name: CI

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Weekly, so newly published vulnerabilities in Go or a dependency
    # show up even when nothing has changed here.
    - cron: "17 6 * * 1"

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      # The oldest Go that go.mod allows, so it keeps building there.
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
      - name: gofmt
        run: |
          unformatted=$(gofmt -l .)
          if [ -n "$unformatted" ]; then
            echo "These files need gofmt:"
            echo "$unformatted"
            exit 1
          fi
      - name: go vet
        run: go vet ./...
      - name: staticcheck
        run: go run honnef.co/go/tools/cmd/staticcheck@2026.2.2 ./...

  release-build:
    # Builds every release binary without publishing, so a broken release
    # config shows up on the PR rather than when a version is tagged.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v7
        with:
          go-version: stable
          check-latest: true
      - uses: goreleaser/goreleaser-action@v7
        with:
          version: "~> v2"
          args: release --snapshot --clean

  vulncheck:
    # Reports known vulnerabilities in the Go standard library and the
    # dependencies that the code actually calls.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version: stable
          check-latest: true
      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...

  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version: stable
          check-latest: true
      - uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: "21"
      - name: Download epubcheck
        shell: bash
        run: |
          curl -sSL -o "$RUNNER_TEMP/epubcheck.zip" \
            https://github.com/w3c/epubcheck/releases/download/v${EPUBCHECK_VERSION}/epubcheck-${EPUBCHECK_VERSION}.zip
          unzip -q "$RUNNER_TEMP/epubcheck.zip" -d "$RUNNER_TEMP"
          echo "EPUBCHECK_JAR=$RUNNER_TEMP/epubcheck-${EPUBCHECK_VERSION}/epubcheck.jar" >> "$GITHUB_ENV"
        env:
          EPUBCHECK_VERSION: "5.2.1"
      - name: Test
        run: go test -race ./...
      - name: Build
        run: go build ./cmd/rekopub
      - name: Build with build.cmd
        if: runner.os == 'Windows'
        shell: cmd
        run: |
          call build.cmd || exit /b 1
          rekopub.exe -h || exit /b 1
          rekopub.exe -VERSION || exit /b 1