name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # Formatting is platform independent, so check it once rather than twice.
      - name: gofmt
        if: matrix.os == 'ubuntu-latest'
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "These files are not gofmt-clean:" >&2
            echo "$unformatted" >&2
            exit 1
          fi

      - name: go vet
        run: go vet ./...

      - name: go test
        run: go test ./... -count=1

  cross-build:
    name: cross-build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # Mirrors the release targets, so a platform-specific break surfaces on
      # the pull request rather than at tag time.
      - name: build all release targets
        run: |
          set -euo pipefail
          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64; do
            goos="${target%/*}"
            goarch="${target#*/}"
            echo "==> ${goos}/${goarch}"
            GOOS="$goos" GOARCH="$goarch" CGO_ENABLED=0 \
              go build -trimpath -o /tmp/sshkeeper-ci-build .
          done