go.yml

name: Go

on:
  push:
    branches: [ "main" ]
    tags: [ "v*" ]
  pull_request:
    branches: [ "main" ]

jobs:
  # Two legs: "minimum" proves the go.mod floor (1.26.0) still builds and
  # passes; "stable" is the toolchain releases are built with, and is where
  # lint and govulncheck run (#38).
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        go: [ minimum, stable ]

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      with:
        fetch-depth: 0

    - name: Set up Go (go.mod minimum)
      if: matrix.go == 'minimum'
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
      with:
        go-version-file: 'go.mod'
        cache: false

    - name: Set up Go (latest stable)
      if: matrix.go == 'stable'
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
      with:
        go-version: stable
        check-latest: true
        cache: false

    - name: Cache Go build artifacts
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
      with:
        path: |
          ~/.cache/go-build
          ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ matrix.go }}-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-${{ matrix.go }}-

    - name: Verify dependencies
      run: go mod verify

    # verify checks hashes, not tidiness: this fails on a go.mod or go.sum
    # that `make tidy` would change.
    - name: Check go.mod and go.sum are tidy
      run: go mod tidy -diff

    - name: Check go directive
      shell: bash
      run: |
        want='go 1.26.0'
        got=$(grep -m1 '^go ' go.mod)
        if [ "$got" != "$want" ]; then
          echo "go.mod directive drifted: got '$got', want '$want'. Run 'make tidy'."
          exit 1
        fi

    - name: Build
      run: go build -v -buildvcs=false -ldflags "-X main.Version=$(git describe --tags --dirty)" ./...

    - name: Test
      run: go test -v -race -shuffle=on -coverpkg=./... -coverprofile=coverage.out ./...

    # Coverage is printed and kept per run, and must stay above a floor (#170).
    # -coverpkg counts code a package is exercised through from another (the
    # CLI tests drive internal/report, for one), so the floor can sit near the
    # real total, about 92% (#261).
    - name: Coverage
      if: matrix.go == 'stable'
      shell: bash
      run: |
        total=$(go tool cover -func=coverage.out | awk '/^total:/ { sub("%", "", $3); print $3 }')
        echo "Total coverage: ${total}%" | tee -a "$GITHUB_STEP_SUMMARY"
        awk -v t="$total" 'BEGIN { exit !(t >= 85) }' || { echo "coverage ${total}% is below the 85% floor"; exit 1; }

    - name: Upload coverage
      if: matrix.go == 'stable'
      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
      with:
        name: coverage
        path: coverage.out
        retention-days: 14

    # Every generated completion script must parse in the shell it targets
    # (#117); pwsh is preinstalled on the runner.
    - name: Check completion scripts
      if: matrix.go == 'stable'
      run: |
        sudo apt-get update -qq
        sudo apt-get install -y -qq --no-install-recommends zsh fish
        dir=$(mktemp -d)
        go run . generate-assets "$dir"
        bash -n "$dir/completions/subenum.bash"
        zsh -n "$dir/completions/_subenum"
        fish --no-execute "$dir/completions/subenum.fish"
        pwsh -NoProfile -Command "\$null = [ScriptBlock]::Create((Get-Content -Raw '$dir/completions/subenum.ps1'))"

    # Lint on the stable leg: golangci-lint must be built with a Go at least as
    # new as the toolchain it analyses (v2.12 could not type-check Go 1.27).
    - name: Run golangci-lint
      if: matrix.go == 'stable'
      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
      with:
        version: v2.15.0

    # Fails on vulnerabilities reachable from this code, in dependencies or in
    # the Go standard library of the toolchain releases are built with.
    - name: Run govulncheck
      if: matrix.go == 'stable'
      run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...

  # The unit tests on macOS and Windows, whose binaries ship too: file
  # replacement, signals and paths differ there (#170). The race detector
  # runs on Linux, in build.
  test-os:
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ macos-latest, windows-latest ]
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
      with:
        go-version: stable
        check-latest: true
        cache: false

    - name: Test
      run: go test -shuffle=on ./...

  # Runs the composite action (action.yml, #126) from this checkout against
  # a lab zone on every runner OS: a scan, then a diff against its results.
  action:
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-latest ]
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
      with:
        go-version-file: 'go.mod'
        cache: false

    - name: Scan a lab zone with the action
      id: scan
      uses: ./
      with:
        version: source
        domain: lab.example
        args: -simulate-zone examples/labs/lab1-first-scan.zone -type A,CNAME
        sarif: takeovers.sarif

    - name: Check the first scan
      shell: bash
      run: |
        set -euo pipefail
        test "${{ steps.scan.outputs.verdict }}" = complete
        test "${{ steps.scan.outputs.found }}" -ge 5
        grep -q 'dangling-cname' takeovers.sarif
        cp "${{ steps.scan.outputs.results }}" previous.jsonl
        echo "gone.lab.example" >> previous.jsonl

    - name: Diff against it
      id: diff
      uses: ./
      with:
        version: source
        domain: lab.example
        args: -simulate-zone examples/labs/lab1-first-scan.zone -type A,CNAME
        previous: previous.jsonl

    - name: Check the diff
      shell: bash
      run: |
        test "${{ steps.diff.outputs.added }}" = 0
        test "${{ steps.diff.outputs.removed }}" = 1

  # Builds the Dockerfile for both published platforms without pushing, so a
  # broken image is caught on the PR rather than during a release.
  docker:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4

    - name: Build image (no push)
      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
      with:
        context: .
        platforms: linux/amd64,linux/arm64
        push: false
        build-args: VERSION=ci

  # Runs the full GoReleaser pipeline in snapshot mode on every push to main
  # (no signing, no publishing), so .goreleaser.yaml is exercised long before
  # a tag depends on it (#61).
  release-snapshot:
    needs: build
    if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
      with:
        go-version: stable
        check-latest: true
        cache: false

    - name: Install syft (SBOMs)
      uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3

    - name: GoReleaser snapshot
      uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
      with:
        version: "~> v2"
        args: release --snapshot --clean --skip=sign

    - name: Assert static Linux binaries
      shell: bash
      run: |
        for f in dist/subenum_linux_*/subenum; do
          file "$f"
          file "$f" | grep -q 'statically linked'
        done

    # The archives ship generated completions and a man page (#88); make sure
    # each one parses in its own shell, and the man page renders cleanly.
    - name: Check completions and man page
      shell: bash
      run: |
        sudo apt-get update -qq
        sudo apt-get install -y -qq --no-install-recommends zsh fish groff
        tar -xzf dist/subenum_*_linux_amd64.tar.gz -C "$RUNNER_TEMP"
        bash -n "$RUNNER_TEMP/completions/subenum.bash"
        zsh -n "$RUNNER_TEMP/completions/_subenum"
        fish -n "$RUNNER_TEMP/completions/subenum.fish"
        pwsh -NoProfile -Command "\$e = \$null; [void][System.Management.Automation.Language.Parser]::ParseFile('$RUNNER_TEMP/completions/subenum.ps1', [ref]\$null, [ref]\$e); if (\$e) { \$e; exit 1 }"
        test -z "$(groff -man -ww -z "$RUNNER_TEMP/man/subenum.1" 2>&1)"

  # Builds and publishes a release from a v* tag with GoReleaser (#61):
  # static binaries (#46), archives with LICENSE/README/CHANGELOG,
  # checksums.txt, SBOMs, a keyless cosign signature over the checksums, and
  # release notes from the tag's CHANGELOG.md section. GoReleaser creates the
  # release as a draft; it is published only after provenance is attested, so
  # the public never sees a partial release (cleanup-failed-release removes a
  # failed draft). It waits for every test job, the macOS and Windows tests
  # and the action included, since their binaries and the action ship too.
  release:
    needs: [ build, test-os, action, docker ]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      with:
        fetch-depth: 0

    # Release binaries use the latest stable Go so they ship a patched
    # standard library; go.mod's version is only the minimum (#38). No build
    # cache here, so release artifacts are always built from scratch.
    - name: Set up Go
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
      with:
        go-version: stable
        check-latest: true
        cache: false

    - name: Install syft (SBOMs)
      uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3

    - name: Install cosign (keyless signing)
      uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3

    # CITATION.cff must name the release being cut (#102); checked before
    # anything is built or published.
    - name: Check CITATION.cff version
      shell: bash
      run: |
        want="${GITHUB_REF_NAME#v}"
        got=$(sed -n 's/^version: *//p' CITATION.cff)
        if [ "$got" != "$want" ]; then
          echo "::error::CITATION.cff says version $got but the tag is ${GITHUB_REF_NAME}; update version and date-released"
          exit 1
        fi

    - name: Release notes from CHANGELOG.md
      shell: bash
      run: .github/scripts/release-notes.sh "${GITHUB_REF_NAME}" > "${RUNNER_TEMP}/notes.md"

    - name: GoReleaser
      uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
      with:
        version: "~> v2"
        args: release --clean --release-notes=${{ runner.temp }}/notes.md
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Assert static Linux binaries
      shell: bash
      run: |
        for f in dist/subenum_linux_*/subenum; do
          file "$f"
          file "$f" | grep -q 'statically linked'
        done

    - name: Attest build provenance
      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
      with:
        subject-path: |
          dist/*.tar.gz
          dist/*.zip
          dist/checksums.txt

    # Flipping draft to false is the moment the release becomes public.
    - name: Publish release
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      shell: bash
      run: gh release edit "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --draft=false

  # Publishes a multi-arch image to GHCR once the release itself is public
  # (#40). The Dockerfile cross-compiles in a build-platform builder stage, so
  # arm64 needs no QEMU. `latest` only moves for non-prerelease tags.
  publish-image:
    needs: release
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

    # GHCR requires lowercase repository names; the owner is mixed case.
    - name: Compute image name
      id: image
      shell: bash
      env:
        OWNER: ${{ github.repository_owner }}
      run: echo "name=ghcr.io/${OWNER,,}/subenum" >> "$GITHUB_OUTPUT"

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4

    - name: Log in to GHCR
      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Image metadata
      id: meta
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
      with:
        images: ${{ steps.image.outputs.name }}
        tags: |
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}

    - name: Build and push
      id: push
      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
      with:
        context: .
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        build-args: VERSION=${{ github.ref_name }}

    - name: Attest image provenance
      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
      with:
        subject-name: ${{ steps.image.outputs.name }}
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: true

  # Failure-path cleanup. If the release job fails partway, the draft release
  # GoReleaser created would otherwise linger
  # invisibly until someone removes it by hand. This job runs only when a
  # tag-triggered release run failed. It deletes the draft release for this tag
  # and the tag ref so a partial release leaves nothing behind. It only ever
  # deletes a draft (never a published release) and is a no-op when there is
  # nothing to clean, so it is safe and idempotent.
  cleanup-failed-release:
    needs: [release]
    if: ${{ failure() && startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
    - name: Remove draft release and tag for failed run
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        TAG: ${{ github.ref_name }}
        REPO: ${{ github.repository }}
      shell: bash
      run: |
        set -euo pipefail
        # Every page: past 30 releases the draft is not on the first one.
        rel=$(gh api --paginate "repos/${REPO}/releases?per_page=100" \
          --jq ".[] | select(.tag_name==\"${TAG}\") | [.id, .draft] | @tsv" | awk 'NR==1')
        if [ -z "${rel}" ]; then
          echo "No release found for ${TAG}; nothing to clean."
          exit 0
        fi
        id=$(printf '%s' "${rel}" | cut -f1)
        draft=$(printf '%s' "${rel}" | cut -f2)
        if [ "${draft}" != "true" ]; then
          echo "Release ${id} for ${TAG} is published (draft=${draft}); leaving it intact."
          exit 0
        fi
        echo "Deleting draft release ${id} for ${TAG}."
        gh api -X DELETE "repos/${REPO}/releases/${id}"
        echo "Deleting tag ref ${TAG}."
        gh api -X DELETE "repos/${REPO}/git/refs/tags/${TAG}" || echo "Tag ref already removed."
        echo "Cleanup complete for ${TAG}."