ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  secret-scan:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Run gitleaks over full history
        run: |
          docker run --rm -v "$PWD:/repo" --entrypoint sh \
            ghcr.io/gitleaks/gitleaks:latest \
            -c 'git config --global --add safe.directory /repo &&
                gitleaks detect --source /repo --no-banner --redact'

  build-test:
    name: Build and test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
      - run: go build ./...
      - run: go test -race ./...
      # The e2e tests are behind a build tag and so are never compiled by the
      # run above; type-check them here so a changed signature cannot rot there
      # unnoticed. They still only execute against a kind cluster.
      - run: go vet -tags e2e ./...
      # The chart is the only installer, so `helm lint` runs on every profile a
      # customer can choose. The rendered output is asserted by the Go tests
      # above; this is the CLI's own opinion of the chart (ADR 0036).
      - run: make chart-lint
      # Reachability, not the module graph: this fails only on vulnerabilities
      # the code actually calls, standard library included (ADR 0038).
      - run: make vulncheck

  image:
    name: Image build and scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      # The image was built by hand until now, so a Dockerfile that does not
      # build reached main and was found by whoever next ran the e2e (ADR 0085).
      - run: docker build -t runtime-agent:ci --build-arg VERSION=ci .
      - name: Catalogue what the image holds
        run: |
          docker save runtime-agent:ci -o image.tar
          docker run --rm -v "$PWD:/w" anchore/syft:v1.52.0 \
            docker-archive:/w/image.tar -o json > sbom.json
      # A scanner that catalogues nothing reports nothing, which reads exactly
      # like a clean image. Six Debian packages and the binary's own module list
      # are what is in there; if either goes missing the scan is broken.
      - name: The catalogue is not empty
        run: |
          python3 - <<'PY'
          import json, collections
          kinds = collections.Counter(a["type"] for a in json.load(open("sbom.json"))["artifacts"])
          print(dict(kinds))
          assert kinds["deb"] >= 6, f"the base layer catalogued {kinds['deb']} packages"
          assert kinds["go-module"] >= 60, f"the binary catalogued {kinds['go-module']} modules"
          PY
      # Everything, including the Go findings that do not gate. Reported so the
      # decision not to fail on them stays visible rather than silent.
      - name: What the scanner found
        continue-on-error: true
        run: |
          docker run --rm -v "$PWD:/w" -w /w anchore/grype:v0.119.0 \
            sbom:/w/sbom.json -o table --show-suppressed
      # The gate: the base layer, where a fix exists. Go is govulncheck's, on
      # reachability (ADR 0038, .grype.yaml).
      - name: Gate on the base layer
        run: |
          docker run --rm -v "$PWD:/w" -w /w anchore/grype:v0.119.0 \
            sbom:/w/sbom.json --fail-on high --only-fixed

  lint:
    name: Lint (golangci-lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
      - uses: golangci/golangci-lint-action@v9
        with:
          # v2.13.2 rather than v2.11.4: a linter built with Go 1.26 refuses a
          # module targeting 1.27 outright, config unread (ADR 0086).
          version: v2.13.2
          # No analysis cache. On 2026-09-16 a restored one reported six
          # SA5011 findings in files the branch did not touch, twice, on a
          # tree byte-identical to a passing main; a cold run found none.
          # Seeing that `t.Fatal` does not return takes knowledge of the
          # testing package that a partial cache drops. 24s a run buys the
          # whole class of false red.
          skip-cache: true

  proto:
    name: Payload schema (buf)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          # buf compares against main out of this checkout, so it needs one.
          fetch-depth: 0
      - uses: bufbuild/buf-setup-action@v1
        with:
          version: 1.72.0
      - run: buf lint
      # Field numbers are never reused and removed ones stay reserved. This is
      # what enforces that, and with it the N-2 compatibility window in
      # `backend-requirements.md` §6 — not review vigilance (ADR 0074).
      - name: Check the schema against main
        run: |
          if git ls-tree -r --name-only origin/main -- proto | grep -q .; then
            buf breaking --against '.git#ref=origin/main'
          else
            echo "main carries no schema: this change is the one introducing it."
          fi