name: CI

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  smoke:
    name: Smoke (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version-file: go.mod
          cache: true

      - name: Install Make on Windows
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: choco install make --no-progress -y

      - name: Validate quality targets with stock macOS Make
        if: matrix.os == 'macos-latest'
        env:
          GIT_CONFIG_COUNT: 1
          GIT_CONFIG_KEY_0: grep.patternType
          GIT_CONFIG_VALUE_0: fixed
        run: make -n vulncheck

      - name: Check vulnerabilities through native Windows Make
        if: matrix.os == 'windows-latest'
        shell: cmd
        run: make vulncheck

      - name: Check dead code through native Windows Make
        if: matrix.os == 'windows-latest'
        continue-on-error: true
        shell: cmd
        run: make deadcode

      - name: Run static lint through native Windows Make
        if: matrix.os == 'windows-latest'
        continue-on-error: true
        shell: cmd
        run: make lint-static

      - name: Check formatting
        if: matrix.os == 'ubuntu-latest'
        shell: bash
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "gofmt needed on:" >&2
            echo "$unformatted" >&2
            exit 1
          fi

      - name: Vet
        if: matrix.os == 'ubuntu-latest'
        run: go vet ./...

      - name: Test
        run: go test ./...

      - name: Build binary
        run: go run ./cmd/zero-release build

      - name: Smoke binary
        run: go run ./cmd/zero-release smoke

  performance:
    name: Performance Smoke
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version-file: go.mod
          cache: true

      - name: Build binary
        run: go run ./cmd/zero-release build

      - name: Performance smoke
        run: go run ./cmd/zero-perf-bench --output dist/perf/perf-bench.json --ci

      - name: Upload performance report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: zero-performance-smoke
          path: dist/perf/perf-bench.json
          if-no-files-found: warn

  security:
    name: Security & code health
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version-file: go.mod
          cache: true

      # Hard gate: fails the build when code reaches a known vulnerability. A stdlib
      # CVE is cleared by a toolchain bump (see go.mod). May also flag a newly
      # published advisory on an unrelated PR — intentional: do not ship known vulns.
      - name: govulncheck
        run: make vulncheck

      # Advisory: reports functions unreachable from any cmd/* main so dormant
      # code is visible in CI. Non-blocking while the dormant subsystems are
      # still being wired or removed.
      - name: deadcode (advisory)
        continue-on-error: true
        run: make deadcode

      # Advisory: catches what deadcode's whole-program reachability analysis
      # doesn't, unused private functions/assignments reachable within a
      # package but never actually called, plus staticcheck-style correctness
      # and readability issues. Scoped to a few linters rather than the full
      # default battery, and non-blocking, while the existing findings across
      # the repo are cleaned up incrementally (see #527).
      - name: golangci-lint (advisory)
        continue-on-error: true
        run: make lint-static