name: Build gopass

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  linux:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        go: ['1.25']
    name: Go ${{ matrix.go }}
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: block
        allowed-endpoints: >
          github.com:443
          objects.githubusercontent.com:443
          proxy.golang.org:443
          raw.githubusercontent.com:443
          release-assets.githubusercontent.com:443
          storage.googleapis.com:443
          sum.golang.org:443
          golang.org:443
          go.dev:443
          azure.archive.ubuntu.com:443
          archive.ubuntu.com:443
          security.ubuntu.com:443
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: ${{ matrix.go }}
    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-
    - name: Ubuntu Dependencies
      run: sudo apt-get install --yes git gnupg
    - run: git config --global user.name nobody
    - run: git config --global user.email foo.bar@example.org

    -
      name: Debug
      run:  |
        echo "Go env ------------------"
        pwd
        echo ${HOME}
        echo ${GITHUB_WORKSPACE}
        echo ${GOPATH}
        echo ${GOROOT}
        env  

    - name: Build and Unit Test
      run: make gha-linux
    - name: Integration Test
      run: make test-integration

  container:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9
        env:
          IMAGE_NAME: ${{ github.repository }}
        with:
          images: ${{ env.IMAGE_NAME }}

      - name: Build container image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
        with:
          context: .
          push: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  windows:
    runs-on: windows-latest
    defaults:
      run:
          shell: msys2 {0}
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit

    - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
      with:
        release: false
        path-type: inherit
        install: >-
          base-devel
          git

    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version-file: 'go.mod'

    - run: git config --global user.name nobody
    - run: git config --global user.email foo.bar@example.org
      
    - name: Build and Unit Test
      run: make gha-windows

  macos:
    runs-on: macos-latest
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit

    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version-file: 'go.mod'

    - run: git config --global user.name nobody
    - run: git config --global user.email foo.bar@example.org
      
    - name: Build and Unit Test
      run: make gha-osx
      env:
        SLOW_TEST_FACTOR: 100 

  dependabot:
    needs: [linux]
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: write
    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'}}
    steps:
      - id: metadata
        uses: dependabot/fetch-metadata@v3
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - run: |
          gh pr review --approve "$PR_URL"
          gh pr merge --squash --auto "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}