name: Lint
on:
  pull_request:
    branches: [ master ]
concurrency: 
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
env:
  # environment variables shared between build steps
  # do not include sensitive credentials and tokens here, instead pass them
  # directly to tools that need them to limit the blast radius in case one of them
  # becomes compromised and leaks credentials to external sites.
  # required by Makefile
  UNIX_SHELL_ON_WINDOWS: true
  # set (to any value other than false) to trigger random unicode filenames testing (logs may be difficult to read)
  ENABLE_UNICODE_FILENAMES: ${{ secrets.ENABLE_UNICODE_FILENAMES }}
  # set (to any value other than false) to trigger very long filenames testing
  ENABLE_LONG_FILENAMES: ${{ secrets.ENABLE_LONG_FILENAMES }}
jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    name: Lint
    runs-on: ${{ matrix.os }}
    steps:
    - name: Check out repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
    - name: Set up Go
      uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
      with:
        go-version-file: 'go.mod'
        check-latest: true
      id: go
      if: ${{ !contains(matrix.os, 'ARMHF') }}
    - id: govulncheck
      uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
      with:
        cache: false
        go-version-input:
        go-version-file: 'go.mod'
        repo-checkout: false
    - name: Lint
      run: make lint
    - name: Check Locks
      run: make check-locks
