name: backend

on:
  push:
    branches:
    tags:
    paths:
      - ".github/workflows/ci-backend.yml"
      - "backend/**"
      - "Dockerfile"
      - "docker-init.sh"
      - ".dockerignore"
      - "!backend/scripts/**"
      - "!**.md"
  pull_request:
    paths:
      - ".github/workflows/ci-backend.yml"
      - "backend/**"
      - "Dockerfile"
      - "docker-init.sh"
      - ".dockerignore"
      - "!backend/scripts/**"
      - "!**.md"

jobs:
  test:
    name: Test & Coverage
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: debug if needed
        run: if [[ "$DEBUG" == "true" ]]; then env; fi
        env:
          DEBUG: ${{secrets.DEBUG}}

      - name: install go
        uses: actions/setup-go@v7
        with:
          go-version: "1.25"
          check-latest: true
          cache-dependency-path: backend

      - name: test and build backend
        run: |
          go test -race -timeout=300s -covermode=atomic -coverprofile=$GITHUB_WORKSPACE/profile.cov_tmp ./...
          cat $GITHUB_WORKSPACE/profile.cov_tmp | grep -v "_mock.go" > $GITHUB_WORKSPACE/profile.cov
          go build -race ./...
        working-directory: backend/app
        env:
          TZ: "America/Chicago"

      - name: test examples
        run: |
          go test -race ./...
          go build -race ./...
        working-directory: backend/_example/memory_store
        env:
          TZ: "America/Chicago"

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: "v2.13.1"
          working-directory: backend/app

      - name: golangci-lint on example directory
        uses: golangci/golangci-lint-action@v9
        with:
          version: "v2.13.1"
          args: --config ../../.golangci.yml
          working-directory: backend/_example/memory_store

      - name: submit coverage
        run: |
          go install github.com/mattn/goveralls@latest
          goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
        working-directory: backend
        env:
          COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  vulncheck:
    name: Vulnerability scan
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: install go
        uses: actions/setup-go@v7
        with:
          go-version: "1.25"
          check-latest: true
          # both go.sum files so the cache key covers the main and example modules scanned below
          cache-dependency-path: |
            backend/go.sum
            backend/_example/memory_store/go.sum

      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@v1.5.0
          govulncheck ./...
          (cd _example/memory_store && govulncheck ./...)
        working-directory: backend
        env:
          # ignore the committed vendor dirs and resolve modules from the cache so
          # both the main module and the nested example module scan consistently
          GOFLAGS: "-mod=readonly"