go_app_pull_requests.yml

name: Pull Request
on:
  workflow_call:
    inputs:
      GH_CI_USER:
        description: 'User for GitHub auth'
        required: true
        type: string
      GOPRIVATE:
        description: 'GOPRIVATE env for go commands'
        required: false
        type: string
      GO_TEST_UNIT_TAGS:
        description: "The tags flag for the unit test go test call. Include -tags flag. Example -tags=unit"
        type: string
        required: false
        default: ""
      GO_TEST_INTEGRATION_ENABLED:
        type: boolean
        default: false
      GO_TEST_INTEGRATION_TAGS:
        description: "The tags flag for the integration test go test call. Include -tags flag. Example -tags=integration"
        type: string
        default: "-tags=integration"
      GO_TEST_INTEGRATION_TIMEOUT:
        description: "The duration before tests are stopped"
        type: string
        default: "10m"
    secrets:
      GH_CI_PAT:
        description: 'Token password for GitHub auth'
        required: true
      CODECOV_TOKEN:
        description: 'Token for Codecov'
        required: true
      ARTIFACT_REGISTRY:
        description: 'Artifact Registry address to which to publish (leave blank to not publish)'
        required: false
      ARTIFACT_REGISTRY_JSON_KEY:
        description: 'Key for publishing to Artifact Registry'
        required: false
env:
  GOPRIVATE: ${{ inputs.GOPRIVATE }}
jobs:
  discover-modules:
    #
    # finds all go modules in the repository
    #
    runs-on: ubuntu-latest
    outputs:
      modules: ${{ steps.set-modules.outputs.modules }}
    steps:
      - uses: actions/checkout@v4
      - name: Find Go modules
        id: set-modules
        run: |
          MODS=$(find . -name vendor -prune -o -name go.mod -print | xargs -n1 dirname | jq -R . | jq -sc .)
          echo "modules=$MODS" >> $GITHUB_OUTPUT
  commitlint:
    #
    # ensures commit messages follow conventional commits
    #
    runs-on: ubuntu-latest
    steps:
      # checkout the commits to lint.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      # setup node, needed to lint commits.
      - uses: actions/setup-node@v1
        with:
          node-version: 18
      # Install needed libraries to lint commits.
      - run: npm install --save-dev @commitlint/{config-conventional@v18.6.0,cli}
      # Lint the commits.
      - run: npx commitlint --from=${{ github.event.pull_request.base.sha }}
  lint:
    #
    # runs golangci-lint
    #
    runs-on: ubuntu-latest
    steps:
      # Checkout code to build (fetch-depth: 0 needed for only-new-issues diff).
      - name: Checkout repo
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      # Setup Go.
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version: 'stable'
      # Use auth to get access to private Git repos for Go code dependencies.
      - name: Configure git for private modules
        env:
          TOKEN: ${{ secrets.GH_CI_PAT }}
          GITHUB_USERNAME: kochava-ci
        run: git config --global url."https://${GITHUB_USERNAME}:${TOKEN}@github.com".insteadOf
          "https://github.com"
      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: latest
          only-new-issues: true
          args: --timeout=10m --enable=bodyclose
  test:
    #
    # ensure go standards and tests pass
    #
    needs: discover-modules
    runs-on: ubuntu-latest
    strategy:
      matrix:
        module: ${{ fromJson(needs.discover-modules.outputs.modules) }}
    steps:
      # Checkout go code to test.
      - name: Checkout repo
        uses: actions/checkout@v6
      # Setup Go.
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version: 'stable'
      # Login to Artifact Registry if configured.
      - name: Login to Artifact Registry
        env:
          ARTIFACT_REGISTRY_JSON_KEY: ${{ secrets.ARTIFACT_REGISTRY_JSON_KEY }}
        if: ${{ env.ARTIFACT_REGISTRY_JSON_KEY }}
        uses: docker/login-action@v2
        with:
          registry: ${{ secrets.ARTIFACT_REGISTRY }}
          username: _json_key
          password: ${{ secrets.ARTIFACT_REGISTRY_JSON_KEY }}
      # Use auth to get access to private Git repos for Go code dependencies.
      - name: Configure git for private modules
        env:
          TOKEN: ${{ secrets.GH_CI_PAT }}
          GITHUB_USERNAME: ${{ inputs.GH_CI_USER }}
        run:
          git config --global url."https://${GITHUB_USERNAME}:${TOKEN}@github.com".insteadOf
          "https://github.com"
      # Vendor Go code needed to build app.
      - name: go mod vendor
        run: go mod vendor
      # Go vet the module.
      - name: go vet
        working-directory: ${{ matrix.module }}
        run: go vet ./...
      # Install go-junit-report to format test results.
      - name: Install go-junit-report
        run: go install github.com/jstemmer/go-junit-report/v2@v2.1.0
      # Build coverage output directories.
      - name: build coverage output directories
        run: |
          mkdir -p ${{ matrix.module }}/coverage/unit
          mkdir -p ${{ matrix.module }}/coverage/int
      # Run unit tests for the module.
      - name: go test
        working-directory: ${{ matrix.module }}
        run: |
          go test -cover --race -v ${{ inputs.GO_TEST_UNIT_TAGS }} ./... \
            -args -test.gocoverdir="${{ github.workspace }}/${{ matrix.module }}/coverage/unit" \
            2>&1 | tee unit_test_output.txt
      - name: Build Unit Test Junit report
        working-directory: ${{ matrix.module }}
        run: go-junit-report -in unit_test_output.txt -set-exit-code > junit_report.xml || true
      - name: Unit Test Report
        uses: dorny/test-reporter@v1
        if: success() || failure()
        with:
          name: Unit Test Report (${{ matrix.module }})
          path: ${{ matrix.module }}/junit_report.xml
          reporter: java-junit
      - name: Upload unit test coverage results to Codecov
        uses: codecov/codecov-action@v5
        with:
          fail_ci_if_error: true # optional (default = false)
          report_type: test_results
          files: ${{ matrix.module }}/junit_report.xml
          name: junit-report-${{ strategy.job-index }}
          token: ${{ secrets.CODECOV_TOKEN }}
      # Integration tests (conditional, per-module)
      - name: integration tests
        if: ${{ inputs.GO_TEST_INTEGRATION_ENABLED }}
        working-directory: ${{ matrix.module }}
        run: |
          go test -v ${{ inputs.GO_TEST_INTEGRATION_TAGS }} -timeout ${{ inputs.GO_TEST_INTEGRATION_TIMEOUT }} ./... \
            | tee integration_test_output.txt
      - name: Build Integration Test Junit report
        if: ${{ inputs.GO_TEST_INTEGRATION_ENABLED }}
        working-directory: ${{ matrix.module }}
        run: go-junit-report -in integration_test_output.txt -set-exit-code > junit_integration_report.xml || true
      - name: Integration Test Report
        uses: dorny/test-reporter@v1
        if: ${{ inputs.GO_TEST_INTEGRATION_ENABLED }}
        with:
          name: Integration Test Report (${{ matrix.module }})
          path: ${{ matrix.module }}/junit_integration_report.xml
          reporter: java-junit
      - name: Upload integration test results to Codecov
        if: ${{ inputs.GO_TEST_INTEGRATION_ENABLED }}
        uses: codecov/codecov-action@v5
        with:
          fail_ci_if_error: true # optional (default = false)
          report_type: test_results
          files: ${{ matrix.module }}/junit_integration_report.xml
          name: junit-integration-report-${{ strategy.job-index }}
          token: ${{ secrets.CODECOV_TOKEN }}
      # Coverage handling
      - name: build coverage.txt
        working-directory: ${{ matrix.module }}
        run: |
          if [ -d coverage/int ] && [ "$(ls -A coverage/int)" ]; then
            go tool covdata textfmt -i=./coverage/int,./coverage/unit -o coverage.txt
          else
            go tool covdata textfmt -i=./coverage/unit -o coverage.txt
          fi
      - name: Upload test coverage results to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          report_type: coverage
          files: ${{ matrix.module }}/coverage.txt
          verbose: true
          fail_ci_if_error: true # optional (default = false)
  docker-build:
    #
    # ensures the docker image will build without pushing to the registry
    # uses the git sha for the most recent commit for the version
    #
    runs-on: ubuntu-latest
    steps:
      # Checkout code to build.
      - name: Checkout repo
        uses: actions/checkout@v6
      # Setup Go.
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version: 'stable'
      # Use auth to get access to private Git repos for Go code dependencies.
      - name: Configure git for private modules
        env:
          TOKEN: ${{ secrets.GH_CI_PAT }}
          GITHUB_USERNAME: ${{ inputs.GH_CI_USER }}
        run: git config --global url."https://${GITHUB_USERNAME}:${TOKEN}@github.com".insteadOf
          "https://github.com"
      # Vendor Go code needed to build app.
      - name: go mod vendor
        run: go mod vendor
      # Setup docker build arguments.
      - name: Docker release meta
        id: release
        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ github.repository }}
          tags: |
            type=sha
      # Setup Docker builder to do build.
      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v2
      # Build the app.
      - name: Build
        uses: docker/build-push-action@v3
        with:
          push: false
          provenance: false
          context: .
          file: Dockerfile
          platforms: linux/amd64
          tags: ${{ steps.release.outputs.tags }}