ci.yml

name: CI

on:
  push:
  pull_request:
    branches: [ master, main, dev ]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test (${{ matrix.os }}, Go ${{ matrix.go-version }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-latest ]
        go-version: [ '1.21.13', '1.26.7' ]
        exclude:
          # Go 1.21's internal linker omits LC_UUID, which current macOS
          # runners require before they will execute test binaries.
          - os: macos-latest
            go-version: '1.21.13'

    steps:
    - name: Checkout repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Go
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: ${{ matrix.go-version }}
        check-latest: true

    - name: Verify dependencies
      run: go mod verify

    - name: Check formatting and module tidiness
      if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.26.7'
      shell: bash
      run: |
        unformatted="$(git ls-files -z '*.go' | xargs -0 gofmt -l)"
        test -z "${unformatted}"
        go mod tidy
        git diff --exit-code -- go.mod go.sum

    - name: Run go vet
      run: go vet ./...

    - name: Run static analysis
      if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.26.7'
      run: go run honnef.co/go/tools/cmd/staticcheck@v0.8.1 ./...

    - name: Run unit tests
      shell: bash
      run: |
        set +e
        test_output="$(go test -v ./... 2>&1)"
        test_status=$?
        printf '%s\n' "${test_output}"
        if [ "${test_status}" -ne 0 ]; then
          diagnostic="$(printf '%s' "${test_output}" | tail -c 8000)"
          diagnostic="${diagnostic//'%'/'%25'}"
          diagnostic="${diagnostic//$'\r'/'%0D'}"
          diagnostic="${diagnostic//$'\n'/'%0A'}"
          echo "::error title=Unit tests failed::${diagnostic}"
          exit "${test_status}"
        fi

    - name: Run race detector
      if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.26.7'
      run: go test -race ./...

    - name: Scan reachable dependencies for vulnerabilities
      if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.26.7'
      run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...

  build:
    name: Cross-Platform Build
    runs-on: ubuntu-latest
    needs: test
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: linux
            goarch: arm
            goarm: 7
          - goos: linux
            goarch: arm
            goarm: 6
          - goos: linux
            goarch: 386
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
          - goos: windows
            goarch: amd64
          - goos: windows
            goarch: arm64
          - goos: windows
            goarch: 386
          - goos: freebsd
            goarch: amd64
    steps:
    - name: Checkout repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Go
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: '1.26.7'

    - name: Build binary
      env:
        GOOS: ${{ matrix.goos }}
        GOARCH: ${{ matrix.goarch }}
        GOARM: ${{ matrix.goarm }}
        CGO_ENABLED: 0
      run: |
        OUTPUT="transmission-telegram-${{ matrix.goos }}-${{ matrix.goarch }}"
        if [ "${{ matrix.goos }}" = "windows" ]; then
          OUTPUT="${OUTPUT}.exe"
        fi
        go build -trimpath -v -o "${OUTPUT}" ./cmd/bot/

  container:
    name: Container Build
    runs-on: ubuntu-latest
    needs: test
    timeout-minutes: 10
    steps:
    - name: Checkout repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Build and inspect container
      shell: bash
      env:
        DOCKER_BUILDKIT: 1
      run: |
        docker build --build-arg VERSION=ci --tag transmission-telegram:ci .
        test "$(docker image inspect --format '{{.Config.User}}' transmission-telegram:ci)" = "1000:1000"
        test "$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.version"}}' transmission-telegram:ci)" = "ci"
        startup_output="$(docker run --rm transmission-telegram:ci 2>&1 || true)"
        grep -F "telegram bot token is required" <<< "${startup_output}"