lint.yml

name: Lint
on:
  pull_request:
    paths:
      - "**.sh"
      - "**.go"
      - go.mod
      - go.sum

permissions:
  contents: read

env:
  GO_VERSION: "^1.22"

jobs:
  dependencies:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Verify dependencies
        run: |
          go mod verify
          go mod download

      - name: Go mod tidy
        run: |
          go mod tidy
          if ! diff="$(git diff -U1 --color --exit-code)"; then
            printf '::error title="go mod tidy results in modifications"::Running `%s` results in modifications that you must check into version control:\n%s\n\n' "go mod tidy" "$diff"
            exit 1
          fi

  golang-ci:
    name: Go Lint
    runs-on: ubuntu-latest
    permissions:
      checks: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false # golangci-lint implements its own caching

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v4
        with:
          version: v1.56
          install-mode: "binary"

  shell-check:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - name: Repository checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Differential ShellCheck
        uses: redhat-plumbers-in-action/differential-shellcheck@v5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}