ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # Codecov OIDC upload; no stored token needed
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          check-latest: true

      - name: Build
        run: go build ./...

      - name: Lint
        # v2 supports the current Go export format. Limit its upgraded rule set
        # to this change until the pre-existing v2 findings are cleaned up.
        run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 run --new-from-rev=${{ github.event.pull_request.base.sha || github.event.before }}

      - name: Vet
        run: go vet ./...

      # Runs the unit suite AND the static egress guard
      # (internal/httpx/guard_test.go), which fails the build if any package
      # outside internal/httpx constructs a raw http.Client / http.NewRequest —
      # so un-receipted egress can't merge.
      - name: Test
        run: go test -coverprofile=coverage.out -covermode=atomic ./...

      - name: Upload coverage
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: codecov/codecov-action@v5
        with:
          files: coverage.out
          use_oidc: true
          fail_ci_if_error: false