tests.yml

name: tests

on:
  push:
    branches:
      - '**'
    paths:
      - '**.go'
      - '**.sh'
      - 'go.mod'
      - 'go.sum'
      - 'build.py'
      - '.github/workflows/tests.yml'

permissions:
  id-token: write
  contents: read

jobs:
  pre-build:
    runs-on: ubuntu-latest

    outputs:
      build_timestamp: ${{ steps.set-env.outputs.BUILD_TIMESTAMP }}
      build_os: ${{ steps.set-build-os.outputs.build_os }}

    steps:
      - name: set env
        id: set-env
        run: |
          echo "BUILD_TIMESTAMP=$(date -u +'%s')" >> $GITHUB_OUTPUT

      - name: set build os
        id: set-build-os
        shell: bash
        run: |
          if [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
            echo 'build_os=["macos-14", "macos-14-large", "ubuntu-20.04"]' >> $GITHUB_OUTPUT
          else
            echo 'build_os=["macos-14", "ubuntu-20.04"]' >> $GITHUB_OUTPUT
          fi

  build:
    needs: [pre-build]
    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        os: ${{ fromJSON(needs.pre-build.outputs.build_os) }}

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: 1.22

      - name: Install deps for Linux
        if: matrix.os == 'ubuntu-20.04'
        run: sudo apt install -quy libpcsclite-dev

      - name: Test
        run: go test -coverprofile=coverage.txt -covermode=atomic ./...

      - name: Test Race
        run: go test -race -v ./...

      - name: Vulnerability check
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_REPO_ROLE }}

      - name: Build and upload
        run: python build.py
        env:
          AWS_BUCKET_BUILD: ${{ secrets.AWS_BUCKET_BUILD }}
          BUILD_TIMESTAMP: ${{ needs.pre-build.outputs.build_timestamp }}
      
      - name: Publish coverage
        uses: codecov/codecov-action@v5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
          file: ./coverage.txt
          flags: ${{ matrix.os }}

  post-build:
    runs-on: ubuntu-latest
    needs: [build]

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_REPO_ROLE }}

      - name: Invalidate CloudFront
        run: aws cloudfront create-invalidation --distribution-id ${{ secrets.AWS_CLOUDFRONT_FILES }} --paths "/test/update_manifest/*" "/release/update_manifest/*"