name: Static Checks

on:
  pull_request:
  push:
    branches:
      - release-*
      - mq-working-branch-**
    tags-ignore:
      - 'contrib/**'
      - 'instrumentation/**'
      - 'internal/**'
      - 'orchestrion/**'
      - 'scripts/**'
  workflow_call:
    inputs:
      go-version:
        required: true
        type: string
      ref:
        description: 'The branch to run the workflow on'
        required: true
        type: string

env:
  # Users may build our library with GOTOOLCHAIN=local. If they do, and our
  # go.mod file specifies a newer Go version than their local toolchain, their
  # build will break. Run our tests with GOTOOLCHAIN=local to ensure that
  # our library builds with all of the Go versions we claim to support,
  # without having to download a newer one.
  GOTOOLCHAIN: local
  GODEBUG: "x509negativeserial=1"
  GOEXPERIMENT: synctest # TODO: remove once go1.25 is the minimum supported version
  GOLANGCI_LINT_VERSION: v2.3.0 # NOTICE: Make sure this is synced with the version in the _tools/go.mod file.

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  copyright:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Setup Go and development tools
        uses: ./.github/actions/setup-go
        with:
          go-version: ${{ inputs.go-version }}
          tools-dir: ${{ github.workspace }}/_tools
          tools-bin: ${{ github.workspace }}/bin
      - name: Copyright
        run: |
          go run ./scripts/check_copyright.go
      - name: Run miscellaneous linters (copyright, Makefiles)
        run: |
          export PATH="${{ github.workspace }}/bin:${PATH}"
          make lint/misc

  check-github-actions:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Setup Go and development tools
        uses: ./.github/actions/setup-go
        with:
          go-version: ${{ inputs.go-version }}
          tools-dir: ${{ github.workspace }}/_tools
          tools-bin: ${{ github.workspace }}/bin
      - name: Lint GitHub Actions workflows
        run: |
          export PATH="${{ github.workspace }}/bin:${PATH}"
          make lint/action

  check-modules:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Setup Go and development tools
        uses: ./.github/actions/setup-go
        with:
          go-version: ${{ inputs.go-version }}
          tools-dir: ${{ github.workspace }}/_tools
          tools-bin: ${{ github.workspace }}/bin
      - name: Run fixmodules
        run: |-
          export PATH="${{ github.workspace }}/bin:${PATH}"
          ./scripts/fix_modules.sh
      - name: Check for changes
        run: git diff --exit-code

  check-docs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Setup Go and development tools
        uses: ./.github/actions/setup-go
        with:
          go-version: ${{ inputs.go-version }}
          tools-dir: ${{ github.workspace }}/_tools
          tools-bin: ${{ github.workspace }}/bin
      - name: Update documentation
        run: |-
          export PATH="${{ github.workspace }}/bin:${PATH}"
          make docs
      - name: Check for changes
        run: git diff --exit-code

  check-format:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Setup Go and development tools
        uses: ./.github/actions/setup-go
        with:
          go-version: ${{ inputs.go-version }}
          tools-dir: ${{ github.workspace }}/_tools
          tools-bin: ${{ github.workspace }}/bin
      - name: Format
        run: |-
          export PATH="${{ github.workspace }}/bin:${PATH}"
          make format
      - name: Check for changes
        run: git diff --exit-code

  lint:
    runs-on:
      group: "APM Larger Runners"
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: golangci-lint
        uses: reviewdog/action-golangci-lint@f9bba13753278f6a73b27a56a3ffb1bfda90ed71 # v2.8.0
        with:
          golangci_lint_flags: "--timeout 10m" # We are hitting timeout when there is no cache
          go_version: ${{ inputs.go-version }}
          golangci_lint_version: ${{ env.GOLANGCI_LINT_VERSION }}
          fail_level: error
          reporter: github-pr-review

      - name: golangci-lint (internal/orchestrion/_integration)
        uses: reviewdog/action-golangci-lint@f9bba13753278f6a73b27a56a3ffb1bfda90ed71 # v2.8.0
        with:
          golangci_lint_flags: "--timeout 10m --disable=gocritic" # We are hitting timeout when there is no cache
          go_version: ${{ inputs.go-version }}
          golangci_lint_version: ${{ env.GOLANGCI_LINT_VERSION }}
          fail_level: error
          reporter: github-pr-review
          workdir: internal/orchestrion/_integration

      - name: shellcheck
        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1.32.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          reporter: github-pr-review
          fail_level: error
          path: ./scripts
          pattern: "**/*.sh"
          filter_mode: nofilter

  checklocks:
    # We have the infrastructure in place for this check,
    # but we still need to add the required annotations for
    # checklocks to actually identify issues. Skipping the
    # check until we do so.
    if: false
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Setup Go and development tools
        uses: ./.github/actions/setup-go
        with:
          go-version: ${{ inputs.go-version }}
          tools-dir: ${{ github.workspace }}/_tools
          tools-bin: ${{ github.workspace }}/bin
      - name: Run checklocks
        run: |-
          export PATH="${{ github.workspace }}/bin:${PATH}"
          ./scripts/check_locks.sh
