build-test.yml

name: Build and Test

permissions:
  contents: read

on:
  push:
    branches:
      - master
    tags:
      - v*
  pull_request:
    branches:
      - master
      - SNOW-*
  schedule:
    - cron: '7 3 * * *'
  workflow_dispatch:
    inputs:
      goTestParams:
        default:
        description: 'Parameters passed to go test'
      sequentialTests:
        type: boolean
        default: false
        description: 'Run tests sequentially (no buffering, slower)'

concurrency:
  # older builds for the same pull request numer or branch should be cancelled
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
    lint:
        runs-on: ubuntu-latest
        name: Check linter
        steps:
          - uses: actions/checkout@v4
          - name: Setup go
            uses: actions/setup-go@v5
            with:
              go-version: '1.25'
          - name: golangci-lint
            uses: golangci/golangci-lint-action@v7
            with:
              version: v2.4.0
          - name: Format, Lint
            shell: bash
            run: ./ci/build.sh
    build-test-linux:
        runs-on: ubuntu-latest
        strategy:
            fail-fast: false
            matrix:
                cloud: [ 'AWS', 'AZURE', 'GCP' ]
                go: [ '1.24', '1.25', '1.26' ]
        name: ${{ matrix.cloud }} Go ${{ matrix.go }} on Ubuntu
        steps:
            - uses: actions/checkout@v4
            - uses: actions/setup-java@v4 # for wiremock
              with:
                java-version: 17
                distribution: 'temurin'
            - name: Setup go
              uses: actions/setup-go@v5
              with:
                  go-version: ${{ matrix.go }}
            - name: Test
              shell: bash
              env:
                PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
                GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
                CLOUD_PROVIDER: ${{ matrix.cloud }}
                GORACE: history_size=7
                GO_TEST_PARAMS: ${{ inputs.goTestParams }}
                SEQUENTIAL_TESTS: ${{ inputs.sequentialTests }}
                WIREMOCK_PORT: 14335
                WIREMOCK_HTTPS_PORT: 13567
              run: ./ci/test.sh
            - name: Upload test results to Codecov
              if: ${{!cancelled()}}
              uses: codecov/test-results-action@v1
              with:
                token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
            - name: Upload coverage to Codecov
              uses: codecov/codecov-action@v5
              with:
                token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
    build-test-linux-no-home:
      runs-on: ubuntu-latest
      name: Ubuntu - no HOME
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 17
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: '1.25'
        - name: Test
          shell: bash
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: AWS
            GORACE: history_size=7
            GO_TEST_PARAMS: ${{ inputs.goTestParams }}
            SEQUENTIAL_TESTS: ${{ inputs.sequentialTests }}
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
            HOME_EMPTY: "yes"
          run: ./ci/test.sh
    build-test-mac:
        runs-on: macos-latest
        strategy:
            fail-fast: false
            matrix:
                cloud: [ 'AWS', 'AZURE', 'GCP' ]
                go: [ '1.24', '1.25', '1.26' ]
        name: ${{ matrix.cloud }} Go ${{ matrix.go }} on Mac
        steps:
            - uses: actions/checkout@v4
            - uses: actions/setup-java@v4 # for wiremock
              with:
                java-version: 17
                distribution: 'temurin'
            - name: Setup go
              uses: actions/setup-go@v5
              with:
                  go-version: ${{ matrix.go }}
            - name: Test
              shell: bash
              env:
                PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
                GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
                CLOUD_PROVIDER: ${{ matrix.cloud }}
                GO_TEST_PARAMS: ${{ inputs.goTestParams }}
                WIREMOCK_PORT: 14335
                WIREMOCK_HTTPS_PORT: 13567
              run: ./ci/test.sh
            - name: Upload test results to Codecov
              if: ${{!cancelled()}}
              uses: codecov/test-results-action@v1
              with:
                token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
            - name: Upload coverage to Codecov
              uses: codecov/codecov-action@v5
              with:
                token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
    build-test-mac-no-home:
      runs-on: macos-latest
      name: Mac - no HOME
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 17
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: '1.25'
        - name: Test
          shell: bash
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: AWS
            GO_TEST_PARAMS: ${{ inputs.goTestParams }}
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
            HOME_EMPTY: "yes"
          run: ./ci/test.sh
    build-test-windows:
        runs-on: windows-latest
        strategy:
            fail-fast: false
            matrix:
                cloud: [ 'AWS', 'AZURE', 'GCP' ]
                go: [ '1.24', '1.25', '1.26' ]
        name: ${{ matrix.cloud }} Go ${{ matrix.go }} on Windows
        steps:
            - uses: actions/checkout@v4
            - uses: actions/setup-java@v4 # for wiremock
              with:
                java-version: 17
                distribution: 'temurin'
            - name: Setup go
              uses: actions/setup-go@v5
              with:
                  go-version: ${{ matrix.go }}
            - uses: actions/setup-python@v5
              with:
                python-version: '3.x'
                architecture: 'x64'
            - name: Test
              shell: cmd
              env:
                PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
                GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
                CLOUD_PROVIDER: ${{ matrix.cloud }}
                GO_TEST_PARAMS: ${{ inputs.goTestParams }}
                SEQUENTIAL_TESTS: ${{ inputs.sequentialTests }}
                WIREMOCK_PORT: 14335
                WIREMOCK_HTTPS_PORT: 13567
              run: ci\\test.bat
            - name: Upload test results to Codecov
              if: ${{!cancelled()}}
              uses: codecov/test-results-action@v1
              with:
                token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
            - name: Upload coverage to Codecov
              uses: codecov/codecov-action@v5
              with:
                token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
    fipsOnly:
      runs-on: ubuntu-latest
      strategy:
        fail-fast: false
      name: FIPS only mode
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 17
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: ${{ matrix.go }}
        - name: Test
          shell: bash
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: ${{ matrix.cloud }}
            GORACE: history_size=7
            GO_TEST_PARAMS: ${{ inputs.goTestParams }}
            TEST_GODEBUG: fips140=only
            SEQUENTIAL_TESTS: ${{ inputs.sequentialTests }}
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
          run: ./ci/test.sh
        - name: Upload test results to Codecov
          if: ${{!cancelled()}}
          uses: codecov/test-results-action@v1
          with:
            token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
        - name: Upload coverage to Codecov
          uses: codecov/codecov-action@v5
          with:
            token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
    build-test-linux-minicore-disabled:
      runs-on: ubuntu-latest
      name: Ubuntu - minicore disabled
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 17
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: '1.25'
        - name: Test
          shell: bash
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: AWS
            GORACE: history_size=7
            GO_TEST_PARAMS: ${{ inputs.goTestParams }} -tags=minicore_disabled
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
          run: ./ci/test.sh
    build-test-mac-minicore-disabled:
      runs-on: macos-latest
      name: Mac - minicore disabled
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 17
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: '1.25'
        - name: Test
          shell: bash
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: AWS
            GO_TEST_PARAMS: ${{ inputs.goTestParams }} -tags=minicore_disabled
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
          run: ./ci/test.sh
    build-test-windows-minicore-disabled:
      runs-on: windows-latest
      name: Windows - minicore disabled
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 17
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: '1.25'
        - uses: actions/setup-python@v5
          with:
            python-version: '3.x'
            architecture: 'x64'
        - name: Test
          shell: cmd
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: AWS
            GO_TEST_PARAMS: ${{ inputs.goTestParams }} -tags=minicore_disabled
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
          run: ci\\test.bat
    ecc:
      runs-on: ubuntu-latest
      strategy:
        fail-fast: false
      name: Elliptic curves check
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 17
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: '1.25'
        - name: Test
          shell: bash
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: AWS
            GORACE: history_size=7
            GO_TEST_PARAMS: ${{ inputs.goTestParams }} -run TestQueryViaHttps
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
            WIREMOCK_ENABLE_ECDSA: true
          run: ./ci/test.sh
    build-test-rockylinux9:
        runs-on: ubuntu-latest
        strategy:
            fail-fast: false
            matrix:
              cloud_go:
              - cloud: 'AWS'
                go: '1.24.2'
              - cloud: 'AZURE'
                go: '1.25.0'
              - cloud: 'GCP'
                go: '1.26.0'
        name: ${{ matrix.cloud_go.cloud }} Go ${{ matrix.cloud_go.go }} on Rocky Linux 9
        steps:
            - uses: actions/checkout@v4
            - name: Test
              shell: bash
              env:
                PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
                GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
                CLOUD_PROVIDER: ${{ matrix.cloud_go.cloud }}
                GORACE: history_size=7
                GO_TEST_PARAMS: ${{ inputs.goTestParams }}
                SEQUENTIAL_TESTS: ${{ inputs.sequentialTests }}
                WIREMOCK_PORT: 14335
                WIREMOCK_HTTPS_PORT: 13567
              run: ./ci/test_rockylinux9_docker.sh ${{ matrix.cloud_go.go }}
    build-test-ubuntu-arm:
      runs-on: ubuntu-24.04-arm
      strategy:
        fail-fast: false
        matrix:
          cloud_go:
            - cloud: 'AWS'
              go: '1.24'
            - cloud: 'AZURE'
              go: '1.25'
            - cloud: 'GCP'
              go: '1.26'
      name: ${{ matrix.cloud_go.cloud }} Go ${{ matrix.cloud_go.go }} on Ubuntu ARM
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 17
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: ${{ matrix.cloud_go.go }}
        - name: Test
          shell: bash
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: ${{ matrix.cloud_go.cloud }}
            GORACE: history_size=7
            GO_TEST_PARAMS: ${{ inputs.goTestParams }}
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
          run: ./ci/test.sh
        - name: Upload test results to Codecov
          if: ${{!cancelled()}}
          uses: codecov/test-results-action@v1
          with:
            token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
        - name: Upload coverage to Codecov
          uses: codecov/codecov-action@v5
          with:
            token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
    build-test-windows-arm:
      runs-on: windows-11-arm
      strategy:
        fail-fast: false
        matrix:
          cloud_go:
            - cloud: 'AWS'
              go: '1.24'
            - cloud: 'AZURE'
              go: '1.25'
            - cloud: 'GCP'
              go: '1.26'
      name: ${{ matrix.cloud_go.cloud }} Go ${{ matrix.cloud_go.cloud }} on Windows ARM
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-java@v4 # for wiremock
          with:
            java-version: 21
            distribution: 'temurin'
        - name: Setup go
          uses: actions/setup-go@v5
          with:
            go-version: ${{ matrix.cloud_go.go }}
        - uses: actions/setup-python@v5
          with:
            python-version: '3.x'
            architecture: 'x64'
        - name: Test
          shell: cmd
          env:
            PARAMETERS_SECRET: ${{ secrets.PARAMETERS_SECRET }}
            GOLANG_PRIVATE_KEY_SECRET: ${{ secrets.GOLANG_PRIVATE_KEY_SECRET }}
            CLOUD_PROVIDER: ${{ matrix.cloud_go.cloud }}
            GO_TEST_PARAMS: ${{ inputs.goTestParams }}
            WIREMOCK_PORT: 14335
            WIREMOCK_HTTPS_PORT: 13567
          run: ci\\test.bat
        - name: Upload test results to Codecov
          if: ${{!cancelled()}}
          uses: codecov/test-results-action@v1
          with:
            token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}
        - name: Upload coverage to Codecov
          uses: codecov/codecov-action@v5
          with:
            token: ${{ secrets.CODE_COV_UPLOAD_TOKEN }}