ci.yml

name: ci

"on":
  push:
    branches:
      - master
  pull_request:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        # Do not init the e2e submodule: it is an SSH-only fixtures repo with no
        # Go sources, so `go test ./...` never needs it and cloning would fail.
        with:
          submodules: false
      - name: Set up mise
        uses: jdx/mise-action@v2
        with:
          # go + golangci-lint + deadcode for the toolchain; helm + kustomize so
          # the render integration tests actually run instead of t.Skip()-ing.
          # kind/kubectl/yq stay out (e2e-only). Versions come from .mise.toml.
          install_args: go golangci-lint go:golang.org/x/tools/cmd/deadcode helm kustomize
      - name: Resolve Go cache paths
        # Computed rather than hardcoded to ~/go/pkg/mod: mise controls the Go
        # install, and a path that does not exist caches NOTHING while still
        # reporting success — a silent no-op is the failure mode to avoid here.
        run: |
          echo "GOMODCACHE=$(go env GOMODCACHE)" >> "$GITHUB_ENV"
          echo "GOCACHE=$(go env GOCACHE)" >> "$GITHUB_ENV"
      - name: Cache Go modules and build cache
        uses: actions/cache@v4
        with:
          path: |
            ${{ env.GOMODCACHE }}
            ${{ env.GOCACHE }}
          # .mise.toml is in the key because the build cache is TOOLCHAIN-specific:
          # a Go bump must start a fresh lineage rather than restore entries the
          # new compiler cannot reuse. go.sum keys the module half; restore-keys
          # lets a dependency change still reuse the previous run's downloads.
          key: ${{ runner.os }}-go-${{ hashFiles('.mise.toml') }}-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-${{ hashFiles('.mise.toml') }}-
      - name: Check
        # The `check` task in .mise.toml is the single source of truth for what
        # CI verifies (vet, build, test, test-race, deadcode, lint): this job runs
        # it verbatim, so `mise run check` on a laptop IS the CI run, and a task
        # added to check's `depends` is in CI with no edit here. mise runs the
        # dependencies in parallel and prefixes every output line with its task
        # name, so a red run still names the task. --continue-on-error keeps the
        # other tasks going after a failure, so a red test cannot hide lint
        # findings (what per-step `if: !cancelled()` used to buy). --jobs 3 caps
        # the parallelism for the runner's memory: golangci-lint, the race build
        # and deadcode each type-check the argo-cd tree.
        run: mise run check --continue-on-error --jobs 3