pull_request.yaml

name: Pull Request
on:
  merge_group:
  pull_request:

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v3.5.2
      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version-file: './go.mod'
          cache-dependency-path: './go.sum'
          check-latest: true
      - name: golangci-lint
        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
        with:
          version: latest
          args: -v -c .golangci.yaml

  tests:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v3.5.2
      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version-file: './go.mod'
          cache-dependency-path: './go.sum'
          check-latest: true

      - id: go-cache-paths
        name: Get Go cache paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT

      - name: Tests
        run: make test

      - name: upload coverage to codecov
        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
        with:
          files: ./coverageunit.out
          verbose: true
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true

  govulncheck:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v3.5.2
      - name: Run govulncheck
        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
        with:
          go-version-file: go.mod

  docker-tests:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v3.5.2
      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version-file: './go.mod'
          cache-dependency-path: './go.sum'
          check-latest: true

      - id: go-cache-paths
        name: Get Go cache paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Build and push openfga/openfga:dockertest
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          file: Dockerfile
          push: false # don't publish the built container for Docker tests
          load: true
          tags: "openfga/openfga:dockertest"

      - name: Docker Tests
        run: make test-docker

  go-bench:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v3.5.2
        with:
          fetch-depth: 0 # to be able to retrieve the last commit in main

      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version-file: './go.mod'
          cache-dependency-path: './go.sum'
          check-latest: true

      # Run benchmark with `go test -bench` and stores the output to a file
      - name: Run benchmark
        run: |
          set -o pipefail
          make test-bench | tee ${{ github.sha }}_bench_output.txt

      - name: Get CPU information
        uses: kenchan0130/actions-system-info@c74331947b5734764feeb375de4038960f2576bd # v1
        id: system-info

      - name: Get Main branch SHA
        id: get-main-branch-sha
        run: |
          SHA=$(git rev-parse origin/main)
          echo "sha=$SHA" >> $GITHUB_OUTPUT

      - name: Get benchmark JSON from main branch
        id: cache
        uses: actions/cache/restore@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4.1.1
        with:
          path: ./cache/benchmark-data.json
          key: ${{ steps.get-main-branch-sha.outputs.sha }}-${{ runner.os }}-${{ steps.system-info.outputs.cpu-model }}-go-benchmark

      - name: Compare benchmarks with Main
        uses: benchmark-action/github-action-benchmark@4de1bed97a47495fc4c5404952da0499e31f5c29 # v1.20.3
        if: steps.cache.outputs.cache-hit == 'true'
        with:
          # What benchmark tool the output.txt came from
          tool: 'go'
          # Where the output from the benchmark tool is stored
          output-file-path: ${{ github.sha }}_bench_output.txt
          # Where the benchmarks in main are (to compare)
          external-data-json-path: ./cache/benchmark-data.json
          # Do not save the data
          save-data-file: false
          # Workflow will fail when an alert happens
          fail-on-alert: true
          github-token: ${{ secrets.GITHUB_TOKEN }}
          # Enable Job Summary for PRs
          summary-always: true

      - name: Run benchmarks but don't compare to Main branch
        uses: benchmark-action/github-action-benchmark@4de1bed97a47495fc4c5404952da0499e31f5c29 # v1.20.3
        if: steps.cache.outputs.cache-hit != 'true'
        with:
          # What benchmark tool the output.txt came from
          tool: 'go'
          # Where the output from the benchmark tool is stored
          output-file-path: ${{ github.sha }}_bench_output.txt
          # Write benchmarks to this file, do not publish to GitHub Pages
          save-data-file: false
          external-data-json-path: ./cache/benchmark-data.json
          # Enable Job Summary for PRs
          summary-always: true