ci.yml

name: CI

permissions:
  contents: read

on:
  pull_request:
    branches: [main]

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9

      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...

      - name: Go Tidy
        run: go mod tidy && git diff --exit-code

      - name: Go Mod Verify
        run: go mod verify

      - name: Build
        run: go build -o /dev/null ./...

      - name: Test
        run: go test -v -count=1 -race -shuffle=on -coverprofile=coverage.txt ./...

      - name: Coverage summary
        run: go tool cover -func=coverage.txt >> "$GITHUB_STEP_SUMMARY"