
  push:
    branches:
      - '**'
      - '!gh-readonly-queue/**'
      - '!integrated/**'
      - '!generated'
      - '!codegen/**'
  pull_request:
  merge_group:
    types:
      - checks_requested
  # The monthly Go version review opens its draft with GITHUB_TOKEN. GitHub
  # requires approval before running pull_request workflows for that draft, so
  # that workflow explicitly dispatches this validation on its generated branch.
  workflow_dispatch:
  # The vulnerability database changes even when this repository does not.
  # This schedule runs only the govulncheck job below; lint and tests remain
  # push-triggered. 10:23 UTC avoids GitHub's busy top-of-hour window.
  schedule:
    - cron: '23 10 * * *'

permissions:
  contents: read

jobs:
  lint:
    timeout-minutes: 10
    name: lint
    runs-on: ubuntu-latest
    # Run on the PR event even for same-repository branches. The stable
    # aggregate check at the bottom cannot safely depend on a separate push
    # workflow run, and every PR should receive the same merge-gating signal.
    if: >-
      github.event_name == 'push' ||
      github.event_name == 'pull_request' ||
      github.event_name == 'merge_group' ||
      github.event_name == 'workflow_dispatch'
    # Prevent Go's automatic toolchain selection from hiding an accidental
    # increase above the minimum declared in go.mod.
    env:
      GOTOOLCHAIN: local

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          persist-credentials: false

      - name: Setup current stable Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          # The lint runner must be built by a Go release at least as new as
          # every release it analyzes. Minimum-version coverage remains in the
          # test matrix below.
          go-version: '1.26.x'
          check-latest: true

      - name: Run lints
        run: ./scripts/lint

      - name: Check go.mod is tidy
        run: ./scripts/check-go-mod
  test:
    timeout-minutes: 15
    name: test (Go ${{ matrix.go-version }})
    runs-on: ubuntu-latest
    if: >-
      github.event_name == 'push' ||
      github.event_name == 'pull_request' ||
      github.event_name == 'merge_group' ||
      github.event_name == 'workflow_dispatch'
    strategy:
      fail-fast: false
      matrix:
        # Test the latest patch in the previous and current stable Go lines.
        # Keep this matrix synchronized with GO_VERSION_POLICY.md. The monthly
        # Codex review proposes both changes together when a Go release lands.
        go-version:
          - '1.25.x'
          - '1.26.x'
    # setup-go installs the selected matrix version first. "local" then stops
    # the go command from silently switching to a newer toolchain.
    env:
      GOTOOLCHAIN: local
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          persist-credentials: false

      - name: Setup go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ matrix.go-version }}
          # A version range can otherwise reuse an older matching toolcache
          # entry immediately after a patched Go release becomes available.
          check-latest: true

      - name: Bootstrap
        env:
          SKIP_BREW: "1"
        run: ./scripts/bootstrap

      - name: Test root module
        run: ./scripts/test

      - name: Test examples module
        working-directory: examples
        run: go test ./...

      - name: Test external consumer
        working-directory: internal/testdata/consumer
        # This nested module catches accidental reliance on internal packages
        # and proves representative core and Azure imports compose externally.
        # readonly also prevents a disposable CI checkout from hiding stale
        # module metadata by rewriting go.mod or go.sum during the test.
        run: go test -mod=readonly ./...

  vulnerability:
    timeout-minutes: 15
    name: govulncheck
    runs-on: ubuntu-latest
    # PR scans catch dependency/call-graph changes. The nightly scan catches
    # newly published advisories against an otherwise unchanged commit.
    if: >-
      github.event_name == 'pull_request' ||
      github.event_name == 'merge_group' ||
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch'
    env:
      GOTOOLCHAIN: local
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          persist-credentials: false

      - name: Setup current stable Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          # Scan with a patched current toolchain so old standard-library
          # findings do not obscure dependency findings. Resolve the range
          # against Go's official feed: its vulnerability database can publish
          # new advisories before setup-go's version mirror lists the fix.
          go-version: '1.26.x'
          check-latest: true
          go-download-base-url: https://go.dev/dl

      - name: Install govulncheck
        # Keep the scanner in its own module so Dependabot can update it without
        # adding development-tool dependencies to SDK users' module graph.
        working-directory: tools
        run: go install golang.org/x/vuln/cmd/govulncheck

      - name: Scan root module
        run: govulncheck ./...

      - name: Scan examples module
        working-directory: examples
        run: govulncheck ./...

  go_version_tests:
    timeout-minutes: 5
    name: test (all supported Go versions)
    runs-on: ubuntu-latest
    if: >-
      always() &&
      (github.event_name == 'pull_request' ||
      github.event_name == 'merge_group' ||
      github.event_name == 'workflow_dispatch')
    needs:
      - test
    steps:
      - name: Require every supported Go version
        env:
          TEST_RESULT: ${{ needs.test.result }}
        run: |
          if [[ "$TEST_RESULT" != "success" ]]; then
            echo "Supported Go version tests ended with: $TEST_RESULT"
            exit 1
          fi