name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "1.25"
          check-latest: true

      - name: gofmt
        shell: bash
        run: |
          out=$(gofmt -l .)
          if [ -n "$out" ]; then
            echo "gofmt found unformatted files:"
            echo "$out"
            exit 1
          fi

      - name: go vet
        run: go vet ./...

      - name: go test (race)
        run: go test -race ./...

      - name: go build
        run: go build -buildvcs=false ./cmd/bumblebee

      - name: bumblebee selftest
        run: |
          go build -buildvcs=false -o ./bumblebee ./cmd/bumblebee
          ./bumblebee selftest

  govulncheck:
    name: govulncheck
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "1.25"
          check-latest: true

      - name: install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@v1.3.0

      - name: govulncheck
        run: govulncheck ./...
