name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  go:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        go: ['1.25']
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go }}
          cache: true

      - name: go vet
        run: go vet ./...

      # golangci-lint-action v7 is required for golangci-lint v2.x.
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v7
        with:
          version: v2.2.2

      # govulncheck is informational — failures don't block the build because
      # stdlib CVEs surface routinely until the runner image catches up to
      # the latest go-patch release. The signal we care about is dependency
      # vulns, which we react to via go.mod bumps.
      - name: govulncheck
        continue-on-error: true
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      # Firestore emulator step removed: storage_test.go skips gracefully
      # when FIRESTORE_EMULATOR_HOST is unset, and the emulator install
      # adds 30-60s of CI time for tests not yet on the merge-gating path.
      # Re-add when storage-layer changes need emulator coverage in CI.
      - name: go test
        env:
          # Quiet test logs so real failures stand out.
          LOG_LEVEL: error
        run: go test -race -count=1 -coverprofile=cov.out ./...

      - name: coverage summary
        run: go tool cover -func=cov.out | tail -1

      - name: go build
        run: go build ./...

      - name: docker build
        run: docker build -t miti99bot-go .