build.yaml

name: Build

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

permissions: read-all

jobs:
  build-matrix:
    env:
      RQ_VERSION: v0.0.9
    name: Matrix
    strategy:
      matrix:
        os:
          - runner: ubuntu-latest
            name: linux
            static: true
          - runner: macos-13
            name: macos-intel
            static: false
          - runner: macos-14
            name: macos-arm64
            static: true
    runs-on: ${{ matrix.os.runner }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version-file: go.mod
      - id: opa
        name: read OPA version
        run: echo "version=$(go list -m -f '{{.Version}}' github.com/open-policy-agent/opa)" >> $GITHUB_OUTPUT
      - uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
        with:
          version: ${{ steps.opa.outputs.version }}
          static: ${{ matrix.os.static }}
      - run: npm ci
        working-directory: build
      - name: Restore rq cache
        id: cache-rq
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: ~/go/bin/rq
          key: ${{ runner.os }}-${{ runner.arch }}-go-rq-${{ env.RQ_VERSION }}
      - run: go install git.sr.ht/~charles/rq/cmd/rq@${{ env.RQ_VERSION }}
        if: steps.cache-rq.outputs.cache-hit != 'true'
      - name: Cache rq binary
        if: steps.cache-rq.outputs.cache-hit != 'true'
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: ~/go/bin/rq
          key: ${{ runner.os }}-${{ runner.arch }}-go-rq-${{ env.RQ_VERSION }}
      - run: build/do.rq pull_request
      - uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
        if: matrix.os.name == 'linux'
        with:
          version: v1.60.3
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: regal-${{ matrix.os.name }}
          path: regal

  race_detector:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version-file: go.mod
      - run: go test -race ./...
        id: race
        continue-on-error: true
      - run: echo "race detector failed but job is optional"
        if: job.steps.race.status == failure()

  code_coverage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version-file: go.mod
      - id: opa
        name: read OPA version
        run: echo "version=$(go list -m -f '{{.Version}}' github.com/open-policy-agent/opa)" >> $GITHUB_OUTPUT
      - uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
        with:
          version: ${{ steps.opa.outputs.version }}
      - run: |
          go run main.go test --coverage bundle \
          | opa eval -f raw -I -d build/simplecov/simplecov.rego data.build.simplecov.from_opa \
          > coverage.json
      - uses: codecov/codecov-action@985343d70564a82044c1b7fcb84c2fa05405c1a2 # v5.0.4
        with:
          fail_ci_if_error: false
          files: ./coverage.json
          name: regal
          token: ${{ secrets.CODECOV_TOKEN }} # required