code-health.yml

---
name: Code Health
on:
  push:
    branches:
      - master
  pull_request:
permissions:
  pull-requests: write  # For PR-specific operations
  issues: write        # For commenting functionality
jobs:
  golangci:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
          cache: false # see https://github.com/golangci/golangci-lint-action/issues/807
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6.1.1
        with:
          version: v1.61.0
  unit-tests:
    env:
      COVERAGE: coverage.out
      TEST_CMD: gotestsum --junitfile unit-tests.xml --format standard-verbose --
      UNIT_TAGS: unit
      INTEGRATION_TAGS: integration
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        if: ${{ matrix.os=='ubuntu-latest' }}
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: go install gotest.tools/gotestsum@latest
      - run: make unit-test
      - name: Test Summary
        id: test_summary
        uses: test-summary/action@v2.4
        with:
          paths: unit-tests.xml
        if: always() && matrix.os == 'ubuntu-latest'
      - name: Upload coverage file
        if: matrix.os == 'ubuntu-latest' && github.event_name == 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-file
          path: coverage.out

  code-coverage:
    needs: unit-tests
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Get merge base
        id: merge_base
        run: |
          MERGE_BASE=$(git merge-base "${{ github.event.pull_request.head.sha }}" "${{ github.event.pull_request.base.sha }}")
          echo "merge_base=$MERGE_BASE" >> "$GITHUB_OUTPUT"
          echo "Checking coverage against: $MERGE_BASE"
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - name: Download coverage file
        uses: actions/download-artifact@v4
        with:
          name: coverage-file
      - name: Check coverage cache
        id: cache-coverage
        uses: actions/cache@v4
        with:
          path: coverage.base.out
          key: coverage-${{ steps.merge_base.outputs.merge_base }}
      - name: Generate base coverage
        if: steps.cache-coverage.outputs.cache-hit != 'true'
        run: |
          # Get coverage from base branch
          git checkout ${{ steps.merge_base.outputs.merge_base }}
          COVERAGE=coverage.base.out make unit-test
      - name: Save coverage to cache
        if: steps.cache-coverage.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: coverage.base.out
          key: coverage-${{ steps.merge_base.outputs.merge_base }}
      - name: Compare coverage
        id: compare
        env:
          BASE_REF: ${{ github.base_ref }}
          HEAD_REF: ${{ github.head_ref }}
        run: |
          # use go tool cover to calculate coverage percentage
          base_coverage=$(go tool cover -func=coverage.base.out | grep total: | awk '{print $3}' | sed 's/%//')
          pr_coverage=$(go tool cover -func=coverage.out | grep total: | awk '{print $3}' | sed 's/%//')
          
          # Calculate difference
          diff=$(echo "$pr_coverage - $base_coverage" | bc)
          echo "diff=$diff" >> "$GITHUB_OUTPUT"
          
          # Create comment content
          if (( $(echo "$diff >= 0" | bc -l) )); then
            trend="📈"
          else
            trend="📉"
          fi
          
          {
            echo "Coverage Report $trend"
            echo "| Branch | Commit | Coverage |"
            echo "|--------|--------|----------|"
            echo "| ${BASE_REF} | ${{ steps.merge_base.outputs.merge_base }} | ${base_coverage}% |"
            echo "| ${HEAD_REF} | ${{ github.event.pull_request.head.sha }} | ${pr_coverage}% |"
            echo "|        | Difference | ${diff}% |"
          } > comment.md
          cat "comment.md" >> "$GITHUB_STEP_SUMMARY"
      - name: set Apix Bot token
        id: app-token
        uses: mongodb/apix-action/token@v4
        with:
          app-id: ${{ secrets.APIXBOT_APP_ID }}
          private-key: ${{ secrets.APIXBOT_APP_PEM }}
      - name: Comment PR
        uses: marocchino/sticky-pull-request-comment@v2.9.0
        with:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          recreate: true
          path: comment.md
      - name: Check coverage threshold
        run: |
          if (( $(echo "${{ steps.compare.outputs.diff }} < 0" | bc -l) )); then
            echo "Error: Coverage difference (${{ steps.compare.outputs.diff }}%) is negative"
          fi

  fuzz-tests:
    env:
      COVERAGE: coverage.out
      TEST_CMD: gotestsum --format standard-verbose --
      UNIT_TAGS: unit
      INTEGRATION_TAGS: integration
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: go install gotest.tools/gotestsum@latest
      - run: make fuzz-normalizer-test
  libraryOwners:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - name: Run check-library-owners
        run: make check-library-owners
  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - name: Generate docs
        run: make gen-docs > /dev/null
      - name: Check for uncommitted files
        run: |
          export FILES=
          FILES=$(git ls-files -o -m --directory --exclude-standard --no-empty-directory)
          export LINES=
          LINES=$(echo "$FILES" | awk 'NF' | wc -l)
          if [ "$LINES" -ne 0 ]; then
            echo "Detected files that need to be committed:"
            echo "${FILES//^/ }"
            echo ""
            echo "Try running: make gen-docs"
            exit 1
          fi
  actionlint:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Download actionlint
        id: get_actionlint
        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
        shell: bash
      - name: Check workflow files
        run: |
          echo "::add-matcher::.github/actionlint-matcher.json"
          ${{ steps.get_actionlint.outputs.executable }} -color
        shell: bash
  mocks:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - name: Install go-mock
        run: go install github.com/golang/mock/mockgen@latest
      - name: Generate mocks
        run: make gen-mocks
      - name: Check for uncommitted files
        run: |
          export FILES=
          FILES=$(git ls-files -o -m --directory --exclude-standard --no-empty-directory)
          export LINES=
          LINES=$(echo "$FILES" | awk 'NF' | wc -l)
          if [ "$LINES" -ne 0 ]; then
            echo "Detected files that need to be committed:"
            echo "${FILES//^/ }"
            echo ""
            echo "Try running: make gen-mocks"
            exit 1
          fi
  shellcheck:
    name: shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Run ShellCheck
        uses: bewuethr/shellcheck-action@v2
  tidy:
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - name: Run 'go mod tidy'
        run: go mod tidy
      - name: Check for uncommitted files
        run: |
          export FILES=
          FILES=$(git ls-files -o -m --directory --exclude-standard --no-empty-directory)
          export LINES=
          LINES=$(echo "$FILES" | awk 'NF' | wc -l)
          if [ "$LINES" -ne 0 ]; then
            echo "Detected files that need to be committed:"
            echo "${FILES//^/ }"
            echo ""
            echo "Try running: go mod tidy"
            exit 1
          fi
  licensecheck:
    name: licensecheck
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: make devtools
      - run: ./build/ci/check-licenses.sh
  checktemplates:
    name: checktemplates
    runs-on: ubuntu-latest
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - uses: actions/checkout@v4
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: make check-templates
  verify_image:
    name: Build docker image
    runs-on: ubuntu-latest
    env:
      DOCKER_CLI_EXPERIMENTAL: enabled
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
        with:
          config: ${{ vars.PERMISSIONS_CONFIG }}
      - name: Check out the repo
        uses: actions/checkout@v4
      - name: Linting
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
      - name: Enable containerd image store
        uses: crazy-max/ghaction-setup-docker@v4.0.0
        with:
          version: v24.0.6
          daemon-config: |
            {
              "features": {
                "containerd-snapshotter": true
              }
            }
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.7.1
      - name: Build image to dockerhub staging registry
        uses: docker/build-push-action@v6.10.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          tags: mongodb/atlas:test
          file: Dockerfile