lint.yml

name: Lint

on:
  workflow_call:
    inputs:
      run-lint:
        type: boolean
        description: "Whether to run package linting"
        required: false
        default: true

permissions:
  contents: read

jobs:
  detect-modules:
    if: ${{ inputs.run-lint == true }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      modules: ${{ steps.set-modules.outputs.modules }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Full history so we can diff against the PR base to find changed modules.
          fetch-depth: 0
      - id: set-modules
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail

          all_modules=$(go list -m -json | jq -s -c '[.[].Dir]')

          # Files changed by this PR (repo-relative paths), vs the base merge-base.
          changed=$(git diff --name-only "${BASE_SHA}...HEAD")

          # Changes to workspace-wide inputs affect linting of every module,
          # so lint them all in that case.
          if printf '%s\n' "$changed" | grep -qE '^(go\.work|go\.work\.sum|\.golangci\.yml|\.tool-versions)$'; then
            echo "Workspace-wide change detected; linting all modules."
            echo "modules=${all_modules}" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Otherwise, select only the modules that contain a changed file.
          root="$(pwd)"
          selected=$(go list -m -json | jq -r '.Dir' | while read -r dir; do
            rel="${dir#"$root"/}"
            while IFS= read -r f; do
              if [[ "$f" == "$rel"/* ]]; then printf '%s\n' "$dir"; break; fi
            done <<< "$changed"
          done | jq -R . | jq -s -c 'map(select(length > 0)) | unique')

          echo "Changed modules: ${selected}"
          echo "modules=${selected}" >> "$GITHUB_OUTPUT"

  golangci-lint:
    needs: detect-modules
    # Skip cleanly when no Go modules changed. An empty matrix would otherwise
    # make this job's result 'failure' (not 'skipped') for the aggregate below.
    if: ${{ inputs.run-lint == true && needs.detect-modules.outputs.modules != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        modules: ${{ fromJSON(needs.detect-modules.outputs.modules) }}
      fail-fast: false
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Go
        uses: ./.github/actions/go-setup-cache
        with:
          cache-dependency-paths: |
            go.work
            ${{ matrix.modules }}/go.mod
            ${{ matrix.modules }}/go.sum

      - name: Parse .tool-versions
        uses: wistia/parse-tool-versions@32f568a4ffd4bfa7720ebf93f171597d1ebc979a # v2.1.1

      - name: golangci-lint ${{ matrix.modules }}
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: "v${{ env.GOLANGCI_LINT }}"
          working-directory: ${{ matrix.modules }}

          # Only report issues introduced by this PR (on changed lines), not
          # pre-existing issues in files the PR didn't touch. Uses the PR patch
          # from the GitHub API, so no extra git history is needed.
          only-new-issues: true

          # disable, as it randomly fails with the following error:
          # The command is terminated due to an error: [../../.golangci.yml] validate: compile schema: failing loading "https://golangci-lint.run/jsonschema/golangci.v2.11.jsonschema.json": Get "https://golangci-lint.run/jsonschema/golangci.v2.11.jsonschema.json": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
          verify: 'false'

  lint:
    needs:
      - detect-modules
      - golangci-lint
    if: ${{ always() }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Aggregate lint result
        run: |
          if [[ "${{ inputs.run-lint }}" != "true" ]]; then
            echo "lint skipped because lint inputs did not change"
            exit 0
          fi

          if [[ "${{ needs.detect-modules.result }}" != "success" ]]; then
            echo "detect modules result: ${{ needs.detect-modules.result }}"
            exit 1
          fi

          # "skipped" is expected when no Go modules changed (empty matrix).
          if [[ "${{ needs.golangci-lint.result }}" != "success" && "${{ needs.golangci-lint.result }}" != "skipped" ]]; then
            echo "golangci-lint result: ${{ needs.golangci-lint.result }}"
            exit 1
          fi

          echo "lint succeeded"