ci-cd improvements

.github/workflows/diffguard.yml

@@ -0,0 +1,78 @@
+name: diffguard
+
+on:
+  pull_request:
+    branches:
+      - '**'
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: diffguard-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  diffguard:
+    name: Quality metrics
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # diffguard needs full history for merge-base and file history checks.
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-diffguard-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-diffguard-
+
+      - name: Install diffguard
+        run: go install github.com/0xPolygon/diffguard/cmd/diffguard@latest
+
+      - name: Run diffguard
+        id: diffguard
+        shell: bash
+        run: |
+          # Keep diffguard's exit code when tee writes the step summary.
+          set -o pipefail
+          diffguard \
+            --base origin/${{ github.base_ref }} \
+            --complexity-threshold 15 \
+            --complexity-delta-tolerance 5 \
+            --function-size-threshold 80 \
+            --function-size-delta-tolerance 15 \
+            --file-size-threshold 800 \
+            --file-size-delta-tolerance-pct 10 \
+            --file-size-delta-tolerance-floor 20 \
+            --tier1-threshold 80 \
+            --tier2-threshold 60 \
+            --mutation-sample-rate 20 \
+            --test-timeout 5m \
+            --output text \
+            --fail-on error \
+            . | tee "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload JSON report
+        # The text report above contains mutation results; this second run is
+        # only for a cheap machine-readable shape report.
+        if: always()
+        run: |
+          diffguard \
+            --base origin/${{ github.base_ref }} \
+            --skip-mutation \
+            --output json \
+            --fail-on none \
+            . > diffguard-report.json
+
+      - uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: diffguard-report
+          path: diffguard-report.json
+          retention-days: 14

.github/workflows/nightly-govulncheck.yml

@@ -0,0 +1,38 @@
+name: Nightly Govulncheck
+
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: nightly-govulncheck-develop
+  cancel-in-progress: true
+
+jobs:
+  govulncheck:
+    name: Run govulncheck on develop
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: develop
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-govulncheck-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-govulncheck-
+
+      - name: Run govulncheck
+        run: make vulncheck

.github/workflows/nightly-sonar.yml

@@ -0,0 +1,51 @@
+name: Nightly Sonar
+
+on:
+  schedule:
+    - cron: '0 1 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: nightly-sonar-develop
+  cancel-in-progress: true
+
+jobs:
+  sonar:
+    name: Run SonarCloud on develop
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: develop
+
+      - name: Run SonarCloud analysis
+        id: sonar
+        if: env.SONAR_TOKEN != ''
+        continue-on-error: true
+        uses: SonarSource/sonarqube-scan-action@c7ee0f9df90b7aa20e8dcf9695dcfe2e7da5b4f2 # v7
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Report informational status
+        if: always()
+        run: |
+          {
+            echo "## Nightly Sonar"
+            case "${{ steps.sonar.outcome }}" in
+              success)
+                echo "SonarCloud analysis completed successfully."
+                ;;
+              skipped)
+                echo "SonarCloud analysis was skipped because SONAR_TOKEN is not available."
+                ;;
+              *)
+                echo "SonarCloud analysis did not complete successfully. This check is informational and does not fail CI."
+                ;;
+            esac
+          } >> "$GITHUB_STEP_SUMMARY"