ci.yml

# The gate on every change: `task lint`, `task test` and `task mutate`, the targets a developer
# runs, and not a list of steps here that goes out of step with them - taskgate holds every step
# to one task.
name: CI

on:
  push:
    branches: [main]
  pull_request:

# Only the tip of a branch is worth a verdict. Never on main: a cancelled run there is a commit
# nobody proved.
concurrency:
  group: ci-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: ${{ github.ref_name != 'main' }}

permissions:
  contents: read

jobs:
  gate:
    # The check main's ruleset requires, named Gate in every spin-stack repository.
    name: Gate
    runs-on: ubuntu-latest
    # A ceiling, not a budget: a `go test` that deadlocks would otherwise hold the runner for six
    # hours without printing a failure.
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # task mutate diffs against the branch point, which a shallow clone does not have.
          fetch-depth: 0

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      # Task is pinned in versions.yaml like every other input: TASK_VERSION and TASK_SHA256.
      - name: Task's pin
        run: go run ./cmd/versions env task >> "$GITHUB_ENV"

      - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
        with:
          version: ${{ env.TASK_VERSION }}
          checksum: ${{ env.TASK_SHA256 }}

      - name: Lint
        run: task lint

      - name: Test
        run: task test

      # always(): a failed suite is when the per-function numbers are wanted.
      - name: Coverage summary
        if: always()
        run: task coverage

      - name: Upload Go coverage HTML
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage-go
          path: coverage.html
          retention-days: 7
          if-no-files-found: ignore

      # The tests are green; this asks what they would have refused. On a pull request the diff is
      # against what it merges into, on a push against what was there before (task mutate says how).
      - name: What this change broke, and whether a test noticed
        env:
          BEFORE: ${{ github.event.before }}
        run: task mutate