lint-go.yaml

name: Go Related Checks

# Any change in triggers needs to be reflected in the concurrency group.
on:
  pull_request: {}
  push:
    branches:
      - main
      - ft/main/**
  # Add this workflow to be triggered by merge queue events
  merge_group:

permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after || github.event.merge_group && github.run_id }}
  cancel-in-progress: ${{ !github.event.merge_group }}

jobs:
  go-mod:
    name: Check Go Modules
    runs-on: ubuntu-24.04
    steps:
      - name: Install Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: 1.25.3
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: Check module vendoring
        run: |
          go mod tidy
          go mod vendor
          test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)

  license-check:
    name: Check third party dependencies licenses
    runs-on: ubuntu-24.04
    steps:
      - name: Install Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: 1.25.3
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: Check for unauthorized dependencies
        run: go run ./tools/licensecheck ./... 2>/dev/null

  golangci:
    name: Lint Source Code
    runs-on: ${{ vars.GH_RUNNER_EXTRA_POWER_UBUNTU_LATEST || 'ubuntu-24.04' }}
    steps:
      - name: Collect Workflow Telemetry
        uses: catchpoint/workflow-telemetry-action@94c3c3d9567a0205de6da68a76c428ce4e769af1 # v2.0.0
        with:
          comment_on_pr: false

      - name: Install Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: 1.25.3
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
        with:
          # renovate: datasource=docker depName=golangci/golangci-lint
          version: v2.5.0
          skip-cache: true
          args: "--verbose --modules-download-mode=vendor"

  precheck:
    runs-on: ubuntu-24.04
    name: Precheck
    steps:
      - name: Install Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: 1.25.3
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          # hard-code the path instead of using ${{ github.repository }} to make sure it works for forked repo as well
          path: src/github.com/cilium/cilium
      - name: Executables check
        run: |
          cd src/github.com/cilium/cilium
          HELP="check permissions of files and allowlist them in contrib/executable_list.txt if you are adding a new executable"
          make check-permissions || (echo $HELP; exit 1)
      - name: Go code prechecks
        run: |
          cd src/github.com/cilium/cilium
          make precheck
      - name: Custom linters
        run: |
          cd src/github.com/cilium/cilium
          make custom-lint

  generate-api:
    runs-on: ubuntu-24.04
    name: Generate API
    steps:
      - name: Install Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: 1.25.3
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          # hard-code the path instead of using ${{ github.repository }} to make sure it works for forked repo as well
          path: src/github.com/cilium/cilium
      - name: Check api generated files
        env:
          BUILDER_GOCACHE_DIR: "/tmp/.cache/go/.cache/go-build"
          BUILDER_GOMODCACHE_DIR: "/tmp/.cache/go/pkg"
        run: |
          cd src/github.com/cilium/cilium
          contrib/scripts/check-api-code-gen.sh

  generate-k8s-api:
    runs-on: ubuntu-24.04
    name: Generate k8s API
    steps:
      - name: Install Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: 1.25.3
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          # hard-code the path instead of using ${{ github.repository }} to make sure it works for forked repo as well
          path: src/github.com/cilium/cilium
      - name: Check k8s generated files
        env:
          BUILDER_GOCACHE_DIR: "/tmp/.cache/go/.cache/go-build"
          BUILDER_GOMODCACHE_DIR: "/tmp/.cache/go/pkg"
        run: |
          # Set GOBIN to ensure 'go install' binaries end up in the same directory
          # as the one actions/setup-go adds to PATH, regardless of GOPATH.
          export GOBIN="$HOME/go/bin"

          cd src/github.com/cilium/cilium
          contrib/scripts/check-k8s-code-gen.sh