lint.yml

name: Lint
on:
  pull_request:
    branches: [ master ]
concurrency: 
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
env:
  # environment variables shared between build steps
  # do not include sensitive credentials and tokens here, instead pass them
  # directly to tools that need them to limit the blast radius in case one of them
  # becomes compromised and leaks credentials to external sites.
  # required by Makefile
  UNIX_SHELL_ON_WINDOWS: true
  # set (to any value other than false) to trigger random unicode filenames testing (logs may be difficult to read)
  ENABLE_UNICODE_FILENAMES: ${{ secrets.ENABLE_UNICODE_FILENAMES }}
  # set (to any value other than false) to trigger very long filenames testing
  ENABLE_LONG_FILENAMES: ${{ secrets.ENABLE_LONG_FILENAMES }}
jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    name: Lint
    runs-on: ${{ matrix.os }}
    steps:
    - name: Check out repository
      uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
      with:
        fetch-depth: 0
    - name: Set up Go
      uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
      with:
        go-version-file: 'go.mod'
        check-latest: true
      id: go
      if: ${{ !contains(matrix.os, 'ARMHF') }}
    - id: govulncheck
      uses: golang/govulncheck-action@3a32958c2706f7048305d5a2e53633d7e37e97d0 # v1.0.2
      with:
        repo-checkout: false
        cache: false
    - name: Lint
      run: make lint
    - name: Check Locks
      run: make check-locks