qa.yml

name: QA Checks

on:
  workflow_call:
    inputs:
      ref:
        type: string
        required: true

permissions:
  contents: read

jobs:
  prepare-go-qa:
    name: Prepare for Go QA
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            sum.golang.org:443
            storage.googleapis.com:443
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref }}
          show-progress: 'false'
          persist-credentials: 'false'
      - name: Restore/save Taskfile cache
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          key: ${{ runner.os }}-qa-taskfile
          path: |
            ./.task
            ./bin
            ./cover.out
            ./cover.html
      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          go-version-file: go.mod
      - uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 3.x
      - name: Pre-build optimization
        run: task prebuild-lambda
      - name: Check Formatting
        run: test -z "$(go fmt ./...)" || echo "Formatting check failed."

  go-test:
    name: Run Go Tests
    runs-on: ubuntu-latest
    needs:
      - prepare-go-qa
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            sum.golang.org:443
            storage.googleapis.com:443
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref }}
          show-progress: 'false'
          persist-credentials: 'false'
      - name: Restore Taskfile cache
        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          key: ${{ runner.os }}-qa-taskfile
          path: |
            ./.task
            ./bin
            ./cover.out
            ./cover.html
      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          go-version-file: go.mod
      - uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 3.x
      - name: Run tests
        run: task test

  go-vet:
    name: Vet Go Code
    runs-on: ubuntu-latest
    needs:
      - prepare-go-qa
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            proxy.golang.org:443
            sum.golang.org:443
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref }}
          show-progress: 'false'
          persist-credentials: 'false'
      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          go-version-file: go.mod
      - name: Vet source code
        run: go vet ./...

  go-lint:
    name: Lint Go Code
    runs-on: ubuntu-latest
    needs:
      - prepare-go-qa
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            proxy.golang.org:443
            sum.golang.org:443
            storage.googleapis.com:443
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref }}
          show-progress: 'false'
          persist-credentials: 'false'
      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          go-version-file: go.mod
      - name: Lint with Staticcheck
        uses: dominikh/staticcheck-action@fe1dd0c3658873b46f8c9bb3291096a617310ca6 # v1.3.1
        with:
          install-go: false

  go-build:
    name: Ensure Go Builds
    runs-on: ubuntu-latest
    needs:
      - prepare-go-qa
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            sum.golang.org:443
            storage.googleapis.com:443
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref }}
          show-progress: 'false'
          persist-credentials: 'false'
      - name: Restore Taskfile cache
        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          key: ${{ runner.os }}-qa-taskfile
          path: |
            ./.task
            ./bin
            ./cover.out
            ./cover.html
      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          go-version-file: go.mod
      - uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 3.x
      - name: Ensure all binaries can compile
        run: task build build-cli

  tflint:
    name: Lint terraform
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref }}
          show-progress: 'false'
          persist-credentials: 'false'
      - uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        name: Cache plugin dir
        with:
          path: .tflint.d/plugins
          key: ${{ runner.os }}-tflint-${{ hashFiles('terraform/.tflint.hcl') }}
      - uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
        name: Setup TFLint
        with:
          tflint_version: latest
      - name: Show TFLint version
        run: tflint --version
      - name: Init TFLint
        run: tflint --init
        working-directory: terraform
        env:
          GITHUB_TOKEN: ${{ github.token }}
      - name: Run TFLint
        run: tflint -f compact --recursive