ci.yml

name: CI

on:
  push:
    branches: ["main"]
  pull_request:
  workflow_dispatch:
  schedule:
    # Nightly cache-bypass run to detect toolchain/cache drift.
    - cron: "17 9 * * *"

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

env:
  GOTOOLCHAIN: go1.26.2
  TOOLS_BIN: ${{ github.workspace }}/.cache/tools/bin
  DISABLE_TOOL_CACHE: ${{ github.event_name == 'schedule' && 'true' || 'false' }}
  GOLANGCI_LINT_VERSION: v2.11.3
  STATICCHECK_VERSION: v0.6.1
  GOSEC_VERSION: v2.23.0
  GOVULNCHECK_VERSION: v1.1.4

jobs:
  proto-lint:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Buf
        uses: bufbuild/buf-action@v1
        with:
          setup_only: true

      - name: Run buf lint
        run: buf lint

  test:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Vet
        run: go vet ./...

      - name: Race tests
        run: go test ./... -race -count=1

      - name: Coverage
        env:
          MIN_COVERAGE: "75"
        run: |
          go test ./... -covermode=atomic -coverprofile=coverage.out
          {
            head -n 1 coverage.out
            tail -n +2 coverage.out | grep -Ev '(^|/).*(\.pb|\.connect)\.go:'
          } > coverage.filtered.out
          mv coverage.filtered.out coverage.out
          coverage_report="$(go tool cover -func=coverage.out)"
          echo "$coverage_report"
          total="$(printf '%s\n' "$coverage_report" | awk '/^total:/ {gsub(/%/, "", $3); print $3}')"
          echo "Total coverage: ${total}% (minimum: ${MIN_COVERAGE}%)"
          awk -v got="$total" -v min="$MIN_COVERAGE" 'BEGIN { if (got+0 < min+0) { printf("coverage %.1f%% is below minimum %.1f%%\n", got, min); exit 1 } }'

      - name: Upload coverage profile
        uses: actions/upload-artifact@v7
        with:
          name: coverage-profile
          path: coverage.out

  golangci-lint:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          args: --timeout=5m ./...

  staticcheck:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Restore tool cache
        if: env.DISABLE_TOOL_CACHE != 'true'
        id: staticcheck-cache
        uses: actions/cache@v5
        with:
          path: ${{ env.TOOLS_BIN }}
          key: staticcheck-${{ runner.os }}-${{ env.GOTOOLCHAIN }}-${{ env.STATICCHECK_VERSION }}

      - name: Install staticcheck (no cache)
        if: env.DISABLE_TOOL_CACHE == 'true'
        run: |
          mkdir -p "${TOOLS_BIN}"
          GOBIN="${TOOLS_BIN}" go install honnef.co/go/tools/cmd/staticcheck@${STATICCHECK_VERSION}

      - name: Install staticcheck (cache miss)
        if: env.DISABLE_TOOL_CACHE != 'true' && steps.staticcheck-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p "${TOOLS_BIN}"
          GOBIN="${TOOLS_BIN}" go install honnef.co/go/tools/cmd/staticcheck@${STATICCHECK_VERSION}

      - name: Run staticcheck
        run: |
          "${TOOLS_BIN}/staticcheck" ./...

  openapi-contract:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Verify admin OpenAPI contract
        run: go test ./cmd/tap -run TestAdminOpenAPIContractMatchesRuntime -count=1

  config-lint:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Setup Helm
        uses: azure/setup-helm@v4

      - name: Install yq
        run: |
          set -euo pipefail
          YQ_VERSION="v4.46.1"
          curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" -o yq
          chmod +x yq
          sudo install -m 0755 yq /usr/local/bin/yq
          yq --version

      - name: Lint runtime config surfaces
        run: ./scripts/lint-config.sh

      - name: Assert Helm render hardening
        run: ./scripts/assert-chart-render.sh

  docker-build:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Build image
        uses: evalops/service-runtime/.github/actions/build-docker-image@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          dockerfile: ./Dockerfile
          tags: siphon:ci

  helm-lint:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Helm
        uses: azure/setup-helm@v4

      - name: Lint Chart
        run: helm lint charts/siphon

      - name: Render Chart
        run: helm template siphon charts/siphon >/dev/null

  security-gosec:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Restore tool cache
        if: env.DISABLE_TOOL_CACHE != 'true'
        id: gosec-cache
        uses: actions/cache@v5
        with:
          path: ${{ env.TOOLS_BIN }}
          key: gosec-${{ runner.os }}-${{ env.GOTOOLCHAIN }}-${{ env.GOSEC_VERSION }}

      - name: Install gosec (no cache)
        if: env.DISABLE_TOOL_CACHE == 'true'
        run: |
          mkdir -p "${TOOLS_BIN}"
          GOBIN="${TOOLS_BIN}" go install github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION}

      - name: Install gosec (cache miss)
        if: env.DISABLE_TOOL_CACHE != 'true' && steps.gosec-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p "${TOOLS_BIN}"
          GOBIN="${TOOLS_BIN}" go install github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION}

      - name: Run gosec
        run: |
          "${TOOLS_BIN}/gosec" -exclude=G117 -exclude-dir=proto ./...

  security-govulncheck:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Restore tool cache
        if: env.DISABLE_TOOL_CACHE != 'true'
        id: govulncheck-cache
        uses: actions/cache@v5
        with:
          path: ${{ env.TOOLS_BIN }}
          key: govulncheck-${{ runner.os }}-${{ env.GOTOOLCHAIN }}-${{ env.GOVULNCHECK_VERSION }}

      - name: Install govulncheck (no cache)
        if: env.DISABLE_TOOL_CACHE == 'true'
        run: |
          mkdir -p "${TOOLS_BIN}"
          GOBIN="${TOOLS_BIN}" go install golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}

      - name: Install govulncheck (cache miss)
        if: env.DISABLE_TOOL_CACHE != 'true' && steps.govulncheck-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p "${TOOLS_BIN}"
          GOBIN="${TOOLS_BIN}" go install golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}

      - name: Run govulncheck
        run: |
          GOTOOLCHAIN="${GOTOOLCHAIN}" go build -o ./bin/siphon ./cmd/tap
          "${TOOLS_BIN}/govulncheck" -mode=binary ./bin/siphon

  security-trivy:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    env:
      TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Trivy filesystem scan
        uses: aquasecurity/trivy-action@v0.35.0
        with:
          scan-type: fs
          scan-ref: .
          severity: CRITICAL
          ignore-unfixed: true
          cache: 'true'
          version: v0.69.3
          exit-code: '1'

  security-sbom:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Generate source SBOM
        uses: anchore/sbom-action@v0
        with:
          path: .
          format: spdx-json
          output-file: sbom-source.spdx.json

      - name: Upload source SBOM
        uses: actions/upload-artifact@v7
        with:
          name: source-sbom
          path: sbom-source.spdx.json

  perf-smoke:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 20
    env:
      TAP_SERVER_PORT: "18080"
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Setup k6
        uses: grafana/setup-k6-action@v1

      - name: Start NATS
        run: docker run -d --name tap-nats -p 4222:4222 nats:2.12.4-alpine -js

      - name: Wait for NATS
        run: |
          for _ in $(seq 1 30); do
            if (echo >/dev/tcp/127.0.0.1/4222) >/dev/null 2>&1; then
              exit 0
            fi
            sleep 1
          done
          echo "nats failed to become ready" >&2
          docker logs tap-nats >&2 || true
          exit 1

      - name: Build tap
        run: go build -o ./bin/siphon ./cmd/tap

      - name: Start tap
        run: |
          ./bin/siphon -config .github/perf/config.yaml > /tmp/tap.log 2>&1 &
          echo $! > /tmp/tap.pid

      - name: Wait for readiness
        run: |
          for _ in $(seq 1 60); do
            if curl -fsS "http://127.0.0.1:${TAP_SERVER_PORT}/readyz" >/dev/null; then
              exit 0
            fi
            if [ -f /tmp/tap.pid ] && ! kill -0 "$(cat /tmp/tap.pid)" 2>/dev/null; then
              echo "tap process exited before readiness" >&2
              cat /tmp/tap.log >&2 || true
              exit 1
            fi
            sleep 1
          done
          echo "tap failed to become ready" >&2
          cat /tmp/tap.log >&2 || true
          exit 1

      - name: Run k6 smoke
        env:
          BASE_URL: http://127.0.0.1:${{ env.TAP_SERVER_PORT }}
          K6_VUS: "20"
          K6_DURATION: 30s
        run: k6 run .github/perf/smoke.js

      - name: Dump logs on failure
        if: failure()
        run: |
          cat /tmp/tap.log || true
          docker logs tap-nats || true

      - name: Stop tap + NATS
        if: always()
        run: |
          if [ -f /tmp/tap.pid ]; then
            kill "$(cat /tmp/tap.pid)" || true
          fi
          docker rm -f tap-nats || true

  integration:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: evalops/service-runtime/.github/actions/setup-go-service@e9e24df11fe3162fba91fbc7d138ca43496bbd27
        with:
          go-version: "1.26.2"
          download: "false"

      - name: Run secure NATS TLS/auth integration tests
        run: go test ./internal/publish -run 'TestNATSPublisherPublishesWith(TokenAuthOverTLS|UserPassOverTLS)' -count=1

      - name: Start NATS + ClickHouse
        run: |
          docker run -d --name tap-nats -p 4222:4222 -p 8222:8222 nats:2.12.4-alpine -js
          docker run -d --name tap-clickhouse -p 8123:8123 -p 9000:9000 clickhouse/clickhouse-server:24

      - name: Wait for services
        run: |
          wait_for_port() {
            local host="$1"
            local port="$2"
            local timeout="$3"
            for i in $(seq 1 "$timeout"); do
              (echo >"/dev/tcp/$host/$port") >/dev/null 2>&1 && return 0
              sleep 1
            done
            return 1
          }

          wait_for_http() {
            local url="$1"
            local timeout="$2"
            for i in $(seq 1 "$timeout"); do
              curl -fsS "$url" >/dev/null && return 0
              sleep 1
            done
            return 1
          }

          wait_for_port 127.0.0.1 4222 60
          wait_for_http http://127.0.0.1:8123/ping 60

      - name: Run Real Integration Test
        env:
          NATS_URL: nats://127.0.0.1:4222
          CLICKHOUSE_ADDR: 127.0.0.1:9000
        run: go test -tags=integration ./internal/publish -run TestRealNATSClickHousePipeline -count=1

      - name: Dump container logs on failure
        if: failure()
        run: |
          docker logs tap-nats || true
          docker logs tap-clickhouse || true

      - name: Stop containers
        if: always()
        run: |
          docker rm -f tap-nats tap-clickhouse || true

  flake-tracker:
    if: always()
    needs:
      - integration
      - perf-smoke
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      actions: read
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Collect CI flake metrics
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          RUN_ID: ${{ github.run_id }}
          BRANCH: main
          TREND_RUN_LIMIT: "30"
        run: .github/scripts/collect_flake_metrics.sh

      - name: Upload flake metrics artifact
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: ci-flake-metrics-${{ github.run_id }}
          path: flake-metrics/
          if-no-files-found: error
          retention-days: 30

  create-failure-issue:
    if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/main' && contains(needs.*.result, 'failure') }}
    needs:
      - proto-lint
      - test
      - golangci-lint
      - staticcheck
      - openapi-contract
      - config-lint
      - docker-build
      - helm-lint
      - security-gosec
      - security-govulncheck
      - security-trivy
      - security-sbom
      - perf-smoke
      - integration
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      actions: read
      contents: read
      issues: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Create issue with failed logs
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          RUN_ID: ${{ github.run_id }}
        run: .github/scripts/create_ci_failure_issue.sh