name: linter

on:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
    branches:
      - "main"
      - "release-**"

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  # Required: allow read access to the content for analysis.
  contents: read
  # Optional: allow read access to pull request. Use with `only-new-issues` option.
  pull-requests: read
  # Optional: Allow write access to checks to allow the action to annotate code in the PR.
  checks: write

jobs:
  changes:
    outputs:
      should-run-linting: ${{ steps.changes.outputs.go == 'true' }}
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: changes
        with:
          filters: |
            go:
              - '**.go'
              - 'go.*'
              - '.github/workflows/lint.yml'
              - '.golangci.yml'

  golangci-lint:
    needs: [changes]
    if: github.event.pull_request.draft == false && needs.changes.outputs.should-run-linting == 'true'
    name: Linting
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      # need to setup go toolchain explicitly
      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
        with:
          go-version-file: go.mod

      - name: golangci-lint
        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6
        with:
          # renovate: datasource=github-releases depName=golangci/golangci-lint
          version: v1.64.4

  skip-lint:
    needs: [changes]
    if: needs.changes.outputs.should-run-linting == 'false'
    name: Linting
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
        with:
          egress-policy: audit

      - run: 'echo "No build required"'