name: ci

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "17 5 * * *" # nightly vuln rescan

# One job on purpose: the shared runner pool is small, so all modules are
# checked sequentially on a single runner instead of a 15-way matrix.
jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: .go-version
          cache: false
      - name: install scanners
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
      - name: build, vet, govulncheck, tests per module
        shell: bash
        run: |
          export PATH="$(go env GOPATH)/bin:$PATH"
          modules=$(find . -name go.mod -printf '%h\n' | sort)
          failed=()
          for m in $modules; do
            echo "::group::$m"
            (
              set -e
              cd "$m"
              go build ./...
              # composites: pre-existing upstream test-file warnings
              go vet -composites=false ./...
              govulncheck ./...
              case "$m" in ./api|./sdk) go test ./... ;; esac  # root needs Postgres
            ) || failed+=("$m")
            echo "::endgroup::"
          done
          if [ ${#failed[@]} -gt 0 ]; then
            echo "FAILED modules: ${failed[*]}"; exit 1
          fi
      - name: osv-scanner
        run: osv-scanner scan source -r .