ci.yml

name: Test and coverage

on: [push, pull_request]

jobs:
  unit-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6.0.3
        with:
          fetch-depth: 2
      - uses: actions/setup-go@v6.4.0
        with:
          go-version: '1.26'
      - name: Run coverage
        run: go env -w GOTOOLCHAIN=go1.25.0+auto && go test -coverpkg=./... ./... -race -coverprofile=coverage.out -covermode=atomic
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          verbose: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  integration-tests:
    runs-on: ubuntu-latest
    needs: unit-tests
    services:
      vault:
        image: hashicorp/vault:2.0
        ports:
          - 8200:8200
        env:
          VAULT_DEV_ROOT_TOKEN_ID: root-token
          VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
          VAULT_ADDR: http://127.0.0.1:8200
        options: >-
          --cap-add=IPC_LOCK
          --health-cmd="vault status"
          --health-interval=2s
          --health-timeout=5s
          --health-retries=15
          --add-host=host.docker.internal:host-gateway
    steps:
      - uses: actions/checkout@v6.0.3
      - uses: actions/setup-go@v6.4.0
        with:
          go-version: '1.26'
      - name: Wait for Vault to be ready
        run: |
          for i in {1..30}; do
            if curl -s http://127.0.0.1:8200/v1/sys/health | grep -q "initialized"; then
              echo "Vault is ready"
              break
            fi
            echo "Waiting for Vault..."
            sleep 1
          done
      - name: Run integration tests
        env:
          VAULT_ADDR: http://127.0.0.1:8200
          VAULT_TOKEN: root-token
          AUDIT_HOST: host.docker.internal
        run: go env -w GOTOOLCHAIN=go1.25.0+auto && go test -tags=integration -v -race ./...