lint.yml

name: golangci-lint
on:
  workflow_dispatch:
  push:
    tags-ignore:
      - "*"
    branches:
      - main
    paths:
      - '*.go'
      - '**/*.go'
      - '.github/workflows/lint.yml'
  pull_request:
    paths:
      - '*.go'
      - '**/*.go'
      - '.github/workflows/lint.yml'

permissions:
  contents: read

env:
  GOTOOLCHAIN: local

jobs:
  golangci:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # ratchet:step-security/harden-runner@v2.11.1
        with:
          egress-policy: block
          disable-sudo: true
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            golangci-lint.run:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            raw.githubusercontent.com:443
            storage.googleapis.com:443

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # ratchet:actions/setup-go@v5
        with:
          go-version: '1.24'
          check-latest: true
          cache: true

      - name: golangci-lint
        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # ratchet:golangci/golangci-lint-action@v6
        with:
          version: latest
          args: --timeout 4m