ci.yaml

name: CI

on:
  push:
    branches: [main]
    tags-ignore: ['v*']
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

permissions:
  contents: read

jobs:
  # Pipelock scans the PR diff before anything else runs. If the scan
  # finds credential leaks, injection patterns, or security misconfigs,
  # all downstream jobs are skipped — no compromised code executes.
  security-scan:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Pipelock Scan
        uses: luckyPipewrench/pipelock@7a3b7de4a5552b4e756eb930256468b7cbd616b1 # v2
        with:
          scan-diff: 'true'
          fail-on-findings: 'true'
          test-vectors: 'false'
          exclude-paths: |
            internal/scanner/scanner_test.go
            internal/scanner/scan_env_test.go
            internal/scanner/text_dlp_test.go
            internal/scanner/validate_test.go
            internal/proxy/intercept_test.go
            internal/proxy/forward_test.go
            internal/proxy/adaptive_escalation_test.go
            internal/proxy/adaptive_coverage_test.go
            internal/proxy/allowlist_scoring_test.go
            internal/proxy/session_api.go
            internal/cli/session/resolver.go
            internal/gitprotect/diffscan_test.go
            internal/config/config_test.go
            internal/cli/test.go
            internal/cli/license_test.go
            enterprise/licenseservice/*_test.go
            configs/*.yaml
            test/secureiqlab/
            README.md
            assets/demo.cast
            scripts/pr-review.py
            docs/attacks-blocked.md
            docs/bypass-resistance.md
            docs/configuration.md
            docs/scan-api.md
            docs/guides/deployment-recipes.md
            docs/guides/tls-interception.md
            examples/demo-readme.sh
            examples/sample-events.jsonl
            examples/quickstart/
            internal/contract/testdata/golden/
            internal/contract/testdata/invalid/
            internal/signing/testdata/golden/

  test:
    needs: [security-scan]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      matrix:
        go-version: ['1.25', '1.26']
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: ${{ matrix.go-version }}

      - name: Verify dependencies
        run: go mod verify

      - name: Download dependencies
        run: go mod download

      - name: Replay harness (deterministic regression)
        run: make test-replay-harness

      - name: Run tests (OSS)
        run: go test -race -count=1 ./...

      - name: Run tests (enterprise)
        run: go test -tags enterprise -race -count=1 -coverprofile=coverage.out ./...

      - name: Upload coverage
        if: matrix.go-version == '1.25'
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v5
        with:
          files: ./coverage.out
          fail_ci_if_error: false

  test-macos:
    needs: [security-scan]
    runs-on: macos-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: '1.26'

      - name: Run sandbox tests (macOS seatbelt)
        run: go test -race -count=1 ./internal/sandbox/...

      - name: Verify cross-platform build
        run: go build ./...

  lint:
    needs: [security-scan]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: '1.25'

      - name: golangci-lint (OSS)
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
        with:
          version: v2.10.1
          skip-cache: true

      - name: golangci-lint (enterprise)
        run: golangci-lint run --build-tags enterprise ./...

      - name: Python pin policy
        run: bash scripts/check-python-pins.sh

  govulncheck:
    needs: [security-scan]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          # 1.26.3 patches GO-2026-4982 / GO-2026-4980 / GO-2026-4976
          # in html/template + net/http/httputil. 1.26.2 was clean
          # when this version was pinned; the advisories landed
          # 2026-05-07.
          go-version: '1.26.3'

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4

      - name: Run govulncheck
        run: govulncheck ./...

  build:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: [security-scan, test, lint]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: '1.25'

      - name: Build binary
        run: |
          VERSION=$(git describe --tags --always --dirty 2>/dev/null || echo "0.1.0-dev")
          go build -trimpath -ldflags "-s -w \
            -X github.com/luckyPipewrench/pipelock/internal/cliutil.Version=$VERSION \
            -X github.com/luckyPipewrench/pipelock/internal/proxy.Version=$VERSION" \
            -o pipelock ./cmd/pipelock

      - name: Verify binary runs
        run: ./pipelock --version

      - name: Build binary (enterprise)
        run: |
          VERSION=$(git describe --tags --always --dirty 2>/dev/null || echo "0.1.0-dev")
          go build -tags enterprise -trimpath -ldflags "-s -w \
            -X github.com/luckyPipewrench/pipelock/internal/cliutil.Version=$VERSION \
            -X github.com/luckyPipewrench/pipelock/internal/proxy.Version=$VERSION" \
            -o pipelock-enterprise ./cmd/pipelock

      - name: Verify enterprise binary runs
        run: ./pipelock-enterprise --version

      - name: Cross-build Windows binaries (enterprise)
        run: |
          GOOS=windows GOARCH=amd64 go build -tags enterprise -trimpath -o /tmp/pipelock-windows-amd64.exe ./cmd/pipelock
          GOOS=windows GOARCH=arm64 go build -tags enterprise -trimpath -o /tmp/pipelock-windows-arm64.exe ./cmd/pipelock