ci.yml

name: CI

on:
  pull_request:
    branches:
      - '**'
  push:
    branches:
      - main

permissions:
  contents: write  # Needed to commit coverage badge on main branch
  pull-requests: write
  security-events: write  # Needed for Datadog SAST results
  id-token: write # Needed to federate STS token to upload coverage

env:
  DD_ENV: ci
  DD_SERVICE: pup

jobs:
  test:
    name: Test and Coverage
    runs-on: ubuntu-latest
    env:
      DD_API_KEY: ${{ secrets.DD_API_KEY }}
      DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }}
      DD_CIVISIBILITY_AGENTLESS_ENABLED: true
      DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true
      DD_CIVISIBILITY_ENABLED: true
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Fetch full git history for Datadog CI Visibility

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true

      - name: Get Datadog credentials
        id: dd-sts # Needed to be able to reference this step's output later
        uses: DataDog/dd-sts-action@main # Pin to the main branch to get auto updates for free, or to a specific commit hash if you want stability
        with:
          policy: public-datadog-pup-sts

      - name: Configure Datadog Test Optimization
        uses: datadog/test-visibility-github-action@v2
        with:
          languages: go
          api_key: ${{ steps.dd-sts.outputs.api_key }}
          site: datadoghq.com

      - name: Install Datadog CI tools
        run: |
          # Install orchestrion for Go test instrumentation
          go install github.com/DataDog/orchestrion@latest
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

          # Install datadog-ci CLI for coverage upload
          npm install -g @datadog/datadog-ci

      - name: Install bc for floating-point math
        run: sudo apt-get update && sudo apt-get install -y bc

      - name: Run tests with coverage
        env:
          DD_CIVISIBILITY_ENABLED: true
          DD_ENV: ci
        run: |
          # Run tests on all packages with race detection
          # Use orchestrion to instrument tests for Datadog CI Visibility
          # IMPORTANT: Use -parallel 256 with orchestrion. The test-visibility-github-action
          # sets GOFLAGS='-toolexec=orchestrion toolexec' which auto-injects t.Parallel()
          # into ALL subtests. With the default parallel limit (GOMAXPROCS=2 on runners),
          # this deadlocks table-driven tests where parent tests wait for subtests that are
          # blocked waiting for parallel slots. A high limit avoids the deadlock.
          if [ -n "$DD_API_KEY" ]; then
            echo "Running tests with Datadog CI Visibility enabled"
            orchestrion go test -v -race -parallel 256 ./...
          else
            echo "Running tests without Datadog CI Visibility (DD_API_KEY not set)"
            go test -v -race ./...
          fi

          # Coverage collection: run WITHOUT orchestrion/ITR to ensure ALL tests execute.
          # Intelligent Test Runner skips tests it deems unaffected by code changes,
          # which breaks coverage on dependency-only PRs (e.g., go.mod updates).
          # GOFLAGS is cleared to remove the '-toolexec=orchestrion toolexec' injected
          # by test-visibility-github-action.
          GOFLAGS="" go test -count=1 -coverprofile=coverage.out -covermode=atomic ./pkg/...

          # Generate HTML coverage report
          go tool cover -html=coverage.out -o coverage.html

      - name: Calculate coverage
        id: coverage
        run: |
          # Calculate total coverage
          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
          echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT
          echo "Total coverage: $COVERAGE%"

          # Calculate coverage by package
          echo "## Coverage by Package" > coverage_report.txt
          echo "" >> coverage_report.txt
          go tool cover -func=coverage.out | grep -v "total:" | awk '{print $1, $3}' | sort -t: -k1,1 -u | while read line; do
            echo "- $line" >> coverage_report.txt
          done

          # Get coverage summary
          echo "" >> coverage_report.txt
          echo "## Summary" >> coverage_report.txt
          echo "" >> coverage_report.txt
          go tool cover -func=coverage.out | tail -1 >> coverage_report.txt

      - name: Upload coverage to Datadog
        if: env.DD_API_KEY != ''
        env:
          DATADOG_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
          DD_SITE: datadoghq.com
        run: |
          # Upload coverage reports to Datadog
          datadog-ci coverage upload --format=go-coverprofile coverage.out

      - name: Check coverage threshold
        run: |
          COVERAGE=${{ steps.coverage.outputs.coverage }}
          # Lower threshold to account for skipped keychain tests in CI (headless environment)
          # Local macOS coverage is ~87%, CI is ~77% due to keychain tests being skipped
          THRESHOLD=75.0

          echo "Coverage: $COVERAGE%"
          echo "Threshold: $THRESHOLD%"

          # Use bc for floating point comparison
          if [ $(echo "$COVERAGE < $THRESHOLD" | bc -l) -eq 1 ]; then
            echo "❌ Coverage $COVERAGE% is below threshold $THRESHOLD%"
            exit 1
          else
            echo "✅ Coverage $COVERAGE% meets threshold $THRESHOLD%"
          fi

      - name: Generate coverage badge for main branch
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          COVERAGE: ${{ steps.coverage.outputs.coverage }}
        run: |
          # Determine badge color
          if [ $(echo "$COVERAGE >= 90" | bc -l) -eq 1 ]; then
            COLOR="brightgreen"
          elif [ $(echo "$COVERAGE >= 80" | bc -l) -eq 1 ]; then
            COLOR="green"
          elif [ $(echo "$COVERAGE >= 70" | bc -l) -eq 1 ]; then
            COLOR="yellow"
          elif [ $(echo "$COVERAGE >= 60" | bc -l) -eq 1 ]; then
            COLOR="orange"
          else
            COLOR="red"
          fi

          # Create badge JSON for shields.io endpoint schema
          mkdir -p .github/badges
          cat > .github/badges/coverage.json << EOF
          {
            "schemaVersion": 1,
            "label": "coverage",
            "message": "${COVERAGE}%",
            "color": "${COLOR}"
          }
          EOF

          echo "Generated coverage badge: ${COVERAGE}% (${COLOR})"

      # Note: Auto-committing badge disabled due to branch protection requiring signed commits
      # Badge can be updated manually or via a separate workflow with appropriate permissions

      - name: Upload coverage artifacts
        uses: actions/upload-artifact@v6
        with:
          name: coverage-report
          path: |
            coverage.out
            coverage.html
            coverage_report.txt
          retention-days: 30

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true

      - name: Install golangci-lint
        run: |
          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin latest
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

      - name: Run golangci-lint
        run: golangci-lint run --timeout=5m

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true

      - name: Build
        run: go build -v ./...

      - name: Build CLI binary
        run: go build -o pup .

      - name: Verify binary
        run: ./pup --version

  sast:
    name: Datadog Static Analysis
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    env:
      DD_API_KEY: ${{ secrets.DD_API_KEY }}
      DD_APP_KEY: ${{ secrets.DD_APP_KEY }}
      DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Full history for better SAST analysis

      - name: Run Datadog Static Analysis
        if: env.DD_API_KEY != ''
        run: |
          # Install datadog-ci if not already installed
          npm install -g @datadog/datadog-ci

          # Run static analysis
          # This will analyze the code for security vulnerabilities, code quality issues, etc.
          datadog-ci sast scan --service=${{ env.DD_SERVICE }} --env=${{ env.DD_ENV }}

      - name: SAST disabled notice
        if: env.DD_API_KEY == ''
        run: |
          echo "⚠️  Datadog Static Analysis skipped: DD_API_KEY not configured"
          echo "To enable SAST, add DD_API_KEY and DD_APP_KEY as repository secrets"