check.yml

name: check

on:
  pull_request:
    types: [opened, synchronize]
  merge_group:
    types: [checks_requested]
  push:
    # Always run on push to main. The build cache can only be reused
    # if it was saved by a run from the repository's default branch.
    # The run result will be identical to that from the merge queue
    # because the commit is identical, yet we need to perform it to
    # seed the build cache.
    branches:
      - main

jobs:
  lint:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          # Use different schema from regular job, to avoid overwriting the same key
          cache-dependency-path: |
            go.sum
            .golangci.yaml

      - name: Run go mod tidy
        run: go mod tidy

      - name: Fail if go.mod/go.sum changed
        run: git diff --exit-code

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          version: "0.8.9"

      - name: Run Go and Python lint checks (does not include formatting checks)
        # `task lint` runs golangci-lint and `ruff check` (lint-python). ruff is
        # provided by uvx, installed above; formatting is checked by `task fmt` below.
        run: go tool -modfile=tools/task/go.mod task lint

      - name: "task fmt: Python, Go and YAML formatting"
        # `task fmt` runs ruff format (Python) plus Go and YAML formatters; the diff
        # check fails the build if anything was left unformatted.
        run: |
          go tool -modfile=tools/task/go.mod task fmt
          git diff --exit-code

      - name: "task checks: custom checks outside of fmt and lint"
        run: |-
          go tool -modfile=tools/task/go.mod task checks
          git diff --exit-code