ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '17 6 * * 1'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    uses: pablontiv/crossbeam/.github/workflows/go-ci.yml@v2
    with:
      go-version-file: go.mod
      coverage-threshold: 85

  race:
    name: Race (${{ matrix.name }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: command
            command: >-
              go test -race -count=1 ./cmd/backscroll
              -run '^(Test.*(Concurrent|Coordination|CoordinateStartup|Cancellation|Canceled|Atomic|Goroutine|Staging|Signal|Lock)|TestProductionUpdater.*)$'
          - name: storage
            command: >-
              go test -race -count=1 ./internal/storage
              -run '^Test.*(Concurrent|Cancellation|Canceled|Atomic|TransactionGate|Busy|Lock|LiveWAL|EEXIST)'
          - name: runtime
            command: go test -race -count=1 ./internal/autoupdate ./internal/startuplock
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: Test concurrent code with the race detector
        run: ${{ matrix.command }}

  gitleaks:
    uses: pablontiv/crossbeam/.github/workflows/gitleaks.yml@v2

  durability:
    name: Native durability (${{ matrix.os }})
    if: github.event_name != 'pull_request'
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: Test real migration and recovery durability
        run: go test ./internal/storage ./internal/recovery -run '^TestDurability' -count=1

  skill-install:
    name: Skill install (${{ matrix.os }})
    if: github.event_name != 'pull_request'
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: Test native skill installation, presets, and recipe retrieval
        run: |
          test_home=$(mktemp -d)
          test_config=$(mktemp -d)
          gomodcache=$(go env GOMODCACHE)
          gocache=$(go env GOCACHE)
          trap 'rm -rf "$test_home" "$test_config"' EXIT
          HOME="$test_home" BACKSCROLL_CONFIG_DIR="$test_config" \
            GOMODCACHE="$gomodcache" GOCACHE="$gocache" \
            go test ./internal/skillinstall ./internal/presets ./cmd/backscroll
      - name: "Install-script bash regression suite (issue #74)"
        run: |
          env -u XDG_CONFIG_HOME \
              -u BACKSCROLL_INSTALL_DIR \
              -u BACKSCROLL_CONFIG_DIR \
              -u BACKSCROLL_INPUTS_SOURCE_DIR \
              bash tests/test-install.sh
          env -u XDG_CONFIG_HOME \
              -u BACKSCROLL_INSTALL_DIR \
              -u BACKSCROLL_CONFIG_DIR \
              -u BACKSCROLL_INPUTS_SOURCE_DIR \
              bash tests/test-install-isolation.sh

  candidate:
    needs: [ci, race, gitleaks]
    if: always() && github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    permissions: {}
    steps:
      - name: Require every merge gate to succeed
        env:
          CI_RESULT: ${{ needs.ci.result }}
          RACE_RESULT: ${{ needs.race.result }}
          GITLEAKS_RESULT: ${{ needs.gitleaks.result }}
        run: |
          set -euo pipefail
          for result in "$CI_RESULT" "$RACE_RESULT" "$GITLEAKS_RESULT"; do
            if [[ "$result" != success ]]; then
              echo "::error::required candidate dependency was $result"
              exit 1
            fi
          done

  release:
    uses: pablontiv/crossbeam/.github/workflows/go-release.yml@v2
    needs: [ci, race, gitleaks, durability, skill-install]
    if: github.event_name == 'push'
    with:
      quality-gate-jobs: '["ci","race","gitleaks","durability","skill-install"]'
      binary-name: backscroll
    permissions:
      contents: write
      id-token: write
      attestations: write