go.yml

name: Go

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]


jobs:

  build:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write

    steps:
    - uses: actions/checkout@v3

    # Configure Workload Identity Federation via a credentials file.
    - id: 'auth'
      name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@v1'
      with:
        workload_identity_provider: 'projects/536185737408/locations/global/workloadIdentityPools/carbonifer-gh-pool/providers/carbonifer-oidc-provider'
        service_account: 'github@carbonifer-sandbox.iam.gserviceaccount.com'
      if: github.event_name != 'pull_request'

    - name: Set up Go
      uses: actions/setup-go@v4
      with:
        go-version: '1.20'

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: 1.4.6
        terraform_wrapper: false
    - run: terraform version -json
  
    - name: Build
      run: go build -v ./...

    - name: Vet
      run: go vet ./...
    
    - name: golangci-lint
      uses: golangci/golangci-lint-action@v3

    - name: Test with credentials
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      run: go test -v ./...
      if: github.event_name != 'pull_request'

    # If run from fork, we should not use tests requiring credentials
    - name: Test without credentials
      run: go test -v ./...
      env:
        SKIP_WITH_CREDENTIALS: true
      if: github.event_name == 'pull_request'