name: CI

on:
  push:
    branches: ["**"]
  pull_request:

permissions:
  contents: read

jobs:
  build:
    name: 构建 / 静态检查 / 测试
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # 格式检查：任何未 gofmt 的文件都会让 CI 失败
      - name: gofmt
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "以下文件未通过 gofmt："
            echo "$unformatted"
            exit 1
          fi

      - name: go vet
        run: go vet ./...

      # staticcheck 能发现 go vet 覆盖不到的问题（死代码、永不匹配的条件、
      # 误用标准库等）。本仓库在 ecdsax/ 下有 staticcheck.conf，对 SA1019 做了
      # 定向豁免并写明了理由。
      - name: staticcheck
        run: |
          go install honnef.co/go/tools/cmd/staticcheck@latest
          staticcheck ./...

      - name: go build
        run: go build ./...

      # -race 能发现并发使用中的问题；本库的函数应全部可并发调用
      - name: go test
        run: go test -race -covermode=atomic -coverprofile=coverage.txt ./...

      - name: 覆盖率摘要
        run: go tool cover -func=coverage.txt | tail -n 20

      - name: 上传覆盖率
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage.txt

  vulncheck:
    name: 依赖漏洞扫描
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # govulncheck 只报告「代码确实会走到」的漏洞，比单纯比对版本号更准
      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

  fuzz:
    name: 模糊测试冒烟
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # 每个目标短跑一段时间。解密路径的输入直接来自不可信来源，这里是对
      # "绝不 panic" 承诺的持续验证。
      - name: fuzz 冒烟
        run: |
          for target in FuzzDecryptNeverPanics FuzzDecryptWithIVNeverPanics \
                        FuzzSymmetricRoundTrip FuzzAEADTamperDetection; do
            echo "===== $target ====="
            go test -run='^$' -fuzz="^${target}$" -fuzztime=30s .
          done

  tidy:
    name: go.mod 一致性
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      # 确保 go.mod / go.sum 与源码 import 保持一致
      - name: go mod tidy 检查
        run: |
          cp go.mod go.mod.bak
          cp go.sum go.sum.bak
          go mod tidy
          diff -u go.mod.bak go.mod
          diff -u go.sum.bak go.sum