build.yml

name: build

on:
  push:
    branches:
      - "main"
  pull_request:
    paths:
      - "go.*"
      - "**/*.go"
      - "Dockerfile"
      - ".github/workflows/*.yml"

permissions:
  contents: read

jobs:
  govulncheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: 1.21.5
      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: dgryski/semgrep-go
          path: rules
      - name: semgrep
        run: semgrep scan --error --enable-nosem -f ./rules .
  ruleguard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: dgryski/semgrep-go
          path: rules
      - uses: actions/setup-go@v5
        with:
          go-version: 1.21.5
      - name: setup-ruleguard
        run: go install github.com/quasilyte/go-ruleguard/cmd/ruleguard@latest
      - name: ruleguard
        run: |
          mv rules ../
          go get -u github.com/quasilyte/go-ruleguard/dsl@latest
          ruleguard -c=0 -rules ../rules/ruleguard.rules.go ./...
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: 1.21.5
      - uses: arduino/setup-task@v1
        with:
          version: 3.x
          repo-token: ${{ secrets.GH_TOKEN }}
      - name: setup-tparse
        run: go install github.com/mfridman/tparse@latest
      - name: setup
        run: |
          task setup
          task build
      - name: test
        run: ./scripts/test.sh
      - uses: codecov/codecov-action@v3
        with:
          file: ./coverage.txt
          token: ${{ secrets.CODECOV_TOKEN }}