pranshuparmar--witr/.github/workflows/pr-check.yml

name: PR Check

on:
  pull_request:
    types: [opened, synchronize, reopened, edited]
  push:
    branches:
      - main
      - staging

permissions: read-all

jobs:

  lint:
    name: "Code Quality: Format"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          check-latest: true

      - name: Verify formatting
        run: |
          if [ -n "$(find . -name "*.go" -not -path "./vendor/*" | xargs gofmt -l)" ]; then
            echo "Go code is not formatted:"
            find . -name "*.go" -not -path "./vendor/*" | xargs gofmt -d
            exit 1
          fi

  golangci-lint:
    name: "Code Quality: Lint (${{ matrix.goos }})"
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        goos: [linux, darwin, windows, freebsd]
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          check-latest: true

      # Lint each platform's build tags in turn. Without this, _windows/_darwin/
      # _freebsd files are skipped under the default GOOS=linux and never analyzed.
      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.12.2
        env:
          GOOS: ${{ matrix.goos }}

  govulncheck:
    name: "Security: Vulnerability Scan"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          check-latest: true

      - name: Run govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

  vendor:
    name: "Code Quality: Vendor"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          check-latest: true

      - name: Verify vendor is in sync
        run: |
          go mod vendor
          git diff --exit-code -- vendor go.mod go.sum

  test:
    name: "Tests: Unit (${{ matrix.os }})"
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            race: true
          - os: ubuntu-24.04-arm
            race: true
          - os: macos-latest
            race: true
          - os: windows-latest
            race: false
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          check-latest: true

      - name: Run tests
        shell: bash
        run: |
          if [ "${{ matrix.race }}" = "true" ]; then
            go test -race ./...
          else
            go test ./...
          fi

  coverage:
    name: "Code Quality: Coverage"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          check-latest: true

      # Reports total coverage of the linux build; informational, no threshold gate.
      - name: Measure coverage
        run: |
          go test -covermode=atomic -coverprofile=coverage.out ./...
          go tool cover -func=coverage.out
          {
            echo "### Test coverage (linux build)"
            echo '```'
            go tool cover -func=coverage.out | tail -1
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"