go.yml

name: Go
on: [push]
jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v6.0.3
    - name: Install tools
      run: |
        make install
        echo "PATH=$(go env GOPATH)/bin:$PATH" >> $GITHUB_ENV
    - name: Install buf
      run: |
        URL=$(curl -s https://api.github.com/repos/bufbuild/buf/releases/latest | jq -r '.assets[] | select(.name=="buf-Linux-x86_64") | .browser_download_url')
        curl -sSL "$URL" -o /usr/local/bin/buf
        chmod +x /usr/local/bin/buf
    - name: Regenerate files
      run: make generate
    - name: Tidy
      run: go mod tidy
    - name: Build
      run: go build -v ./...
  test:
    name: Test
    runs-on: ubuntu-latest
    services:
      mariadb:
        # Matches the forum's major version and testdb/compose.yaml.
        image: mariadb:11.5
        env:
          # Throwaway credential for disposable fixture data; mirrored in
          # testdb/testdb.go and testdb/compose.yaml.
          MARIADB_ROOT_PASSWORD: harness
        ports:
          - 3310:3306
        options: >-
          --health-cmd="healthcheck.sh --connect --innodb_initialized"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=24
    steps:
    - name: Check out code
      uses: actions/checkout@v6.0.3
    # The service container is up for the whole job; this step is "no
    # harness" only in the sense that TESTDB_ADDR is left unset. Mirror
    # of the with-harness guard, inverted: a known harness-backed test
    # must visibly SKIP here. An any-skip grep would be satisfiable by a
    # single surviving skip while the rest of the gate drifted, and zero
    # skips has more than one cause (tests dialing a database despite
    # TESTDB_ADDR being unset, but also harness tests deleted or excluded
    # by build tags) — so require the same sentinel test the with-harness
    # step requires to PASS.
    - name: Test (TESTDB_ADDR unset — integration tests must skip)
      run: |
        set -euo pipefail
        go test -v ./testdb ./datastores 2>&1 | tee no-harness.log
        if ! grep -q -- '--- SKIP: TestValidateApiKey_ActiveKeyResolvesActiveScopes' no-harness.log; then
          echo "::error::sentinel harness test TestValidateApiKey_ActiveKeyResolvesActiveScopes did not SKIP with TESTDB_ADDR unset — either the skip gate has drifted (plain 'go test ./...' may now require a database) or the harness tests silently vanished"
          exit 1
        fi
        go test ./...
    # `go test ./...` prints identical output whether the integration
    # tests ran or all skipped, so env-wiring drift would silently turn
    # the harness suite into a no-op forever. Surface the verdicts of
    # both harness-backed packages (./testdb and the ./datastores
    # behavior tests) verbosely and fail loudly on any skip before
    # running the full suite.
    - name: Test with MariaDB harness
      run: |
        set -euo pipefail
        go test -v ./testdb ./datastores 2>&1 | tee harness.log
        if grep -q -- '--- SKIP' harness.log; then
          echo "::error::harness integration tests skipped despite TESTDB_ADDR being set — env wiring has drifted and the harness suite degraded to a no-op"
          exit 1
        fi
        # Positive sentinel: no-skips alone can't tell "ran" from
        # "absent". A renamed or missing package hard-errors `go test`
        # under pipefail, but deleted/renamed test FUNCTIONS or
        # build-tag-excluded files leave a package that resolves, runs
        # nothing, and greps clean. Require a known harness test to have
        # PASSED.
        if ! grep -q -- '--- PASS: TestValidateApiKey_ActiveKeyResolvesActiveScopes' harness.log; then
          echo "::error::sentinel harness test TestValidateApiKey_ActiveKeyResolvesActiveScopes did not run — the harness suite silently vanished from the verbose run"
          exit 1
        fi
        go test ./...
      env:
        TESTDB_ADDR: 127.0.0.1:3310
    # The race detector is load-bearing here, not belt-and-braces: the
    # sentry concurrency guard (rest/sentry_test.go, #132) is
    # deterministically red under -race against a shared-hub regression
    # but only probabilistically red without it (~80% per plain run).
    # More concurrency stacks on this surface from #131 on — the guard
    # must be live in CI, not just in branch gates.
    - name: Test with race detector
      run: go test -race ./...
      env:
        TESTDB_ADDR: 127.0.0.1:3310
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v6.0.3
    - name: Install tools
      run: make install
    - name: Install buf
      run: |
        URL=$(curl -s https://api.github.com/repos/bufbuild/buf/releases/latest | jq -r '.assets[] | select(.name=="buf-Linux-x86_64") | .browser_download_url')
        curl -sSL "$URL" -o /usr/local/bin/buf
        chmod +x /usr/local/bin/buf
    - name: Lint
      run: make lint