build-and-verify.yml

# Reusable workflow: Build and Verify Go utilities across multiple OS/ARCH combos,
# with linting and security checks. Designed to be called via workflow_call.

name: Build and Verify

on:
  workflow_call:
    secrets:
      QLTY_COVERAGE_TOKEN:
        required: false
        description: This secret is needed for Qlty (Code Climate).
    inputs:
      program:
        type: string
        required: true
        description: Name of the utility to build (used for artifact name & output matching).
      build-matrix:
        type: string
        required: false
        description: 'JSON array of objects: [{ "goos": "...", "arch": "..." }] for build combinations.'
      test-matrix:
        type: string
        required: false
        description: 'JSON array of objects: [{ "platform": "...", "arch": "..." }] for test combinations.'
      go-version-file:
        type: string
        required: false
        default: './go.mod'
        description: 'Path to go.mod file for Go version detection.'
      working-directory:
        type: string
        required: false
        default: './'
        description: 'Path to working directory (default: ./).'
      enable-qlty-coverage:
        type: boolean
        required: true
        description: If true, coverage reports are uploaded to Qlty. Requires QLTY_COVERAGE_TOKEN secret.
      artifact-retention-days:
        type: number
        required: false
        default: 7
        description: Days to retain build artifacts.

# Default shell to keep behavior consistent across steps.
defaults:
  run:
    shell: bash

jobs:
  configure-ci:
    runs-on: ubuntu-latest
    outputs:
      working-dir: ${{ steps.get-working-dir.outputs.dir }}
    steps:
      - name: Get working directory
        id: get-working-dir
        run: |
          if [ -z "${{ inputs.working-directory }}" ]; then
            echo "dir=./" >> "$GITHUB_OUTPUT"
          else
            echo "dir=${{ inputs.working-directory }}" >> "$GITHUB_OUTPUT"
          fi

  quality-security-checks:
    name: Quality & Security Checks
    runs-on: ubuntu-latest
    needs: configure-ci
    timeout-minutes: 10
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Checkout caller repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.event.repository.full_name }}

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: ${{ inputs.go-version-file }}
          check-latest: true

      - name: Lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: latest
          skip-cache: true
          working-directory: ${{ needs.configure-ci.outputs.working-dir }}

      - name: Format Check
        run: make format-check
        working-directory: ${{ needs.configure-ci.outputs.working-dir }}

      - name: Gosec Security Scanner
        uses: securego/gosec@9e75c0576c9878035d4221392108d458abe10fc3 # v2.28.0
        with:
          args: '-severity high -exclude-dir=testdata -exclude=*_test.go ${{ needs.configure-ci.outputs.working-dir }}/...'

      - name: Vulnerability Scan
        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
        with:
          go-version-file: ${{ inputs.go-version-file }}
          check-latest: true
          cache: false
          repo-checkout: false
          go-package: ./...
          work-dir: ${{ needs.configure-ci.outputs.working-dir }}

  build:
    needs: [ configure-ci, quality-security-checks ]
    name: 'Build (${{ matrix.goos }}, ${{ matrix.arch }})'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      # If the caller didn't pass a build-matrix, use defaults for tri-OS and dual-arch.
      matrix:
        include: ${{ fromJson(inputs.build-matrix != '' && inputs.build-matrix || '[{"goos":"windows","arch":"amd64"},{"goos":"windows","arch":"arm64"},{"goos":"linux","arch":"amd64"},{"goos":"linux","arch":"arm64"},{"goos":"darwin","arch":"arm64"}]') }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.event.repository.full_name }}
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: ${{ inputs.go-version-file }}
          check-latest: true

      - name: Build
        working-directory: ${{ needs.configure-ci.outputs.working-dir }}
        run: |
          echo "Building ${{ inputs.program }} for ${GOOS:=${{ matrix.goos }}}/${GOARCH:=${{ matrix.arch }}}"
          make OS=${{ matrix.goos }} ARCH=${{ matrix.arch }} build

      - name: Upload binary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ inputs.program }}-${{ matrix.goos }}-${{ matrix.arch }}
          path: ${{ needs.configure-ci.outputs.working-dir }}/build/${{ inputs.program }}*
          retention-days: ${{ inputs.artifact-retention-days }}

  test:
    needs: [ configure-ci, quality-security-checks ]
    name: 'Test (${{ matrix.platform }}, ${{ matrix.arch }})'
    strategy:
      fail-fast: false
      # If the caller didn't pass a test-matrix, use defaults for tri-OS and dual-arch.
      matrix:
        include: ${{ fromJson(inputs.test-matrix != '' && inputs.test-matrix || '[{"platform":"windows-2022","arch":"amd64"},{"platform":"windows-2022","arch":"arm64"},{"platform":"ubuntu-24.04","arch":"amd64"},{"platform":"ubuntu-24.04","arch":"arm64"},{"platform":"macos-14","arch":"arm64"}]') }}

    runs-on: ${{ matrix.platform }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.event.repository.full_name }}
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: ${{ inputs.go-version-file }}
          check-latest: true

      - name: Resolve GOOS from runner platform
        id: get-target
        run: |
          platform="${{ matrix.platform }}"

          if [[ "$platform" == *"ubuntu"* ]]; then
            echo "target=linux" >> "$GITHUB_OUTPUT"
          elif [[ "$platform" == *"windows"* ]]; then
            echo "target=windows" >> "$GITHUB_OUTPUT"
          elif [[ "$platform" == *"macos"* ]]; then
            echo "target=darwin" >> "$GITHUB_OUTPUT"
          else
            echo "target=unknown" >> "$GITHUB_OUTPUT"
          fi

      - name: Install go-junit-report
        run: go install github.com/jstemmer/go-junit-report/v2@14d61e6e75e3f3c74551d757ad936e8e88014464 # v2.1.0

      - name: Run tests
        working-directory: ${{ needs.configure-ci.outputs.working-dir }}
        run: |
          mkdir -p build
          echo "::group::Running tests for ${{ matrix.platform }} (${{ matrix.arch }})"
          make test 2>&1 | tee build/${{ inputs.program }}-${{ steps.get-target.outputs.target }}-${{ matrix.arch }}.txt
          echo "::endgroup::"

      - name: Generate JUnit report
        if: always()
        working-directory: ${{ needs.configure-ci.outputs.working-dir }}
        run: |
          go-junit-report -set-exit-code \
            -in build/${{ inputs.program }}-${{ steps.get-target.outputs.target }}-${{ matrix.arch }}.txt \
            -iocopy \
            -out build/${{ inputs.program }}-testreport-${{ steps.get-target.outputs.target }}-${{ matrix.arch }}.xml

      - name: Archive test results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-results-${{ steps.get-target.outputs.target }}-${{ matrix.arch }}
          path: ${{ needs.configure-ci.outputs.working-dir }}/build/${{ inputs.program }}-testreport-*.xml
          retention-days: ${{ inputs.artifact-retention-days }}
          if-no-files-found: error

  html-test-report:
    name: Generate HTML Test Report
    needs: test
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: Open-CMSIS-Pack/workflows-and-actions-collection

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.11'

      - name: Download test results
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts/

      - name: List downloaded files
        run: ls -R artifacts/

      - name: Install dependencies 
        run: |
          python -m pip install --upgrade pip
          pip install pandas

      - name: Run test report generator
        run: |
          python ./scripts/generate_junit_to_html_report.py \
            --test_report_dir artifacts \
            --report_header "${{ inputs.program }}" \
            --output_file test_report.html

      - name: Upload HTML report as artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: html-test-report
          path: test_report.html

  coverage:
    name: Coverage Report
    needs: [ configure-ci, test ]
    runs-on: ubuntu-24.04
    if: inputs.enable-qlty-coverage == true
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.event.repository.full_name }}
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: ${{ inputs.go-version-file }}
          check-latest: true

      - name: Coverage check
        working-directory: ${{ needs.configure-ci.outputs.working-dir }}
        run: make coverage-check

      - name: Normalize cover.out paths
        working-directory: ${{ needs.configure-ci.outputs.working-dir }}
        run: |
          find . -name 'cover.out' -exec sed -i 's|github.com/Open-CMSIS-Pack|github.com/open-cmsis-pack|g' {} +

      - name: Get strip-prefix for coverage
        id: get-strip-prefix
        run: |
          if [ "${{ inputs.program }}" = "cbuild" ]; then
            echo "prefix=github.com/open-cmsis-pack/cbuild/v2" >> "$GITHUB_OUTPUT"
          elif [ "${{ inputs.program }}" = "cbridge" ]; then
            echo "prefix=github.com/open-cmsis-pack/generator-bridge" >> "$GITHUB_OUTPUT"
          else
            echo "prefix=github.com/open-cmsis-pack/${{ inputs.program }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish coverage report to QLTY
        uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v1
        with:
          token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
          files: '${{ needs.configure-ci.outputs.working-dir }}/**/cover.out'
          strip-prefix: ${{ steps.get-strip-prefix.outputs.prefix }}
          skip-errors: false