lint.yaml

name: Lint (Go)
run-name: make lint
on:
  pull_request:
    paths-ignore:
      - "docs/**"
      - "rfd/**"
      - "**/*.md*"
  merge_group:
    paths-ignore:
      - "docs/**"
      - "rfd/**"
      - "**/*.md*"

jobs:
  lint:
    name: Lint (Go)
    runs-on: ubuntu-22.04-16core

    permissions:
      contents: read

    container:
      image: ghcr.io/gravitational/teleport-buildbox:teleport15

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check for untidy go modules
        shell: bash
        run: |
          find . -path ./e -prune -o -name go.mod -print | while read f; do 
            echo "checking $f"
            pushd $(dirname "$f") > /dev/null; 
            go mod tidy;
            popd > /dev/null;
          done

          # We have to add the current directory as a safe directory or else git commands will not work as expected.
          git config --global --add safe.directory $( realpath . ) && git diff --exit-code;

      - name: Set linter versions
        run: |
          echo BUF_VERSION=$(cd build.assets; make print-buf-version) >> $GITHUB_ENV
          echo GOLANGCI_LINT_VERSION=$(cd build.assets; make print-golangci-lint-version) >> $GITHUB_ENV

      - name: Print linter versions
        run: |
          echo "BUF_VERSION=$BUF_VERSION"
          echo "GOLANGCI_LINT_VERSION=$GOLANGCI_LINT_VERSION"

      # Run various golangci-lint checks.
      # TODO(codingllama): Using go.work could save a bunch of repetition here.
      - name: golangci-lint (api)
        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          working-directory: api
          args: --out-format=colored-line-number
          skip-cache: true
      - name: golangci-lint (teleport)
        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          args: --out-format=colored-line-number --build-tags libfido2,piv
          skip-cache: true
      - name: golangci-lint (assets/backport)
        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          working-directory: assets/backport
          args: --out-format=colored-line-number
          skip-cache: true
      - name: golangci-lint (build.assets/tooling)
        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          working-directory: build.assets/tooling
          args: --out-format=colored-line-number
          skip-cache: true
      - name: golangci-lint (integrations/terraform)
        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          working-directory: integrations/terraform
          args: --out-format=colored-line-number
          skip-cache: true
      - name: golangci-lint (integrations/event-handler)
        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          working-directory: integrations/event-handler
          args: --out-format=colored-line-number
          skip-cache: true

      - uses: bufbuild/buf-setup-action@88db93f5d74ffa329bb43e42aa95cd822697d214 # v1.29.0
        with:
          github_token: ${{ github.token }}
          version: ${{ env.BUF_VERSION }}
      - uses: bufbuild/buf-lint-action@044d13acb1f155179c606aaa2e53aea304d22058 # v1.1.0
      - name: buf breaking from parent to self
        uses: bufbuild/buf-breaking-action@a074e988ee34efcd4927079e79c611f428354c01 # v1.1.3
        with:
          against: "https://github.com/${GITHUB_REPOSITORY}.git#branch=${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}"
      - name: buf breaking from self to master
        uses: bufbuild/buf-breaking-action@a074e988ee34efcd4927079e79c611f428354c01 # v1.1.3
        if: ${{ github.base_ref != 'master' && github.event.merge_group.base_ref != 'refs/heads/master' }}
        with:
          input: "https://github.com/${GITHUB_REPOSITORY}.git#branch=master"
          against: "."

      # TODO(codingllama): Consider https://github.com/actions-rs/clippy-check
      #  for Rust.
      - name: Run (non-action) linters
        run: make lint-no-actions

      - name: Check if protos are up to date
        # We have to add the current directory as a safe directory or else git commands will not work as expected.
        run: git config --global --add safe.directory $(realpath .) && make protos-up-to-date/host

      - name: Check if Operator CRDs are up to date
        # We have to add the current directory as a safe directory or else git commands will not work as expected.
        run: git config --global --add safe.directory $(realpath .) && make crds-up-to-date

      - name: Check if derived functions are up to date
        # We have to add the current directory as a safe directory or else git commands will not work as expected.
        run: git config --global --add safe.directory $(realpath .) && make derive-up-to-date