ci.yml

name: Go Build & Package

on:
  push:
    branches: [ "main" ]
    tags: [ "v*" ]
  pull_request:
    branches: [ "main" ]

jobs:
  test:
    name: Lint, Test, Sec
    runs-on: ubuntu-latest
    container: debian:trixie
    permissions:
      contents: read

    steps:
      - name: Install System Dependencies
        run: |
          apt-get update && apt-get install -y git make curl bash binutils build-essential
          git config --global --add safe.directory '*'

      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'

      # Linting
      - name: GolangCI-Lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: latest

      # Security Scan (Gosec)
      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: ./...

      # Vulnerability Check
      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      # Testing (with race detector)
      - name: Run Tests
        run: |
          go test -v -race -coverprofile=coverage.out ./...
          go tool cover -func=coverage.out
        env:
          CGO_ENABLED: 1

  shellcheck:
    name: Shellcheck
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          version: v0.10.0

  build-and-package:
    name: Build, Deb (${{ matrix.arch }})
    needs: [test, shellcheck]
    runs-on: ubuntu-latest
    container: debian:trixie
    strategy:
      matrix:
        arch: [amd64, arm64]
    permissions:
      contents: read

    steps:
      - name: Install System Dependencies
        run: |
          apt-get update && apt-get install -y git make curl bash binutils build-essential
          git config --global --add safe.directory '*'

      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'

      # Build Binary
      - name: Build Binaries
        run: make build ARCH=${{ matrix.arch }} LDFLAGS="-s -w"

      - name: Determine Version
        id: get_version
        shell: bash
        run: |
          if [[ $GITHUB_REF == refs/tags/v* ]]; then
            # Strip 'refs/tags/v' to get '0.2.0'
            VERSION=${GITHUB_REF#refs/tags/v}
          else
            # Fallback for non-tag builds (e.g. 0.0.0-dev-a1b2c3d)
            VERSION=0.0.0-dev-${GITHUB_SHA::7}
          fi
          echo "VERSION=${VERSION}" >> $GITHUB_ENV

      # Create Deb File
      - name: Package Deb
        run: make deb VERSION=${{ env.VERSION }} ARCH=${{ matrix.arch }}

      # Upload the .deb file when tagged
      - name: Upload Deb Artifact
        uses: actions/upload-artifact@v6
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          name: deb-package-${{ matrix.arch }}
          path: "*.deb"
          if-no-files-found: error

  release:
    name: Release
    needs: build-and-package
    runs-on: ubuntu-latest
    permissions:
      contents: write
      security-events: write
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/download-artifact@v7
        with:
          pattern: deb-package-*
          merge-multiple: true

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          files: "*.deb"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}