name: test

on:
  push:
    branches: [main]
  pull_request:

# The job reads the repository and nothing else (security audit 2026-10-17,
# review of stages 2-6).
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          # design-first.sh reads each commit's parent and the template history.
          fetch-depth: 0

      - name: Design first
        env:
          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
        run: bash .github/scripts/design-first.sh "$BASE" "$HEAD"

      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version: "1.26"
          cache: true
          cache-dependency-path: |
            go.sum
            test/e2e/go.sum

      - name: Format
        run: |
          fmt="$(gofmt -l .)"
          if [ -n "$fmt" ]; then
            echo "$fmt"
            echo "gofmt needed on the files above; run 'gofmt -w .'"
            exit 1
          fi

      - name: Vet
        run: go vet ./...

      # Unused code, dead branches and the usual slips go vet does not look
      # for. The version is pinned: a new release adds checks, and a check
      # that appears under a push is a red build nobody asked for. 2026.1 is
      # the release for Go 1.26. test/e2e is a module of its own, so ./...
      # skips it; it is checked in its own step below.
      - name: Staticcheck
        run: go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...

      - name: Test
        run: go test ./...

      # Known vulnerabilities in the module's dependencies and in the
      # standard library of this Go, reached from SelfPost's code (security
      # audit 2026-10-17, I4: twelve stdlib advisories went unnoticed until
      # the base image's tag happened to move). Pinned like staticcheck.
      - name: Vulnerabilities
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...

      # The e2e module runs only in release.yml, after a release is published;
      # a type error there would first show up then. Compile it here without
      # running it: `go test -run` would still run TestMain, which brings up
      # the whole stand.
      - name: Compile the e2e
        working-directory: test/e2e
        run: |
          go vet ./...
          go test -c -o /dev/null .
          go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...