ci.yml

name: build

on:
  push:
    branches:
    tags:
  pull_request:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: set up go 1.26
        uses: actions/setup-go@v7
        with:
          go-version: "1.26"
        id: go

      - name: set up bun
        uses: oven-sh/setup-bun@v2

      - name: install jq
        run: |
          command -v jq >/dev/null || { sudo apt-get update && sudo apt-get install -y jq; }
          jq --version

      - name: build and test
        run: |
          go test -race -timeout=180s -covermode=atomic -coverprofile=$GITHUB_WORKSPACE/profile.cov_tmp ./...
          grep -v -E "_mock.go|/mocks/" $GITHUB_WORKSPACE/profile.cov_tmp > $GITHUB_WORKSPACE/profile.cov

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: "v2.12.2"

      - name: install goveralls
        run: go install github.com/mattn/goveralls@latest

      - name: submit coverage
        continue-on-error: true
        run: $(go env GOPATH)/bin/goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
        env:
          COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  lint-scripts:
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: validate YAML frontmatter in markdown files
        run: |
          pip install pyyaml
          python3 .github/scripts/validate-frontmatter.py

      - name: validate Codex marketplace manifests
        run: python3 .github/scripts/validate-codex-marketplace.py

      - name: shellcheck
        # pinned: the runner image's shellcheck drifts, and a `shellcheck disable=` written
        # against a newer local version can pass locally and fail here. SC2317 was split into
        # SC2329 in 0.11, so a suppression naming only one code silently breaks on the other.
        # digest-pinned: a docker tag is mutable, and a retag would change the checker
        # silently -- the same failure class the pin exists to prevent.
        # Contributors can reproduce this exact check with the same image.
        run: |
          find . -name '*.sh' -not -path './.git/*' -not -path './vendor/*' -print0 \
            | xargs -0 docker run --rm -v "$PWD":/mnt:ro koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d