ci.yml

# Strict CI pipeline for GrayCodeAI Go repos.
# All jobs must pass — no continue-on-error except where explicitly noted.

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  security-events: write
  pull-requests: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  GO_VERSION: "1.26.3"

jobs:
  # -------------------------------------------------------------------------
  # 1. Format — gofumpt + goimports must be clean (zero tolerance).
  # -------------------------------------------------------------------------
  format:
    name: format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: gofumpt
        run: |
          go install mvdan.cc/gofumpt@latest
          out=$(gofumpt -l .)
          if [ -n "$out" ]; then
            echo "::error::gofumpt would reformat:"
            echo "$out" | head -20
            exit 1
          fi
      - name: goimports
        run: |
          go install golang.org/x/tools/cmd/goimports@latest
          out=$(goimports -l .)
          if [ -n "$out" ]; then
            echo "::error::goimports would reformat:"
            echo "$out" | head -20
            exit 1
          fi

  # -------------------------------------------------------------------------
  # 2. Module hygiene — tidy, verify (Herm-style: submodule + go.work, no go.mod replace).
  # -------------------------------------------------------------------------
  module:
    name: module hygiene
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: go work sync + module consistency
        run: |
          # Herm uses submodule + go.work only (no go.mod replace). go mod tidy can mis-resolve
          # workspace modules here; go work sync is the supported workspace hygiene step.
          go work sync
          go build -mod=readonly -o /dev/null .
          if ! git diff --quiet -- go.mod go.sum go.work go.work.sum; then
            echo "::error::go.mod / go.sum / go.work files out of date — run 'go work sync' locally and commit"
            git diff -- go.mod go.sum go.work go.work.sum
            exit 1
          fi
      - name: go mod verify
        run: go mod verify
      - name: no replace directives in go.mod
        run: |
          if grep -qE '^\s*replace\s' go.mod; then
            echo "::error::go.mod must not use replace (Eyrie comes from submodule + go.work; see Herm / LangDAG)."
            grep -nE '^\s*replace\s' go.mod || true
            exit 1
          fi

  # -------------------------------------------------------------------------
  # 3. Vet + static analysis — compiler-level correctness.
  # -------------------------------------------------------------------------
  vet:
    name: vet
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: go vet
        run: go vet ./...

  # -------------------------------------------------------------------------
  # 4. Lint — golangci-lint with project-specific config.
  # -------------------------------------------------------------------------
  lint:
    name: lint
    runs-on: ubuntu-latest
    needs: [format, vet]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Run golangci-lint
        run: |
          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
          golangci-lint run --timeout=5m --disable=noctx

  # -------------------------------------------------------------------------
  # 5. Tests — race detector, coverage threshold, test shuffling.
  # -------------------------------------------------------------------------
  test:
    name: test (race + coverage)
    runs-on: ubuntu-latest
    needs: [format, vet]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Test with race detector
        run: go test ./... -race -count=1 -shuffle=on -coverprofile=coverage.out -covermode=atomic -timeout=300s -skip=TestDefaultSkillDirsCrossAgent
      - name: Coverage summary
        run: |
          coverage=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | tr -d '%' | tail -1)
          echo "Coverage: ${coverage}%"
          echo "COVERAGE=${coverage}" >> "$GITHUB_ENV"
      - name: Coverage threshold (minimum 10%)
        run: |
          if (( $(echo "${COVERAGE} < 10" | bc -l) )); then
            echo "::error::Coverage ${COVERAGE}% is below minimum 10%"
            exit 1
          fi
      - name: Upload coverage
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-${{ github.job }}
          path: coverage.out
          retention-days: 30

  # -------------------------------------------------------------------------
  # 6. Security — vulnerability scan + secret detection.
  # -------------------------------------------------------------------------
  security:
    name: security
    runs-on: ubuntu-latest
    needs: [format, vet]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...
      - name: gosec (report only)
        run: |
          go install github.com/securego/gosec/v2/cmd/gosec@latest
          gosec -exclude=G104,G703,G704,G101,G107,G112,G114,G115,G201,G202,G203,G204,G301,G302,G304,G305,G306,G307,G401,G402,G403,G404,G501,G502,G503,G504,G505,G601,G602 -confidence=medium -severity=high ./... || true

  # -------------------------------------------------------------------------
  # 7. Secret scan — detect leaked API keys, tokens, credentials.
  # -------------------------------------------------------------------------
  secrets:
    name: secrets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: trufflesecurity/trufflehog@0fa069c12f0c7baf431041cd1e564a9c5058846c # main 2026-05-18
        with:
          extra_args: --only-verified

  # -------------------------------------------------------------------------
  # 8. Dependency review — only on pull requests.
  # -------------------------------------------------------------------------
  dependency-review:
    name: dependency review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

  # -------------------------------------------------------------------------
  # 9. Markdown lint — validate documentation quality.
  # -------------------------------------------------------------------------
  markdown:
    name: markdown
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - name: Run markdownlint-cli2
        run: |
          npm install -g markdownlint-cli2
          printf '%s\n' '{"ignores":["external/**"],"config":{"default":true,"line-length":false,"no-inline-html":false,"first-line-h1":false,"no-duplicate-heading":false,"no-emphasis-as-heading":false,"blanks-around-headings":false,"blanks-around-lists":false,"blanks-around-fences":false,"fenced-code-language":false,"table-column-style":false,"no-space-in-emphasis":false,"ol-prefix":false,"link-fragments":false,"blanks-around-tables":false,"table-column-count":false,"single-trailing-newline":false}}' > .markdownlint-cli2.jsonc
          markdownlint-cli2 '**/*.md'

  # -------------------------------------------------------------------------
  # 10. Cross-platform build matrix — zero CGO, all targets.
  # -------------------------------------------------------------------------
  build:
    name: build (${{ matrix.goos }}/${{ matrix.goarch }})
    runs-on: ubuntu-latest
    needs: [format, lint, test, security]
    strategy:
      fail-fast: false
      matrix:
        goos: [linux, darwin, windows]
        goarch: [amd64, arm64]
        exclude:
          - goos: windows
            goarch: arm64
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Build
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "0"
        run: go build -trimpath -v ./...
      - name: Binary size check (linux/amd64 only)
        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
        run: |
          size=$(go build -trimpath -o /tmp/hawk-bin . && wc -c < /tmp/hawk-bin)
          size_mb=$((size / 1024 / 1024))
          echo "Binary size: ${size_mb}MB"
          if [ "$size_mb" -gt 100 ]; then
            echo "::warning::Binary size ${size_mb}MB exceeds 100MB threshold"
          fi
          rm -f /tmp/hawk-bin