ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # Graphite CI optimization: skip redundant CI runs for stacked PRs.
  # See https://graphite.com/docs/stacking-and-ci
  optimize_ci:
    runs-on: ubuntu-latest
    continue-on-error: true
    outputs:
      skip: ${{ steps.check_skip.outputs.skip }}
    steps:
      - name: Optimize CI
        id: check_skip
        uses: withgraphite/graphite-ci-action@26bc0dcdeaba101794931d67a464ecbb21a76a8b # v0.0.9 tag (no formal releases)
        with:
          graphite_token: ${{ secrets.GRAPHITE_CI_OPTIMIZER_TOKEN }}

  # Detect which files changed so PRs skip irrelevant jobs. For merge_group and
  # push events every filter defaults to 'true', so the merge queue and post-merge
  # always run the full suite (a stale generated artifact must never merge because
  # its check was skipped, as happened when the library subcommands merged).
  detect-changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      go: ${{ github.event_name != 'pull_request' || steps.filter.outputs.go == 'true' || steps.filter.outputs.ci == 'true' }}
      scripts: ${{ github.event_name != 'pull_request' || steps.filter.outputs.scripts == 'true' || steps.filter.outputs.ci == 'true' }}
    steps:
      - name: Checkout (needed for non-PR events)
        if: github.event_name != 'pull_request'
        uses: actions/checkout@v7
      - name: Detect changed files
        uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            ci:
              - '.github/workflows/ci.yml'
              - '.github/scripts/**'
            go:
              - '**/*.go'
              - 'go.mod'
              - 'go.sum'
              - 'Makefile'
              - '.goreleaser*.yaml'
              - 'resources/**'
              - 'package/**'
              - 'config/**'
              - 'weaver/**'
              - 'generator/**/data_library/**'
            scripts:
              - 'scripts/**'
              - 'package/scripts/**'
              - '.github/scripts/**'

  shellcheck:
    name: ShellCheck
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.scripts == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Run ShellCheck (package/scripts)
        run: |
          find package/scripts -type f -name "*.sh" -exec shellcheck {} +

      - name: Run ShellCheck (scripts)
        run: |
          find scripts -type f -name "*.sh" -exec shellcheck {} +

  setup:
    name: Setup environment
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Download dependencies
        run: |
          go env
          bash .github/scripts/retry.sh go mod download

      - name: Install tools
        run: |
          bash .github/scripts/retry.sh make install-tools

  test:
    name: Test
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes, setup]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Run tests (race detector)
        env:
          CGO_ENABLED: "1"
        run: |
          make test-race

      - name: Run embedded-library tests
        run: |
          make test-embedded

  gosec:
    name: Gosec
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes, setup]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Run gosec
        run: |
          make security

  revive:
    name: Revive
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes, setup]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Run revive
        run: |
          make lint

      - name: Check for global-logger usage
        run: |
          make lint-global-logger

  build:
    name: Build - ${{ matrix.goos }}/${{ matrix.goarch }}
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes, setup]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: freebsd
            goarch: amd64
          - goos: freebsd
            goarch: arm64
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
          - goos: windows
            goarch: amd64
          - goos: windows
            goarch: arm64
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      # Only the linux legs build container images (the goreleaser dockers are
      # linux/amd64 and linux/arm64), so QEMU/buildx are set up only there. The
      # freebsd/darwin/windows legs cross-compile binaries only, so they no
      # longer pull from Docker Hub at all, which removes the transient-pull
      # failure they used to hit (PIPE-1092). On the linux legs the QEMU and
      # buildkit images are pre-pulled with retry and pinned, so a transient
      # Docker Hub blip during setup no longer fails the build.
      - name: Pre-pull buildx base images (retry transient Docker Hub pulls)
        if: matrix.goos == 'linux'
        run: |
          bash .github/scripts/retry.sh docker pull tonistiigi/binfmt:latest
          bash .github/scripts/retry.sh docker pull moby/buildkit:buildx-stable-1

      - name: Set up Docker Buildx
        if: matrix.goos == 'linux'
        id: buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver-opts: image=moby/buildkit:buildx-stable-1

      - name: Set up QEMU
        if: matrix.goos == 'linux'
        uses: docker/setup-qemu-action@v4
        with:
          image: tonistiigi/binfmt:latest

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Set build host platform
        run: |
          echo "BUILD_HOST_OS=$(go env GOHOSTOS)" >> $GITHUB_ENV
          echo "BUILD_HOST_ARCH=$(go env GOHOSTARCH)" >> $GITHUB_ENV

      - name: Run GoReleaser (split)
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser-pro
          version: "v2.12.5"
          args: release --clean --skip=publish --skip=sign --skip=validate --snapshot --split
        env:
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          BUILD_HOST_OS: ${{ env.BUILD_HOST_OS }}
          BUILD_HOST_ARCH: ${{ env.BUILD_HOST_ARCH }}
          GGOOS: ${{ matrix.goos }}
          GGOARCH: ${{ matrix.goarch }}

      - name: Upload dist artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dist-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/
          retention-days: 1

  merge-build:
    name: Merge Build
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes, setup, build]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    env:
      cinc_package: https://packages.cinc.sh/files/stable/cinc-auditor/4.56.58/ubuntu/22.04/cinc-auditor_4.56.58-1_amd64.deb
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      # Pre-pull the QEMU/buildkit images with retry so a transient Docker Hub
      # blip during buildx/QEMU setup doesn't fail the merge build (PIPE-1092).
      # The images are pinned to match what the setup actions request below.
      - name: Pre-pull buildx base images (retry transient Docker Hub pulls)
        run: |
          bash .github/scripts/retry.sh docker pull tonistiigi/binfmt:latest
          bash .github/scripts/retry.sh docker pull moby/buildkit:buildx-stable-1

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver-opts: image=moby/buildkit:buildx-stable-1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        with:
          image: tonistiigi/binfmt:latest

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Set build host platform
        run: |
          echo "BUILD_HOST_OS=$(go env GOHOSTOS)" >> $GITHUB_ENV
          echo "BUILD_HOST_ARCH=$(go env GOHOSTARCH)" >> $GITHUB_ENV

      - name: Download dist artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: dist-*
          merge-multiple: true
          path: dist/

      - name: Run GoReleaser (merge)
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser-pro
          version: "v2.12.5"
          args: continue --merge --skip=publish --skip=sign --skip=validate
        env:
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          BUILD_HOST_OS: ${{ env.BUILD_HOST_OS }}
          BUILD_HOST_ARCH: ${{ env.BUILD_HOST_ARCH }}

      - name: Prepare CINC directory
        run: mkdir -p /tmp/cinc

      - name: Cache CINC package
        id: cache-cinc
        uses: actions/cache@v6
        with:
          path: /tmp/cinc/cinc.deb
          key: cinc-auditor-4.56.58

      - name: Download CINC (Inspec)
        if: steps.cache-cinc.outputs.cache-hit != 'true'
        run: |
          curl -fsSL --retry 3 --retry-delay 5 --retry-connrefused -o /tmp/cinc/cinc.deb "$cinc_package"

      - name: Install CINC
        run: |
          sudo apt-get -o Acquire::Retries=3 update
          sudo apt-get -o Acquire::Retries=3 install -y -f /tmp/cinc/cinc.deb

      - name: Install package
        run: sudo apt-get install -y -f ./dist/linux_amd64/blitz_amd64.deb

      - name: Start service
        run: sudo systemctl start blitz

      - name: Run install tests
        run: |
          sudo cinc-auditor exec package/inspec/install/package.rb

      - name: Uninstall package
        run: |
          sudo apt-get remove -y blitz

      - name: Run uninstall tests
        run: |
          sudo cinc-auditor exec package/inspec/remove/package.rb

  man-check:
    name: Man pages
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes, setup]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Generate and verify man pages
        run: |
          make man-check

  completion-check:
    name: Shell completion (bash, zsh)
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes, setup]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Generate and verify completion scripts
        run: |
          make completion-check

  generate-o11y-check:
    name: Generated metrics
    runs-on: ubuntu-latest
    needs: [optimize_ci, detect-changes, setup]
    if: ${{ needs.optimize_ci.outputs.skip != 'true' && needs.detect-changes.outputs.go == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Generate and verify metric code
        run: |
          make generate-o11y-check