go-cli.yml

name: Go CLI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  workflow_dispatch: {}
  schedule:
    # Daily 06:00 UTC: the full runtime parity matrix + publish parity. On
    # push/PR only the cases affected by the change run (see parity-runtime).
    - cron: "0 6 * * *"

jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      code-quality: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - uses: go-task/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - run: task lint
      - run: task spec:compliance
      - run: task vuln
      - run: task test:race
      - run: task coverage
      - name: Coverage summary
        if: always()
        run: go run ./cmd/devtool coverage-report coverage.out "unit (hermetic)" >> "$GITHUB_STEP_SUMMARY"
      - run: task test:integration
      - run: task build
      - run: ./devcontainer --version

      # Convert the Go coverage profile (coverage.out) to Cobertura XML for
      # GitHub's native Code Quality feature.
      - name: Convert coverage to Cobertura XML
        run: |
          go install github.com/boumenot/gocover-cobertura@latest
          gocover-cobertura < coverage.out > coverage.xml
      - name: Upload coverage report
        uses: actions/upload-code-coverage@v1
        with:
          file: coverage.xml
          language: Go
          label: code-coverage/go

      # Binary covdata for the cross-lane merge (coverage-report job).
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: covdata-unit
          path: artifacts/coverage/data/unit
          if-no-files-found: error

  e2e:
    runs-on: ubuntu-latest
    needs: lint-and-test
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - uses: go-task/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - run: task coverage:e2e
      - name: Coverage summary
        if: always()
        run: go run ./cmd/devtool coverage-report artifacts/coverage/data/e2e "e2e" >> "$GITHUB_STEP_SUMMARY"
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: covdata-e2e
          path: artifacts/coverage/data/e2e
          if-no-files-found: error
      - if: always()
        run: task clean

  # Hermetic parity gate: read-configuration golden comparison + the contract
  # lane of the parity matrix (flag validation / output contract, no Docker).
  parity:
    runs-on: ubuntu-latest
    needs: lint-and-test
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - uses: actions/setup-node@v6
        with:
          node-version: "20"
      - uses: go-task/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - run: task reference
      - run: task parity:contract
      - run: task parity:network
      # Coverage is measured separately with an instrumented Go binary. Keep the
      # functional parity run above release-like, and avoid conflating subprocess
      # coverage with the hermetic unit profile.
      - run: task coverage:parity-contract
      - name: Coverage summary
        if: always()
        run: go run ./cmd/devtool coverage-report artifacts/coverage/data/contract "parity:contract" >> "$GITHUB_STEP_SUMMARY"
      - if: always()
        run: |
          mkdir -p artifacts
          git -C reference rev-parse HEAD > artifacts/reference-commit.txt
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: parity-contract-network-v0.88.0
          path: artifacts/
          if-no-files-found: error
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: covdata-contract
          path: artifacts/coverage/data/contract
          if-no-files-found: error

  # "Did the repo change today?" gate for the expensive daily lanes. Manual dispatch
  # always runs; a scheduled run only proceeds when HEAD has a commit within the last
  # day (devtool daily-changed) — on a private/billed repo this skips the daily matrix
  # on quiet days. Runs on schedule/dispatch so the daily lanes' `needs:` is satisfied.
  daily-changes:
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    outputs:
      run: ${{ steps.check.outputs.run }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - id: check
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "manual dispatch → always run" >&2
            echo "run=true" >> "$GITHUB_OUTPUT"
          else
            go run ./cmd/devtool daily-changed >> "$GITHUB_OUTPUT"
          fi

  # Single sharded runtime parity matrix, parameterized by event:
  #   push/PR — SCOPED to the commands the diff can affect (devtool parity-affected),
  #             run with the plain binary: a fast gate (the full matrix is ~45 min).
  #   daily   — the FULL matrix with the instrumented binary, so one run gates parity
  #             AND measures coverage; daily-changes keeps it off on quiet days.
  # 4 shards across independent runners (each its own docker daemon) so the matrix
  # never contends for one runner's CPU/disk/daemon. PARITY_SHARD_TOTAL MUST equal the
  # length of matrix.shard — parity_sharding_workflow_test.go enforces it so a mismatch
  # can't silently drop cases.
  parity-runtime:
    needs: [lint-and-test, daily-changes]
    # Every push/PR, and on schedule/dispatch only when the repo changed. always() so a
    # skipped daily-changes (push/PR) doesn't skip this job; the explicit lint-and-test
    # check restores the normal "needs succeeded" gate.
    if: >-
      always()
      && needs.lint-and-test.result == 'success'
      && (github.event_name == 'push' || github.event_name == 'pull_request'
          || needs.daily-changes.outputs.run == 'true')
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3]
    env:
      PARITY_RUNTIME_TIMEOUT: "10m"
      # Each shard owns ~a quarter of the selected cases; -parallel 2 per 2-core runner
      # is the proven-safe load (per-case id-label / COMPOSE_PROJECT_NAME isolation).
      PARITY_PARALLEL: "2"
      PARITY_SHARD_INDEX: ${{ matrix.shard }}
      PARITY_SHARD_TOTAL: "4"
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
          # Full history so the push/PR diff base is present for the affected mapping.
          fetch-depth: 0
      # devtool (the affected mapping) runs before the composite setup, so Go here.
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - name: Plan this run
        id: plan
        run: |
          if [ "${{ github.event_name }}" = "push" ] || [ "${{ github.event_name }}" = "pull_request" ]; then
            if [ "${{ github.event_name }}" = "pull_request" ]; then
              base="${{ github.event.pull_request.base.sha }}"; head="${{ github.event.pull_request.head.sha }}"
            else
              base="${{ github.event.before }}"; head="${{ github.sha }}"
            fi
            go run ./cmd/devtool parity-affected-commands "$base" "$head" >> "$GITHUB_OUTPUT"
          else
            # daily: the full matrix (this job only runs when daily-changes said so).
            echo "run=true" >> "$GITHUB_OUTPUT"
            echo "commands=all" >> "$GITHUB_OUTPUT"
          fi
      - if: steps.plan.outputs.run == 'true'
        uses: ./.github/actions/setup-parity-runtime
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      # push/PR: scoped, plain binary — a fast gate.
      - name: Run parity (scoped, plain)
        if: steps.plan.outputs.run == 'true' && (github.event_name == 'push' || github.event_name == 'pull_request')
        env:
          PARITY_COMMAND: ${{ steps.plan.outputs.commands }}
        run: task parity:runtime
      # daily: full matrix, instrumented binary — gates parity AND measures coverage.
      - name: Run parity (full, instrumented)
        if: steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
        run: task coverage:parity-runtime
      - name: Coverage summary
        if: always() && steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
        run: go run ./cmd/devtool coverage-report artifacts/coverage/data/runtime "parity:runtime shard ${{ matrix.shard }}" >> "$GITHUB_STEP_SUMMARY"
      - if: always() && steps.plan.outputs.run == 'true'
        run: |
          mkdir -p artifacts
          git -C reference rev-parse HEAD > artifacts/reference-commit.txt
      - uses: actions/upload-artifact@v7
        if: always() && steps.plan.outputs.run == 'true'
        with:
          name: parity-runtime-v0.88.0-shard-${{ matrix.shard }}
          path: artifacts/
          if-no-files-found: error
      # daily only: covdata slice for the cross-lane merge (distinct name per shard).
      - uses: actions/upload-artifact@v7
        if: always() && steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
        with:
          name: covdata-runtime-shard-${{ matrix.shard }}
          path: artifacts/coverage/data/runtime
          if-no-files-found: error
      - if: always() && steps.plan.outputs.run == 'true'
        run: task clean

  # Publish parity (features/templates → ephemeral OCI registry). Daily only, its own
  # job so it doesn't steal a runtime shard's runner.
  parity-publish-full:
    needs: [lint-and-test, daily-changes]
    if: needs.daily-changes.outputs.run == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
      - uses: ./.github/actions/setup-parity-runtime
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - run: task coverage:parity-publish
      - name: Coverage summary
        if: always()
        run: go run ./cmd/devtool coverage-report artifacts/coverage/data/publish "parity:publish" >> "$GITHUB_STEP_SUMMARY"
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: covdata-publish
          path: artifacts/coverage/data/publish
          if-no-files-found: error
      - if: always()
        run: task clean

  # Single gate + cross-lane coverage for ALL events (absorbs the old push/PR
  # parity-runtime aggregator, the daily report, and the per-PR coverage-report):
  # gates the runtime matrix (and, on daily, publish) into one pass/fail, and merges
  # every lane's covdata (unit + e2e + contract, plus the daily runtime shards +
  # publish) into the one true cross-lane number.
  parity-runtime-gate:
    if: always()
    runs-on: ubuntu-latest
    needs: [lint-and-test, e2e, parity, parity-runtime, parity-publish-full]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - uses: go-task/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Download all lane covdata
        uses: actions/download-artifact@v8
        with:
          pattern: covdata-*
          path: artifacts/coverage/data
      # download-artifact nests each artifact under covdata-<lane>/; flatten to <lane>/
      # so coverage:merge sees one dir per lane (the runtime shards stay distinct).
      - name: Normalize lane dirs
        run: |
          cd artifacts/coverage/data
          for d in covdata-*; do [ -d "$d" ] && mv "$d" "${d#covdata-}"; done
          ls -R . || true
      - name: Merged coverage report
        run: task coverage:merge | tee -a "$GITHUB_STEP_SUMMARY"
      - uses: actions/upload-artifact@v7
        with:
          name: covdata-merged
          path: artifacts/coverage/data/merged.out
          if-no-files-found: warn
      # Final verdict last, so coverage is posted even when a shard failed. A skipped
      # lane (publish on push/PR, or the whole matrix on a quiet daily) counts as pass.
      - name: Gate on runtime + publish
        run: |
          runtime="${{ needs.parity-runtime.result }}"
          publish="${{ needs.parity-publish-full.result }}"
          echo "runtime: $runtime, publish: $publish"
          for r in "$runtime" "$publish"; do
            case "$r" in
              success|skipped) ;;
              *) echo "runtime/publish parity failed"; exit 1 ;;
            esac
          done

  cross-compile:
    runs-on: ubuntu-latest
    needs: lint-and-test
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - uses: go-task/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - run: task build:cross
      - run: ls -lh dist/