name: CI (lib)

# First-ever CI for go/lib (ADR-KV-014). lib is publicly mirrored on
# code.tnxs.net, so every push and PR gets a build/vet/test job plus a
# gitleaks secret-scan job. lib is a Go library — no Dockerfile, no deploy.
#
# push trigger is scoped to main + release tags (not every branch): with
# `branches: ['**']` *and* `pull_request` both set, every PR ran CI twice —
# once for the pull_request event, once for the push to the PR's source
# branch. main+tags replaced branch-per-version (ADR-KV-014, DT-KV-004), so
# there's no longer a fleet of long-lived version branches that need their
# own push-triggered runs independent of a PR.
on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:

defaults:
  run:
    shell: bash

# Serialize per ref. PR runs cancel superseded validations; branch pushes never cancel.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: [self-hosted, Linux]
    permissions: { contents: read }
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version: stable

      - name: go build ./...
        run: go build ./...

      - name: go vet ./...
        run: go vet ./...

      - name: go test ./...
        run: go test ./...

  gitleaks:
    runs-on: [self-hosted, Linux]
    permissions: { contents: read }
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

      - name: gitleaks detect (git history)
        run: |
          docker run --rm -v "$PWD:/repo" -w /repo zricethezav/gitleaks:latest \
            detect --source /repo --redact -v