open-vault/.github/workflows/code-checker.yml

name: Run linters

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches:
      - main
      - release/**

concurrency:
  group: ${{ github.head_ref || github.run_id }}-lint
  cancel-in-progress: true

jobs:
  deprecations:
    name: Deprecated functions
    runs-on: ubuntu-latest
    if: github.base_ref == 'main'
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0
      - uses: ./.github/actions/set-up-go
        with:
          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
      - run: make ci-deprecations
        name: Check deprecations

  codechecker:
    name: Code checks
    runs-on: ubuntu-latest
    if: github.base_ref == 'main'
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0
      - uses: ./.github/actions/set-up-go
        with:
          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
        # Note: if there is a function we want to ignore the nilnil check for,
        # You can add 'ignore-nil-nil-function-check' somewhere in the
        # godoc for the function.
      - run: make ci-vet-codechecker
        name: Check custom linters

  format:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - uses: ./.github/actions/set-up-go
        with:
          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
      - name: Go format
        run: |
          make ci-bootstrap
          echo "Using gofumpt version $(go run mvdan.cc/gofumpt -version)"
          make fmt
          if ! git diff --exit-code; then
            echo "Code has formatting errors. Run 'make fmt' to fix"
            exit 1
          fi

  semgrep:
    name: Semgrep
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep@sha256:ffc6f3567654f9431456d49fd059dfe548f007c494a7eb6cd5a1a3e50d813fb3
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - name: Run Semgrep Rules
        id: semgrep
        run: semgrep ci --include '*.go' --config 'tools/semgrep/ci'