build-and-test.yml

name: Build, Test, & Release 🚀
on:
  push:
    branches:
      - "main"
  pull_request_target:
    types: [opened, synchronize, edited]
env:
  GO_VERSION: "1.20"
  REF: ${{ github.event_name == 'push' && github.ref || github.event.pull_request.head.ref }}
concurrency: ${{ github.ref }}-${{ github.event_name }}-${{ github.event.pull_request.head.ref }}
jobs:
  lint:
    strategy:
      matrix:
        go-version: [1.19.x, 1.20.x]
        os: [ubuntu-latest, macos-latest, windows-latest]
    name: lint
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        name: checkout
        with:
          ref: ${{ env.REF }}
      - uses: actions/setup-go@v5
        name: setup go
        with:
          go-version: ${{ matrix.go-version }}
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: v1.52
          args: --timeout=10m0s
          skip-cache: true
  test:
    permissions:
      id-token: write
    needs: lint
    strategy:
      matrix:
        go-version: [1.19.x, 1.20.x]
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        name: checkout
        with:
          ref: ${{ env.REF }}
      - uses: actions/setup-go@v5
        name: setup go
        with:
          go-version: ${{ matrix.go-version }}
      - name: aws
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::507109231688:role/automation-gha
          aws-region: eu-west-2
      - name: gcp
        uses: google-github-actions/auth@v2
        with:
          token_format: "access_token"
          workload_identity_provider: "projects/667354156589/locations/global/workloadIdentityPools/cicd/providers/github"
          service_account: storage-writer@bbeesley-iam.iam.gserviceaccount.com
      - run: go test -v ./...
        name: test
  release:
    runs-on: ubuntu-latest
    needs: test
    if: ${{ github.ref_name == github.event.repository.default_branch && github.event_name == 'push' }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        name: checkout
        with:
          ref: ${{ env.REF }}
      - uses: actions/setup-go@v5
        name: setup-go
        with:
          go-version: ${{ env.GO_VERSION }}
      - uses: go-semantic-release/action@v1
        name: release
        with:
          hooks: goreleaser
          changelog-file: CHANGELOG.md
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  tests-complete:
    runs-on: ubuntu-latest
    needs: test
    if: ${{ github.event_name != 'push' }}
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
        if: ${{ github.actor == 'dependabot[bot]' }}
        with:
          ref: ${{ env.REF }}
      - name: approve-dependabot
        if: ${{ github.actor == 'dependabot[bot]' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PA_TOKEN }}
        run: |
          gh pr review --approve || true
          gh pr merge --auto --rebase || true