lint.yml

name: Lint

on:
  push:
    tags:
      - v*
    branches:
      - main
  pull_request:

permissions:
  # Required: allow read access to the content for analysis.
  contents: read

  # Optional: allow read access to pull request. Use with `only-new-issues` option.
  pull-requests: read

  # Optional: Allow write access to checks to allow the action to annotate code in the PR.
  checks: write

jobs:
  # ------------------------------

  golangci-lint:
    name: golangci-lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: false

      - uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: setup
        run: task setup

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          args: --timeout=5m

  # ------------------------------

  codeql-analyze:
    name: codeql-analyze
    runs-on: ubuntu-latest

    permissions:
      security-events: write
      actions: read
      contents: read

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - uses: github/codeql-action/init@v3

      - uses: github/codeql-action/autobuild@v3

      - uses: github/codeql-action/analyze@v3

  # ------------------------------

  semgrep:
    runs-on: ubuntu-latest
    name: semgrep
    container:
      image: returntocorp/semgrep
    steps:
      - uses: actions/checkout@v4

      - uses: actions/checkout@v4
        with:
          repository: dgryski/semgrep-go
          path: rules

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: semgrep
        run: semgrep scan --error --enable-nosem -f ./rules .