ci.yml

# Canonical CI workflow for hawk-eco Go repos.
# Source of truth: .shared-templates/workflows/go-ci.yml.tmpl
#
# Two deployment models:
#
# 1. NOW — render this template inline into each repo's
#    .github/workflows/ci.yml. Every repo has identical content.
#
# 2. LATER — once GrayCodeAI/.github exists as a central repo, move this
#    file to GrayCodeAI/.github/.github/workflows/go-ci.yml with
#    `on: workflow_call:`. Each repo's ci.yml becomes a 5-line caller:
#
#       name: CI
#       on: { push: { branches: [main] }, pull_request: }
#       jobs:
#         ci:
#           uses: GrayCodeAI/.github/.github/workflows/go-ci.yml@main

name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  GO_VERSION: "1.26.4"
  GOPRIVATE: "github.com/GrayCodeAI/*"
  GONOSUMDB: "github.com/GrayCodeAI/*"
  GONOSUMCHECK: "1"

jobs:
  # -------------------------------------------------------------------------
  # Format + vet — fastest, fail fast.
  # -------------------------------------------------------------------------
  fmt-vet:
    name: fmt + vet
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Clone tok (workspace dep)
        run: git clone --depth=1 https://github.com/GrayCodeAI/tok.git ../tok
      - name: Boundary guard
        run: bash ./scripts/check-ecosystem-boundaries.sh
      - name: gofumpt diff
        run: |
          go install mvdan.cc/gofumpt@v0.10.0
          out=$(gofumpt -l .)
          if [ -n "$out" ]; then
            echo "::error::gofumpt would reformat the following files:"
            echo "$out"
            exit 1
          fi
      - name: go vet
        run: go vet ./...

  # -------------------------------------------------------------------------
  # Lint — golangci-lint covers most static checks.
  # -------------------------------------------------------------------------
  lint:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Clone tok (workspace dep)
        run: git clone --depth=1 https://github.com/GrayCodeAI/tok.git ../tok
      - name: Boundary guard
        run: bash ./scripts/check-ecosystem-boundaries.sh
      - uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v7.0.0
        with:
          version: v2.1.0
          install-mode: goinstall
          verify: false
          args: --timeout=5m

  # -------------------------------------------------------------------------
  # Tests with race detector + coverage upload.
  # -------------------------------------------------------------------------
  test:
    name: test (race + cover)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Clone tok (workspace dep)
        run: git clone --depth=1 https://github.com/GrayCodeAI/tok.git ../tok
      - name: Boundary guard
        run: bash ./scripts/check-ecosystem-boundaries.sh
      - name: Tidy check
        run: |
          go mod tidy
          if ! git diff --quiet; then
            echo "::error::go.mod / go.sum out of date — run 'go mod tidy' and commit"
            git diff
            exit 1
          fi
      - name: Test
        run: go test ./... -race -count=1 -shuffle=on -coverprofile=coverage.out -covermode=atomic -timeout=180s
      - name: Coverage summary
        run: go tool cover -func=coverage.out | tail -1
      - name: Coverage threshold
        run: |
          COVERAGE=$(go tool cover -func=coverage.out | tail -1 | grep -oE '[0-9]+\.[0-9]+' || echo "0")
          THRESHOLD=49
          if [ "$(echo "$COVERAGE < $THRESHOLD" | bc -l)" -eq 1 ]; then
            echo "::error::Coverage ${COVERAGE}% is below threshold ${THRESHOLD}%"
            exit 1
          fi
          echo "Coverage ${COVERAGE}% meets threshold ${THRESHOLD}%"
      - name: Upload coverage
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage
          path: coverage.out

  # -------------------------------------------------------------------------
  # Security scan — vulnerability database + (optional) gosec.
  # -------------------------------------------------------------------------
  security:
    name: security
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Clone tok (workspace dep)
        run: git clone --depth=1 https://github.com/GrayCodeAI/tok.git ../tok
      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
          govulncheck ./...
      - name: gosec (advisory)
        continue-on-error: true
        run: |
          go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
          gosec -exclude=G104,G301,G302,G304,G306 ./...

  # -------------------------------------------------------------------------
  # Dead code detection.
  # -------------------------------------------------------------------------
  deadcode:
    name: deadcode
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Clone tok (workspace dep)
        run: git clone --depth=1 https://github.com/GrayCodeAI/tok.git ../tok
      - name: deadcode
        run: |
          go install golang.org/x/tools/cmd/deadcode@v0.30.0
          deadcode ./... 2>&1 | head -50

  # -------------------------------------------------------------------------
  # Duplication detection — jscpd.
  # -------------------------------------------------------------------------
  jscpd:
    name: duplication
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: jscpd
        run: |
          npx jscpd --min-lines 5 --min-tokens 50 --reporters console --blame . 2>&1 | head -50

  # -------------------------------------------------------------------------
  # Fuzz — short corpus runs to catch panics in fuzz targets.
  # -------------------------------------------------------------------------
  fuzz:
    name: fuzz (60s)
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Clone tok (workspace dep)
        run: git clone --depth=1 https://github.com/GrayCodeAI/tok.git ../tok
      - name: Run fuzz targets
        run: |
          go test -fuzz=FuzzContentHash     -fuzztime=60s ./engine/... || true
          go test -fuzz=FuzzExtractEntities -fuzztime=60s ./engine/... || true
          go test -fuzz=FuzzRecallOpts      -fuzztime=60s ./engine/... || true

  # -------------------------------------------------------------------------
  # Cross-platform build matrix — only for repos that produce a binary.
  # Repos that are pure libraries can keep this job (it'll just `go build ./...`)
  # or remove it locally.
  # -------------------------------------------------------------------------
  build:
    name: build (${{ matrix.goos }}/${{ matrix.goarch }})
    runs-on: ubuntu-latest
    needs: [fmt-vet, lint, test]
    strategy:
      fail-fast: false
      matrix:
        goos: [linux, darwin, windows]
        goarch: [amd64, arm64]
        exclude:
          - goos: windows
            goarch: arm64
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Clone tok (workspace dep)
        run: git clone --depth=1 https://github.com/GrayCodeAI/tok.git ../tok
      - name: Build
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "0"
        run: go build ./...