golang.yaml

# Copyright 2024 NVIDIA CORPORATION
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Golang

permissions:
  contents: read

on:
  workflow_call:
    inputs:
      golang_version:
        required: true
        type: string

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      name: Checkout code

    - name: Install Go
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: ${{ inputs.golang_version }}

    - name: Lint
      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
      with:
        version: latest
        args: -v --timeout 5m
        skip-cache: true

    - name: Run go vet
      # Every package, no exclusions. This overlaps the govet linter inside
      # golangci-lint above, but it is not redundant with it -- both reasons
      # were measured on the pre-#511 tree, not assumed:
      #   * golangci-lint honours //nolint:govet. The bridge carried 7 such
      #     comments and golangci-lint reported 0 findings; stripping them
      #     produced findings immediately. Bare go vet has no suppression
      #     mechanism at all, so this step is the one that cannot be silenced
      #     one site at a time.
      #   * golangci-lint caps repeats of the same finding
      #     (--max-same-issues, default 3). It surfaced 3 where go vet
      #     surfaced 8, so it under-reports exactly the kind of spreading
      #     problem this gate exists to catch.
      # Consequence: if this goes red, fix the code. There is no middle
      # ground to retreat to, and an exclusion here is a blind spot rather
      # than a filter.
      run: go vet ./...

    - name: Check golang modules
      run: |
        make check-modules

    - name: Run unit tests
      run: |
        go test -v -race -coverprofile=coverage.out -covermode=atomic $(go list ./... | grep -v vendor)

    # The mockpcisysfs LD_PRELOAD shim (libpcimocksys.so) is exercised only by
    # tests behind the `integration` build tag, which the untagged unit-test run
    # above skips. Build the shim and run them explicitly so the sysfs
    # redirection (incl. the _FORTIFY_SOURCE open and fopen paths that lspci
    # relies on) has automated enforcement.
    - name: Build mockpcisysfs shim
      run: make -C pkg/system/mockpcisysfs

    - name: Run mockpcisysfs integration tests
      run: go test -tags integration -v ./pkg/system/mockpcisysfs/...

    # The tests/e2e harness packages sit behind the `e2e` build tag, so the
    # untagged unit-test run above skips them -- `go list ./...` does not even
    # match them. `make e2e` does not reach them either: it targets the Ginkgo
    # suite package ./tests/e2e/go, not ./tests/e2e/go/... . Without this step
    # the harness's own unit tests compile for nobody and rot silently, which is
    # how the diagnostics collection path lost its sidecar logs unnoticed
    # (#562). These are plain `go test` units -- no cluster, no kubectl.
    - name: Run e2e framework unit tests
      run: make test-e2e-framework

    - name: Run govulncheck
      run: |
        go install golang.org/x/vuln/cmd/govulncheck@latest
        govulncheck ./...