ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: gofmt
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "These files are not gofmt-clean:"; echo "$unformatted"; exit 1
          fi
      - name: go vet
        run: go vet ./...
      - name: staticcheck
        run: go run honnef.co/go/tools/cmd/staticcheck@latest ./...
      - name: build
        run: go build ./...
      - name: test
        run: go test -race ./...
      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
      - name: gosec
        # Triaged-accepted under the private systemd StateDirectory= deployment: G304/G703
        # (operator-controlled config / STATE_DIRECTORY paths) and G706 (log taint on operator /
        # Telegram-supplied values, consumed by journald). The gate fails on any OTHER finding.
        run: go run github.com/securego/gosec/v2/cmd/gosec@latest -exclude=G304,G703,G706 ./...