name: CI

on:
  push:
    branches: [main]
  pull_request:

env:
  # Test the module alone, with the versions in go.mod (never a go.work).
  GOWORK: "off"

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      - uses: golangci/golangci-lint-action@v9
        with:
          version: v2.14.0

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      - name: Verify tidy
        run: |
          go mod tidy
          git diff --exit-code -- go.mod go.sum
      - run: go vet ./...
      - name: Static build
        # The runner binary is attached read-only to every sandbox, which has no
        # libc of ours: it must be a static executable (sandbox.CheckStatic
        # refuses anything else at start).
        run: |
          CGO_ENABLED=0 go build -trimpath -o /tmp/ermite-runner .
          file /tmp/ermite-runner | grep -q 'statically linked'
      - name: Protobuf lint and drift
        # buf and protoc-gen-go are pinned as `tool` directives in go.mod: the
        # generated code is reproducible and must match the committed one.
        run: |
          go tool buf lint
          go generate ./internal/execstream
          git diff --exit-code -- internal/execstream/execpb
      - run: go test -race ./...