ci.yml

name: CI

on:
  pull_request:
    branches:
      - '**'
  push:
    branches:
      - main

permissions:
  contents: write  # Needed to commit coverage badge on main branch
  pull-requests: write
  security-events: write  # Needed for Datadog SAST results
  id-token: write # Needed to federate STS token to upload coverage

env:
  DD_ENV: ci
  DD_SERVICE: pup

jobs:
  test:
    name: Test and Coverage
    runs-on: ubuntu-latest
    env:
      DD_API_KEY: ${{ secrets.DD_API_KEY }}
      DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }}
      DD_CIVISIBILITY_AGENTLESS_ENABLED: true
      DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true
      DD_CIVISIBILITY_ENABLED: true
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Fetch full git history for Datadog CI Visibility

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true

      - name: Get Datadog credentials
        id: dd-sts # Needed to be able to reference this step's output later
        uses: DataDog/dd-sts-action@main # Pin to the main branch to get auto updates for free, or to a specific commit hash if you want stability
        with:
          policy: public-datadog-pup-sts

      - name: Configure Datadog Test Optimization
        uses: datadog/test-visibility-github-action@v2
        with:
          languages: go
          api_key: ${{ steps.dd-sts.outputs.api_key }}
          site: datadoghq.com

      - name: Install Datadog CI tools
        run: |
          # Install orchestrion for Go test instrumentation
          go install github.com/DataDog/orchestrion@latest
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

          # Install datadog-ci CLI for coverage upload
          npm install -g @datadog/datadog-ci

      - name: Install bc for floating-point math
        run: sudo apt-get update && sudo apt-get install -y bc

      - name: Run tests with coverage
        env:
          DD_CIVISIBILITY_ENABLED: true
          DD_ENV: ci
        run: |
          # Run tests on all packages with race detection
          # Use orchestrion to instrument tests for Datadog CI Visibility
          # NOTE: Do NOT use -parallel N with orchestrion — it auto-injects t.Parallel()
          # into subtests, which deadlocks table-driven tests when the parallel slot limit
          # is lower than the number of subtests.
          if [ -n "$DD_API_KEY" ]; then
            echo "Running tests with Datadog CI Visibility enabled"
            orchestrion go test -v -race ./...
            # Calculate coverage with orchestrion instrumentation
            # Use -count=1 to disable test caching and get accurate coverage
            orchestrion go test -count=1 -coverprofile=coverage.out -covermode=atomic ./pkg/...
          else
            echo "Running tests without Datadog CI Visibility (DD_API_KEY not set)"
            go test -v -race ./...
            go test -count=1 -coverprofile=coverage.out -covermode=atomic ./pkg/...
          fi

          # Generate HTML coverage report
          go tool cover -html=coverage.out -o coverage.html

      - name: Calculate coverage
        id: coverage
        run: |
          # Calculate total coverage
          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
          echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT
          echo "Total coverage: $COVERAGE%"

          # Calculate coverage by package
          echo "## Coverage by Package" > coverage_report.txt
          echo "" >> coverage_report.txt
          go tool cover -func=coverage.out | grep -v "total:" | awk '{print $1, $3}' | sort -t: -k1,1 -u | while read line; do
            echo "- $line" >> coverage_report.txt
          done

          # Get coverage summary
          echo "" >> coverage_report.txt
          echo "## Summary" >> coverage_report.txt
          echo "" >> coverage_report.txt
          go tool cover -func=coverage.out | tail -1 >> coverage_report.txt

      - name: Upload coverage to Datadog
        if: env.DD_API_KEY != ''
        env:
          DATADOG_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
          DD_SITE: datadoghq.com
        run: |
          # Upload coverage reports to Datadog
          datadog-ci coverage upload --format=go-cover coverage.out

      - name: Check coverage threshold
        run: |
          COVERAGE=${{ steps.coverage.outputs.coverage }}
          # Lower threshold to account for skipped keychain tests in CI (headless environment)
          # Local macOS coverage is ~87%, CI is ~77% due to keychain tests being skipped
          THRESHOLD=75.0

          echo "Coverage: $COVERAGE%"
          echo "Threshold: $THRESHOLD%"

          # Use bc for floating point comparison
          if [ $(echo "$COVERAGE < $THRESHOLD" | bc -l) -eq 1 ]; then
            echo "❌ Coverage $COVERAGE% is below threshold $THRESHOLD%"
            exit 1
          else
            echo "✅ Coverage $COVERAGE% meets threshold $THRESHOLD%"
          fi

      - name: Generate coverage badge data
        if: github.event_name == 'pull_request'
        id: badge
        run: |
          COVERAGE=${{ steps.coverage.outputs.coverage }}

          # Determine badge color based on coverage
          if [ $(echo "$COVERAGE >= 90" | bc -l) -eq 1 ]; then
            COLOR="brightgreen"
          elif [ $(echo "$COVERAGE >= 80" | bc -l) -eq 1 ]; then
            COLOR="green"
          elif [ $(echo "$COVERAGE >= 70" | bc -l) -eq 1 ]; then
            COLOR="yellow"
          elif [ $(echo "$COVERAGE >= 60" | bc -l) -eq 1 ]; then
            COLOR="orange"
          else
            COLOR="red"
          fi

          echo "color=$COLOR" >> $GITHUB_OUTPUT

      - name: Generate PR comment body
        if: github.event_name == 'pull_request'
        id: comment
        env:
          COVERAGE: ${{ steps.coverage.outputs.coverage }}
          BADGE_COLOR: ${{ steps.badge.outputs.color }}
          COMMIT_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          # Determine status
          if [ $(echo "$COVERAGE >= 80" | bc -l) -eq 1 ]; then
            STATUS="✅ PASSED - Coverage meets minimum threshold"
            STATUS_EMOJI="✅"
          else
            STATUS="❌ FAILED - Coverage below minimum threshold"
            STATUS_EMOJI="❌"
          fi

          # Create comment body using heredoc
          cat > comment_final.txt << EOF
          ## 📊 Test Coverage Report

          **Overall Coverage:** ${COVERAGE}% ![Coverage](https://img.shields.io/badge/coverage-${COVERAGE}%25-${BADGE_COLOR})

          **Threshold:** 80% ${STATUS_EMOJI}

          <details>
          <summary>Coverage by Package</summary>

          \`\`\`
          $(cat coverage_report.txt)
          \`\`\`

          </details>

          ---
          📈 **Coverage Status:** ${STATUS}

          <sub>Updated for commit ${COMMIT_SHA}</sub>
          EOF

      - name: Comment on PR
        if: github.event_name == 'pull_request'
        continue-on-error: true  # Don't fail CI if comment posting fails
        uses: actions/github-script@v8
        env:
          COMMENT_BODY: ${{ steps.comment.outputs.comment_body }}
        with:
          script: |
            const fs = require('fs');
            const commentBody = fs.readFileSync('comment_final.txt', 'utf8');

            // Find existing comment
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const botComment = comments.find(comment =>
              comment.user.type === 'Bot' && comment.body.includes('📊 Test Coverage Report')
            );

            if (botComment) {
              // Update existing comment
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: commentBody
              });
            } else {
              // Create new comment
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body: commentBody
              });
            }

      - name: Generate coverage badge for main branch
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          COVERAGE: ${{ steps.coverage.outputs.coverage }}
        run: |
          # Determine badge color
          if [ $(echo "$COVERAGE >= 90" | bc -l) -eq 1 ]; then
            COLOR="brightgreen"
          elif [ $(echo "$COVERAGE >= 80" | bc -l) -eq 1 ]; then
            COLOR="green"
          elif [ $(echo "$COVERAGE >= 70" | bc -l) -eq 1 ]; then
            COLOR="yellow"
          elif [ $(echo "$COVERAGE >= 60" | bc -l) -eq 1 ]; then
            COLOR="orange"
          else
            COLOR="red"
          fi

          # Create badge JSON for shields.io endpoint schema
          mkdir -p .github/badges
          cat > .github/badges/coverage.json << EOF
          {
            "schemaVersion": 1,
            "label": "coverage",
            "message": "${COVERAGE}%",
            "color": "${COLOR}"
          }
          EOF

          echo "Generated coverage badge: ${COVERAGE}% (${COLOR})"

      # Note: Auto-committing badge disabled due to branch protection requiring signed commits
      # Badge can be updated manually or via a separate workflow with appropriate permissions

      - name: Upload coverage artifacts
        uses: actions/upload-artifact@v6
        with:
          name: coverage-report
          path: |
            coverage.out
            coverage.html
            coverage_report.txt
          retention-days: 30

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true

      - name: Install golangci-lint
        run: |
          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin latest
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

      - name: Run golangci-lint
        run: golangci-lint run --timeout=5m

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true

      - name: Build
        run: go build -v ./...

      - name: Build CLI binary
        run: go build -o pup .

      - name: Verify binary
        run: ./pup --version

  sast:
    name: Datadog Static Analysis
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    env:
      DD_API_KEY: ${{ secrets.DD_API_KEY }}
      DD_APP_KEY: ${{ secrets.DD_APP_KEY }}
      DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Full history for better SAST analysis

      - name: Run Datadog Static Analysis
        if: env.DD_API_KEY != ''
        run: |
          # Install datadog-ci if not already installed
          npm install -g @datadog/datadog-ci

          # Run static analysis
          # This will analyze the code for security vulnerabilities, code quality issues, etc.
          datadog-ci sast scan --service=${{ env.DD_SERVICE }} --env=${{ env.DD_ENV }}

      - name: SAST disabled notice
        if: env.DD_API_KEY == ''
        run: |
          echo "⚠️  Datadog Static Analysis skipped: DD_API_KEY not configured"
          echo "To enable SAST, add DD_API_KEY and DD_APP_KEY as repository secrets"