go-ci.yaml

# Copyright (c) 2026 Peaceful Studio OÜ
# SPDX-License-Identifier: Apache-2.0

name: Go CI

on:
  workflow_call:
    inputs:
      go-version:
        description: Go toolchain version passed to actions/setup-go.
        required: false
        type: string
        default: 'stable'
      module-paths:
        description: >-
          Space-separated list of directories to search for go.mod files.
          Each directory is passed verbatim to `find`; missing directories are
          silently ignored.
        required: false
        type: string
        default: 'go cli'
      test-packages:
        description: >-
          Go package pattern passed to `go test` and `go build` (e.g.
          `./...` or `./internal/...`). Use a narrower pattern to exclude
          packages that have no unit tests by design — for example, a
          terraform-provider's root `main.go` (driven by acceptance tests
          under TF_ACC=1) appears as a 0% row in the coverage table
          otherwise. Default `./...` preserves existing behavior.
        required: false
        type: string
        default: './...'
      golangci-lint-version:
        description: >-
          Version selector for `go install <module>@<version>`. Values starting
          with `v2` install from `github.com/golangci/golangci-lint/v2/cmd/golangci-lint`
          (required for golangci-lint v2 config files); anything else installs
          from `github.com/golangci/golangci-lint/cmd/golangci-lint` (v1). Pin a
          tag (e.g. `v1.61.0` or `v2.12.2`) for reproducible runs.
        required: false
        type: string
        default: 'latest'
      coverage-title:
        description: >-
          Heading prepended to the rendered coverage report so a reader
          can tell the language at a glance when multiple coverage
          sticky comments coexist on the same PR. Rendered as a
          markdown H2. Note: `coverage-pr-comment-header` is an
          HTML-comment dedup key only, never visible — no doubling on
          the rendered comment.
        required: false
        type: string
        default: 'Go coverage'
      runs-on:
        description: >-
          Runner label(s) for all jobs. Pass a plain label (e.g.
          'ubuntu-latest' or 'hetzner') or a JSON array string to require
          multiple labels (e.g. '["self-hosted", "hetzner"]'). When empty,
          the runner defaults by repository visibility: public repos use
          ubuntu-latest; private and internal repos use the self-hosted
          Hetzner pool (`["self-hosted","hetzner"]`).
        required: false
        type: string
        default: ''

jobs:
  resolve-runner:
    name: resolve runner
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      runner: ${{ steps.pick.outputs.runner }}
    steps:
      - name: Checkout CI helpers
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: peacefulstudio/github-actions
          ref: ${{ job.workflow_sha }}
          path: .github-actions-helpers
      - name: Pick runner
        id: pick
        env:
          GH_TOKEN: ${{ github.token }}
          RUNS_ON: ${{ inputs.runs-on }}
        run: |
          set -euo pipefail
          visibility=""
          if [ -z "$RUNS_ON" ]; then
            visibility=$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.visibility')
          fi
          runner=$(.github-actions-helpers/scripts/resolve-runner.sh "$RUNS_ON" "$visibility")
          {
            echo "runner<<__RUNNER_EOF__"
            echo "$runner"
            echo "__RUNNER_EOF__"
          } >> "$GITHUB_OUTPUT"

  build-and-test:
    needs: resolve-runner
    runs-on: ${{ startsWith(needs.resolve-runner.outputs.runner, '[') && fromJSON(needs.resolve-runner.outputs.runner) || needs.resolve-runner.outputs.runner }}
    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ inputs.go-version }}

      - name: Discover Go modules
        id: discover
        env:
          MODULE_PATHS: ${{ inputs.module-paths }}
        run: |
          set -euo pipefail
          read -r -a paths <<<"$MODULE_PATHS"
          existing=()
          for p in "${paths[@]}"; do
            [ -d "$p" ] && existing+=("$p")
          done
          if [ ${#existing[@]} -eq 0 ]; then
            echo "None of the configured module paths exist: $MODULE_PATHS"
            echo "found=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          mods=$(find "${existing[@]}" -name go.mod -not -path '*/.git/*' -print0 | xargs -0 -n1 dirname | sort -u)
          if [ -z "$mods" ]; then
            echo "No go.mod files found under: ${existing[*]}"
            echo "found=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "Found modules:"
          awk '{print "  " $0}' <<<"$mods"
          {
            echo "found=true"
            echo "modules<<EOF"
            echo "$mods"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Build
        if: steps.discover.outputs.found == 'true'
        env:
          MODULES: ${{ steps.discover.outputs.modules }}
          TEST_PACKAGES: ${{ inputs.test-packages }}
        run: |
          set -euo pipefail
          while IFS= read -r mod; do
            [ -z "$mod" ] && continue
            echo "::group::build $mod"
            (cd "$mod" && go build "$TEST_PACKAGES")
            echo "::endgroup::"
          done <<< "$MODULES"

      - name: Test with coverage
        if: steps.discover.outputs.found == 'true'
        env:
          MODULES: ${{ steps.discover.outputs.modules }}
          TEST_PACKAGES: ${{ inputs.test-packages }}
        run: |
          set -euo pipefail
          mkdir -p "$GITHUB_WORKSPACE/coverage"
          while IFS= read -r mod; do
            [ -z "$mod" ] && continue
            safe=$(echo "$mod" | tr '/' '_')
            echo "::group::test $mod"
            (cd "$mod" && go test -v -race -covermode=atomic -coverprofile="$GITHUB_WORKSPACE/coverage/$safe.out" "$TEST_PACKAGES")
            echo "::endgroup::"
          done <<< "$MODULES"

      - name: Convert coverage to Cobertura
        if: steps.discover.outputs.found == 'true'
        env:
          MODULES: ${{ steps.discover.outputs.modules }}
        run: |
          set -euo pipefail
          go install github.com/boumenot/gocover-cobertura@v1.4.0
          mkdir -p coverage/merged
          while IFS= read -r mod; do
            [ -z "$mod" ] && continue
            safe=$(echo "$mod" | tr '/' '_')
            echo "::group::cobertura $mod"
            (cd "$mod" && gocover-cobertura < "$GITHUB_WORKSPACE/coverage/$safe.out" > "$GITHUB_WORKSPACE/coverage/merged/$safe.xml")
            echo "::endgroup::"
          done <<< "$MODULES"

      - name: Code Coverage Summary Report
        if: steps.discover.outputs.found == 'true'
        uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0
        with:
          filename: 'coverage/merged/*.xml'
          badge: true
          format: 'markdown'
          output: 'both'

      - name: Augment coverage report with cyclomatic complexity
        if: steps.discover.outputs.found == 'true'
        env:
          MODULES: ${{ steps.discover.outputs.modules }}
        run: |
          set -euo pipefail
          if [ ! -f code-coverage-results.md ]; then
            echo "::error::CodeCoverageSummary did not produce code-coverage-results.md"
            exit 1
          fi
          # Workaround: irongut/CodeCoverageSummary runs inside a Docker
          # container that may write code-coverage-results.md as root. Self-hosted
          # runners lack passwordless sudo, so take ownership without sudo by
          # replacing the file with a runner-owned copy when it is not already
          # writable (a same-directory rename only needs workspace dir perms).
          if [ ! -w code-coverage-results.md ]; then
            cp code-coverage-results.md code-coverage-results.md.owned
            mv -f code-coverage-results.md.owned code-coverage-results.md
          fi
          go install github.com/fzipp/gocyclo/cmd/gocyclo@v0.6.0
          GOCYCLO="$(go env GOPATH)/bin/gocyclo"

          DIRS=()
          while IFS= read -r mod; do
            [ -z "$mod" ] && continue
            DIRS+=("$mod")
          done <<< "$MODULES"

          AVG=$("$GOCYCLO" -avg -ignore '_test\.go' "${DIRS[@]}" | awk '/^Average:/{print $2}')
          if [ -z "${AVG}" ]; then
            echo "::error::Failed to extract average complexity from gocyclo output"
            exit 1
          fi

          # Workaround: gocover-cobertura@v1.4.0 emits <class complexity="0"/>
          # unconditionally, so every Complexity cell in CodeCoverageSummary's
          # output renders 0. Compute gocyclo -avg per package (matched to the
          # markdown row by Go import path) and once globally for the Summary
          # row, then patch the markdown.
          while IFS= read -r mod; do
            [ -z "$mod" ] && continue
            modpath=$(awk '/^module /{print $2; exit}' "$mod/go.mod")
            if [ -z "$modpath" ]; then
              echo "::error::No module path in $mod/go.mod (unreadable or malformed)"
              exit 1
            fi
            while IFS= read -r pkgdir; do
              pkgavg=$("$GOCYCLO" -avg -ignore '_test\.go' "$pkgdir" | awk '/^Average:/{print $2; exit}')
              if [ -z "$pkgavg" ]; then
                echo "::warning::No gocyclo average for $pkgdir — skipping complexity patch for this package"
                continue
              fi
              rel="${pkgdir#"$mod"}"
              rel="${rel#/}"
              if [ -z "$rel" ]; then
                importpath="$modpath"
              else
                importpath="$modpath/$rel"
              fi
              awk -v pkg="$importpath" -v avg="$pkgavg" '
                index($0, pkg " ") && /\| 0 \|/ { sub(/\| 0 \|/, "| " avg " |") }
                { print }
              ' code-coverage-results.md > code-coverage-results.md.tmp
              mv code-coverage-results.md.tmp code-coverage-results.md
            done < <(find "$mod" -type f -name '*.go' ! -name '*_test.go' -exec dirname {} \; | sort -u)
          done <<< "$MODULES"

          sed -i "s/| \*\*0\*\* |/| **${AVG}** |/g" code-coverage-results.md
          if ! grep -qF "| **${AVG}** |" code-coverage-results.md; then
            echo "::warning::Coverage report format changed — Summary Complexity not patched. Check CodeCoverageSummary version."
          fi

          COV_FUNC="$RUNNER_TEMP/cov-func.txt"
          : > "$COV_FUNC"
          while IFS= read -r mod; do
            [ -z "$mod" ] && continue
            safe=$(echo "$mod" | tr '/' '_')
            (cd "$mod" && go tool cover -func="$GITHUB_WORKSPACE/coverage/$safe.out") >> "$COV_FUNC"
          done <<< "$MODULES"

          {
            echo
            echo "<details>"
            echo "<summary>Cyclomatic complexity — top 10 production functions (average ${AVG})</summary>"
            echo
            echo "| Complexity | Function | Location | Attended |"
            echo "| ---------: | -------- | -------- | :------- |"
            "$GOCYCLO" -top 10 -ignore '_test\.go' "${DIRS[@]}" | while read -r complexity _pkg func location; do
              file_line="${location%:*}"
              if [[ ! "${file_line}" =~ \.go:[0-9]+$ ]]; then
                echo "| ${complexity} | \`${func}\` | \`${location}\` | ? parse |"
                continue
              fi
              if pct=$(grep -F "${file_line}:" "$COV_FUNC" | head -1 | awk 'NF{print $NF}') && [ -n "${pct}" ]; then
                case "${pct}" in
                  0.0%) attended="✗ 0.0%" ;;
                  *)    attended="✓ ${pct}" ;;
                esac
              else
                attended="? no-row"
              fi
              echo "| ${complexity} | \`${func}\` | \`${file_line}\` | ${attended} |"
            done
            echo
            echo "</details>"
          } >> code-coverage-results.md

      - name: Checkout CI helpers
        if: steps.discover.outputs.found == 'true'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: peacefulstudio/github-actions
          ref: ${{ job.workflow_sha }}
          path: .github-actions-helpers

      - name: Sort coverage table alphabetically
        if: steps.discover.outputs.found == 'true'
        uses: ./.github-actions-helpers/.github/actions/sort-coverage-table

      - name: Prepend coverage title
        if: steps.discover.outputs.found == 'true'
        env:
          COVERAGE_TITLE: ${{ inputs.coverage-title }}
        run: |
          set -euo pipefail
          if [ ! -f code-coverage-results.md ]; then
            echo "::error::code-coverage-results.md not found after Code Coverage Summary Report — did irongut/CodeCoverageSummary succeed?"
            exit 1
          fi
          printf '## %s\n\n' "$COVERAGE_TITLE" | cat - code-coverage-results.md > code-coverage-results.tmp
          mv code-coverage-results.tmp code-coverage-results.md

      - name: Add Coverage PR Comment
        if: steps.discover.outputs.found == 'true' && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        with:
          recreate: true
          header: go-coverage
          path: code-coverage-results.md

      - name: Write to Job Summary
        if: steps.discover.outputs.found == 'true'
        run: cat code-coverage-results.md >> "$GITHUB_STEP_SUMMARY"

  lint:
    needs: resolve-runner
    runs-on: ${{ startsWith(needs.resolve-runner.outputs.runner, '[') && fromJSON(needs.resolve-runner.outputs.runner) || needs.resolve-runner.outputs.runner }}
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ inputs.go-version }}

      - name: Discover Go modules
        id: discover
        env:
          MODULE_PATHS: ${{ inputs.module-paths }}
        run: |
          set -euo pipefail
          read -r -a paths <<<"$MODULE_PATHS"
          existing=()
          for p in "${paths[@]}"; do
            [ -d "$p" ] && existing+=("$p")
          done
          if [ ${#existing[@]} -eq 0 ]; then
            echo "None of the configured module paths exist: $MODULE_PATHS"
            echo "found=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          mods=$(find "${existing[@]}" -name go.mod -not -path '*/.git/*' -print0 | xargs -0 -n1 dirname | sort -u)
          if [ -z "$mods" ]; then
            echo "No go.mod files found under: ${existing[*]}"
            echo "found=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "Found modules:"
          awk '{print "  " $0}' <<<"$mods"
          {
            echo "found=true"
            echo "modules<<EOF"
            echo "$mods"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Install golangci-lint
        if: steps.discover.outputs.found == 'true'
        env:
          GOLANGCI_LINT_VERSION: ${{ inputs.golangci-lint-version }}
        run: |
          case "$GOLANGCI_LINT_VERSION" in
            v2*) MODULE=github.com/golangci/golangci-lint/v2/cmd/golangci-lint ;;
            *)   MODULE=github.com/golangci/golangci-lint/cmd/golangci-lint ;;
          esac
          go install "${MODULE}@${GOLANGCI_LINT_VERSION}"

      - name: Lint
        if: steps.discover.outputs.found == 'true'
        env:
          MODULES: ${{ steps.discover.outputs.modules }}
        run: |
          set -euo pipefail
          while IFS= read -r mod; do
            [ -z "$mod" ] && continue
            echo "::group::lint $mod"
            (cd "$mod" && golangci-lint run ./...)
            echo "::endgroup::"
          done <<< "$MODULES"