ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  GOPRIVATE: github.com/splitsecure/

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version: "1.26"
          cache: true
      - uses: golangci/golangci-lint-action@v9
        with:
          version: v2.10
          skip-cache: true

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version: "1.26"
          cache: true
      - run: make test

  docs:
    name: Check Generated Docs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version: "1.26"
          cache: true
      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_wrapper: false
      - run: make check-docs

  release-dryrun:
    # Exercises the goreleaser pipeline end-to-end on main only so
    # config breakage (missing artifacts, name template typos, manifest
    # path) surfaces before we cut a real tag, without paying the
    # ~5-minute matrix-build cost on every PR. --snapshot uses a
    # synthetic version; --skip=sign,publish skips GPG and the GitHub
    # release so no secrets or write perms are required.
    name: Release Dry Run
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v6
        with:
          go-version: "1.26"
          cache: true
      - name: Run GoReleaser (snapshot)
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          args: release --snapshot --clean --skip=sign,publish