name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  go:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        go: ['1.25']
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-go@v6
        with:
          go-version: ${{ matrix.go }}
          cache: true

      - name: go vet
        run: go vet ./...

      # Pinning the lint binary to v2.12.x because our .golangci.yml targets
      # Go 1.25 and earlier v2.x releases were built against go1.24, which the
      # lint config rejects with "Go language version used to build
      # golangci-lint is lower than the targeted Go version".
      # Action v9 is the first Node 24-native release; still accepts any
      # golangci-lint >= v2.1.0.
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.12.2

      # govulncheck is informational — failures don't block the build because
      # stdlib CVEs surface routinely until the runner image catches up to
      # the latest go-patch release. The signal we care about is dependency
      # vulns, which we react to via go.mod bumps.
      - name: govulncheck
        continue-on-error: true
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      # No DB emulator step: storage integration tests (mongodb, dynamodb) skip
      # gracefully when MONGODB_TEST_URL / DYNAMODB_LOCAL_URL are unset. Run them
      # locally via `make test-mongo` / `make test-dynamodb`.
      - name: go test
        env:
          # Quiet test logs so real failures stand out.
          LOG_LEVEL: error
        run: go test -race -count=1 -coverprofile=cov.out ./...

      - name: coverage summary
        run: go tool cover -func=cov.out | tail -1

      - name: go build
        run: go build ./...

      - name: docker build
        run: docker build -t miti99bot .

  iac:
    name: SAM template validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: aws-actions/setup-sam@v3
        with:
          use-installer: true
      - name: sam validate (offline)
        run: sam validate --lint --region ap-southeast-1