goLint.yml

on:
  workflow_call:
    inputs:
      runs-on:
        required: false
        type: string
        default: ubuntu-latest
      os-dependencies:
        required: false
        type: string
      goprivate:
        required: false
        type: string
        default: go.step.sm/,github.com/smallstep/
      golangci-lint-version:
        required: false
        type: string
        default: latest
      golangci-lint-args:
        required: false
        type: string
        default: "--timeout=30m"
      skip-go-generate:
        required: false
        type: boolean
        default: false
      skip-go-mod-tidy:
        required: false
        type: boolean
        default: true
    secrets:
      SSH_PRIVATE_KEY:
        required: false
      PAT:
        required: false

permissions:
  contents: read

jobs:
  lint:
    runs-on: ${{ inputs.runs-on }}
    env:
      GOPRIVATE: ${{ inputs.goprivate }}
    steps:
      - name: Install Dependencies # Some dependencies require this package
        if: ${{ inputs.os-dependencies != '' }}
        shell: bash
        env:
          OS_DEPS: ${{ inputs.os-dependencies }}
        run: |
          case "${RUNNER_OS}" in
            Linux)
              sudo apt-get update
              # shellcheck disable=SC2086
              sudo apt-get install -y ${OS_DEPS}
              ;;
            macOS)
              # shellcheck disable=SC2086
              brew install ${OS_DEPS}
              ;;
            Windows)
              # shellcheck disable=SC2086
              choco install -y ${OS_DEPS}
              ;;
            *)
              echo "unsupported RUNNER_OS=${RUNNER_OS}" >&2
              exit 1
              ;;
          esac

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: true
          ssh-key: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: Setup Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          check-latest: true
          cache: true
          cache-dependency-path: "**/go.sum"

      - name: Setup SSH key for private dependencies
        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        if: ${{ env.SSH_PRIVATE_KEY != '' }}
        with:
          ssh-private-key: |
            ${{ secrets.SSH_PRIVATE_KEY }}

      - name: Configure Linter
        id: configure-linter
        if: ${{ hashFiles('.golangci.yml', '.golangci.yaml', '.golangci.toml', '.golangci.json') == '' }}
        shell: bash
        run: |
          # GH Actions runs `bash --noprofile --norc -eo pipefail`; `-u` is added on top
          # so a typo in a variable name fails loudly instead of expanding to empty.
          set -euo pipefail

          CONFIG="${RUNNER_TEMP}/golangci-lint-fallback.yml"
          curl -fsSL --output "${CONFIG}" https://raw.githubusercontent.com/smallstep/workflows/main/.golangci.yml
          echo "extra-args=--config=${CONFIG}" >> "${GITHUB_OUTPUT}"

      - name: Reconfigure Git for private repos
        env:
          PAT: ${{ secrets.PAT }}
        if: ${{ env.PAT != '' }}
        run: |
          git config --global url.https://${{ secrets.PAT }}@github.com/.insteadOf git+ssh://git@github.com
          git config --global url.git@github.com:.insteadOf https://github.com/

      - name: Check that go.mod is tidied
        if: inputs.skip-go-mod-tidy == false
        run: go mod tidy -diff

      - name: Run Linter
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        if: success() || failure() # run this step even if the previous one failed
        with:
          version: ${{ inputs.golangci-lint-version }}
          args: "${{ steps.configure-linter.outputs.extra-args }} ${{ inputs.golangci-lint-args }}"
          verify: true

      - name: Run go generate
        if: ( success() || failure() ) && !inputs.skip-go-generate
        shell: bash
        run: |
          # GH Actions runs `bash --noprofile --norc -eo pipefail`; `-u` is added on top
          # so a typo in a variable name fails loudly instead of expanding to empty.
          set -euo pipefail

          # delete all go-generated files (that adhere to the comment convention); protobuf code is
          # excluded, because its output is (currently) not fully controlled by tools.go
          {
              git grep -lz "^// Code generated .* DO NOT EDIT\.$" \
                  -- ':(glob)**/*.go' ':(exclude,glob)**/*.pb.go' \
                  || [ $? -eq 1 ]
          } | while IFS= read -r -d '' file; do
              rm -f "$file"
          done

          # now generate everything
          go generate ./...

          # check that no files were modified or left untracked
          status="$(git status --porcelain)"
          if [ -n "$status" ]; then
              # intent-to-add lets git diff include new untracked files as full additions
              git add -N .

              DIFF=$(mktemp "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/go-generate-diff.XXXXXX")
              trap 'rm -f "${DIFF}"' EXIT
              git --no-pager diff > "${DIFF}"

              {
                echo "### ❌ Generated files are not up to date"
                echo
                echo "One or more files generated by \`go generate ./...\` differ from what's committed."
                echo "Please run \`go generate ./...\` locally and commit the result."
                echo
                echo "Here's the diff:"
                echo
                echo "\`\`\`diff"
                cat "${DIFF}"
                echo "\`\`\`"
              } >> "${GITHUB_STEP_SUMMARY}"

              echo "::error title=Generate check failed::Generated files are not up to date. Run 'go generate ./...' to fix."
              echo "::group::View Generate Diff"
              cat "${DIFF}"
              echo "::endgroup::"

              exit 1
          fi