ci.yml

name: CI

on:
  pull_request:
    branches: [ main, 'release/**' ]
  push:
    branches: [ main, 'release/**' ]

env:
  GO_VERSION: '1.26.6'
  GOFLAGS: '-trimpath'

permissions:
  contents: read

jobs:
  secret-detection:
    name: Secret Detection
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Fetch full history for comprehensive scanning

      - name: Set up Python
        run: |
          # Ensure Python and pip are available
          python3 --version
          pip3 --version

      - name: Install detect-secrets
        run: |
          # Install detect-secrets from PyPI with user flag to avoid permission issues
          pip3 install --user detect-secrets
          # Add user bin to PATH
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Run detect-secrets scan
        run: |
          # Scan for new secrets not in baseline
          echo "Scanning for secrets..."
          if detect-secrets scan --baseline .secrets.baseline --all-files; then
            echo "No new secrets detected!"
          else
            echo "New secrets detected!"
            echo "::error::New secrets found that are not in the baseline"
            echo ""
            echo "To fix this:"
            echo "1. Review the detected secrets above"
            echo "2. If they are false positives, run: detect-secrets scan --update .secrets.baseline"
            echo "3. If they are real secrets, remove them from the code"
            echo "4. Commit the updated .secrets.baseline file"
            exit 1
          fi

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Download dependencies
        run: go mod download

      - name: Clean previous lint cache
        run: |
          rm -rf ~/.cache/golangci-lint || true
          mkdir -p ~/.cache/golangci-lint

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v8
        with:
          version: latest
          args: --timeout=5m

      # otelcol/auth/sakauth is a separate Go module, so the root run above does
      # not descend into it. It resolves the same root .golangci.yml.
      - name: Run golangci-lint (sakauth module)
        uses: golangci/golangci-lint-action@v8
        with:
          version: latest
          working-directory: otelcol/auth/sakauth
          args: --timeout=5m

      - name: Check license headers in third_party
        run: |
          missing=$(find third_party -name "*.go" | xargs grep -rL "Copyright\|SPDX" 2>/dev/null)
          if [ -n "$missing" ]; then
            echo "ERROR: missing license header in:"
            echo "$missing" | sed 's/^/  /'
            exit 1
          fi

      - name: Run govulncheck
        run: make vuln

  unit_test:
    name: Unit Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Download dependencies
        run: go mod download

      - name: Clean previous test artifacts
        run: |
          rm -rf ./coverage || true
          mkdir -p ./coverage

      - name: Run unit tests
        run: make test

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          # "file" was renamed to "files" in v5.
          files: ./coverage/coverage.out
          flags: unittests
          name: codecov-umbrella
          # Coverage upload is informational; a Codecov outage must not fail CI.
          fail_ci_if_error: false

  build_check:
    name: Build Check
    runs-on: ubuntu-latest
    needs: [lint]
    strategy:
      matrix:
        goos: [linux]
        goarch: [amd64, arm64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Download dependencies
        run: go mod download

      - name: Install ARM64 cross compiler
        if: matrix.goarch == 'arm64'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu

      - name: Clean previous build artifacts
        run: |
          rm -f fleetint-${{ matrix.goos }}-${{ matrix.goarch }} || true

      - name: Build all packages
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 1
          CC: ${{ matrix.goarch == 'arm64' && 'aarch64-linux-gnu-gcc' || 'gcc' }}
          CXX: ${{ matrix.goarch == 'arm64' && 'aarch64-linux-gnu-g++' || 'g++' }}
        run: go build ./...

      - name: Smoke build main binary
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 1
          CC: ${{ matrix.goarch == 'arm64' && 'aarch64-linux-gnu-gcc' || 'gcc' }}
          CXX: ${{ matrix.goarch == 'arm64' && 'aarch64-linux-gnu-g++' || 'g++' }}
        run: go build -o fleetint-${{ matrix.goos }}-${{ matrix.goarch }} ./cmd/fleetint

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: fleetint-${{ matrix.goos }}-${{ matrix.goarch }}
          path: fleetint-${{ matrix.goos }}-${{ matrix.goarch }}
          retention-days: 7

  build_check_otelcol:
    name: Build Check (otelcol)
    runs-on: ubuntu-latest
    needs: [lint]
    strategy:
      matrix:
        goarch: [amd64, arm64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # This job installs and executes third-party tooling (the OTel
          # Collector Builder and its transitive dependencies). Do not leave
          # GITHUB_TOKEN in the git config where that tooling can read it.
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Install OTel Collector Builder
        run: go install go.opentelemetry.io/collector/cmd/builder@v0.156.0

      - name: Build fleetint-otelcol
        working-directory: otelcol
        env:
          GOOS: linux
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 0
        run: builder --config=otelcol-builder.yaml

      # The sakauth unit and config tests run in the unit_test job, since
      # `make test` now descends into the nested module. This step covers only
      # the integration test, which needs the collector binary built above and
      # self-skips without FLEETINT_OTELCOL_INTEGRATION=1.
      # Only on amd64: the runner cannot execute arm64 test binaries.
      - name: Run OTel gateway integration test
        if: matrix.goarch == 'amd64'
        working-directory: otelcol/auth/sakauth
        env:
          FLEETINT_OTELCOL_INTEGRATION: "1"
        run: go test -race -run '^TestCollectorGatewayEndToEnd$' .

  codeql:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Download dependencies
        run: go mod download

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: go
          build-mode: manual
        env:
          CODEQL_EXTRACTOR_GO_BUILD_TRACING: on

      - name: Build with CodeQL
        run: go build ./...

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:go"