gate.yml

name: gate
on:
  push:
    branches: [main]
  pull_request:

# A push to a pull request supersedes the run its previous push started. Runs on
# main are never cancelled: each saves the caches the pull requests after it use.
concurrency:
  group: gate-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# The gate runs as two jobs side by side. Every check is a Makefile target, and
# `make gate` runs them all.
#
# A run on main starts from empty Go build and module caches and saves what it
# built. A pull request's run restores what the latest run of the same job on
# main saved, so it rebuilds only what the change touches. Main never restores,
# so each save holds one run's builds and the cache cannot grow from one commit
# to the next.
jobs:
  checks:
    name: lint, fuzz, bench
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - &checkout
        uses: actions/checkout@v7
      - &setup-go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: false
      - &toolchain
        name: toolchain pin
        id: toolchain
        run: |
          version="$(env -u GOTOOLCHAIN make -s print-go-version)"
          echo "GOTOOLCHAIN=go$version" >>"$GITHUB_ENV"
          {
            echo "version=$version"
            echo "gocache=$(go env GOCACHE)"
            echo "gomodcache=$(go env GOMODCACHE)"
          } >>"$GITHUB_OUTPUT"
      - &restore
        name: restore main's caches
        if: github.event_name == 'pull_request'
        uses: actions/cache/restore@v6
        with:
          path: |
            ${{ steps.toolchain.outputs.gocache }}
            ${{ steps.toolchain.outputs.gomodcache }}
          key: go-${{ github.job }}-${{ runner.os }}-go${{ steps.toolchain.outputs.version }}-${{ github.sha }}
          restore-keys: go-${{ github.job }}-${{ runner.os }}-go${{ steps.toolchain.outputs.version }}-
      - name: gofmt
        run: make fmt
      - name: vet
        run: make vet
      - name: lint version
        id: lint-version
        run: echo "version=$(make -s print-lint-version)" >>"$GITHUB_OUTPUT"
      - name: lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: ${{ steps.lint-version.outputs.version }}
      - name: lint rules draw their planted findings
        run: make lint-planted
      - name: fuzz
        id: fuzz
        run: make fuzz
      - name: benchmarks
        run: make bench-smoke
      - name: upload fuzz findings
        if: failure() && steps.fuzz.outcome == 'failure'
        uses: actions/upload-artifact@v7
        with:
          name: fuzz-findings
          path: "**/testdata/fuzz/**"
          if-no-files-found: ignore
      - &save
        name: save caches
        if: github.event_name == 'push'
        uses: actions/cache/save@v6
        with:
          path: |
            ${{ steps.toolchain.outputs.gocache }}
            ${{ steps.toolchain.outputs.gomodcache }}
          key: go-${{ github.job }}-${{ runner.os }}-go${{ steps.toolchain.outputs.version }}-${{ github.sha }}

  suite:
    name: build, test (race detector, exactly 100% coverage)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - *checkout
      - *setup-go
      - *toolchain
      - *restore
      # Tests that load packages with go/packages run go list -export, which
      # compiles what make build does. Built first, that compile no longer runs
      # beside the tests that time a child process, which load can push past
      # their bound (#1010).
      - name: build
        run: make build
      - name: test
        run: make coverage
      - *save