ci.yml

name: ci

on:
  push:
    branches:
      - main
    tags:
      - 'v*.*.*' # Trigger on semantic versioning tags
    paths-ignore:
      - 'docs/**'
      - 'tests/**'
      - 'README.md'
      - '.gitignore'

  pull_request:
    branches:
      - main
    paths-ignore:
      - 'docs/**'
      - 'tests/**'
      - 'README.md'
      - '.gitignore'

permissions:
  contents: read
  id-token: write

jobs:
  lint:
    name: Lint and Format Check
    runs-on: ubuntu-latest
    permissions: 
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: v1.60

  security:
      name: Security Scanning
      runs-on: ubuntu-latest
      permissions:
        contents: read
      env:
        GO111MODULE: on
      steps:
        - name: Checkout Source
          uses: actions/checkout@v4
        - name: Run Gosec Security Scanner
          uses: securego/gosec@master
          with:
            args: -exclude=G301, G304, G306 
  
  goreleaser:
    name: Build and Release with Goreleaser
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs:
      - lint
      - security
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - run: git fetch --force --tags
      - uses: actions/setup-go@v5
        with:
          go-version: 1.23
      - uses: goreleaser/goreleaser-action@v4
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}