ci.yml

# Continuous integration: build and test the project on every push and PR.
#
# Runs on Linux and macOS so that platform-specific code paths (keychain,
# unix-domain socket facade, sandbox launchers) are exercised.
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Verify module tidy
        run: |
          go mod download
          go mod verify

      - name: go vet
        run: go vet ./...

      - name: Build
        run: go build -v ./...

      - name: Test
        run: go test -race -count=1 -timeout=5m ./...

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: gofmt
        run: |
          unformatted=$(gofmt -l .)
          if [ -n "$unformatted" ]; then
            echo "The following files are not gofmt-clean:"
            echo "$unformatted"
            exit 1
          fi

      - name: staticcheck
        uses: dominikh/staticcheck-action@v1
        with:
          version: latest
          install-go: false