ci.yaml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github. run_id }}
  cancel-in-progress: true

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        vault_version: ["1.11.12", "1.12.8", "1.13.4", "1.14.1"]

    services:
      vault:
        image: hashicorp/vault:${{ matrix.vault_version }}
        env:
          SKIP_SETCAP: true
          VAULT_DEV_ROOT_TOKEN_ID: 227e1cce-6bf7-30bb-2d2a-acc854318caf
        ports:
          - 8200:8200

    steps:
      - name: Checkout repository
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2

      - name: Set up Nix
        uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}

      - name: Set up magic Nix cache
        uses: DeterminateSystems/magic-nix-cache-action@fc6aaceb40b9845a02b91e059ec147e78d1b4e41 # v4

      - name: Set up Go cache
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ github.job }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ github.job }}-${{ runner.os }}-go-

      - name: Prepare Nix shell
        run: nix develop --impure .#ci

      - name: Test
        run: nix develop --impure .#ci -c make test

  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2

      - name: Set up Nix
        uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}

      - name: Set up magic Nix cache
        uses: DeterminateSystems/magic-nix-cache-action@fc6aaceb40b9845a02b91e059ec147e78d1b4e41 # v4

      - name: Set up Go cache
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ github.job }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ github.job }}-${{ runner.os }}-go-

      - name: Prepare Nix shell
        run: nix develop --impure .#ci

      - name: Lint
        run: nix develop --impure .#ci -c make lint

  license-check:
    name: License check
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2

      - name: Set up Nix
        uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}

      - name: Set up magic Nix cache
        uses: DeterminateSystems/magic-nix-cache-action@fc6aaceb40b9845a02b91e059ec147e78d1b4e41 # v4

      - name: Set up Go cache
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ github.job }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ github.job }}-${{ runner.os }}-go-

      - name: Cache license information
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: .licensei.cache
          key: licensei-v1-${{ github.ref_name }}-${{ hashFiles('go.sum') }}
          restore-keys: |
            licensei-v1-${{ github.ref_name }}
            licensei-v1-main
            licensei-v1

      - name: Prepare Nix shell
        run: nix develop --impure .#ci

      - name: Populate license cache
        run: nix develop --impure .#ci -c licensei cache
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check licenses
        run: nix develop --impure .#ci -c make license-check
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  dev:
    name: Developer environment
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2

      - name: Set up Nix
        uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}

      - name: Set up magic Nix cache
        uses: DeterminateSystems/magic-nix-cache-action@fc6aaceb40b9845a02b91e059ec147e78d1b4e41 # v4

      - name: Check
        run: nix flake check --impure

      - name: Dev shell
        run: nix develop --impure

  dependency-review:
    name: Dependency review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout repository
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2

      - name: Dependency Review
        uses: actions/dependency-review-action@5bbc3ba658137598168acb2ab73b21c432dd411b # v4.2.5