threshold/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [ main, dev ]
  pull_request:
    branches: [ main, dev ]
  workflow_dispatch:

env:
  GO_VERSION: '1.26.4'

jobs:
  lint:
    name: Lint
    runs-on: lux-build-amd64
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          # Pin to v1.64.8 (last v1 release) to pair with the v1-format
          # .golangci.yml. `latest` can drift to v2 and fail config parsing.
          version: v1.64.8
          args: --timeout=5m
          skip-cache: true

      - name: Run go fmt
        run: |
          if [ "$(gofmt -s -l . | wc -l)" -gt 0 ]; then
            echo "The following files are not formatted:"
            gofmt -s -l .
            exit 1
          fi

      - name: Run go vet
        run: go vet ./...

  test:
    name: Test
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        go-version: ['1.26.4']
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
          cache: true

      - name: Download dependencies
        run: go mod download

      - name: Verify dependencies
        run: go mod verify

      - name: Run tests
        run: go test -v -race -short -timeout 120s -count=1 ./...

      - name: Run build verification
        run: go build -v ./...

      - name: Run tests with coverage
        if: matrix.os == 'ubuntu-latest' && matrix.go-version == env.GO_VERSION
        run: go test -v -race -short -coverprofile=coverage.out -covermode=atomic -timeout 120s -count=1 ./...

      - name: Upload coverage to Codecov
        if: matrix.os == 'ubuntu-latest' && matrix.go-version == env.GO_VERSION
        uses: codecov/codecov-action@v4
        with:
          files: ./coverage.out
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false
          verbose: true

  benchmark:
    name: Benchmark
    runs-on: lux-build-amd64
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Run benchmarks
        run: go test -bench=. -benchtime=100ms -benchmem -timeout=120s -short -count=1 ./...

      - name: Upload benchmark results
        uses: actions/upload-artifact@v4
        with:
          name: benchmark-results
          path: |
            *.prof
            *.test

  build:
    name: Build
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        arch: [amd64, arm64]
        exclude:
          - os: windows-latest
            arch: arm64
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Build binary
        env:
          GOOS: ${{ runner.os == 'Windows' && 'windows' || runner.os == 'macOS' && 'darwin' || 'linux' }}
          GOARCH: ${{ matrix.arch }}
        shell: bash
        run: |
          mkdir -p bin
          go build -v -ldflags "-s -w" -o bin/threshold-cli${{ runner.os == 'Windows' && '.exe' || '' }} ./cmd/threshold-cli

      - name: Upload binary
        uses: actions/upload-artifact@v4
        with:
          name: threshold-${{ runner.os }}-${{ matrix.arch }}
          path: bin/

  security:
    name: Security Scan
    runs-on: lux-build-amd64
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        continue-on-error: true
        with:
          args: -exclude=G104,G115,G304,G401,G501,G502 -fmt=sarif -out=results.sarif ./...

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

      - name: Run go mod audit
        continue-on-error: true
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./... || true

  integration:
    name: Integration Test
    runs-on: lux-build-amd64
    needs: [lint, test, build]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Build binary
        run: |
          mkdir -p bin
          go build -v -o bin/threshold-cli ./cmd/threshold-cli

      - name: Run local simulation
        run: |
          ./bin/threshold-cli info
          echo "CLI tool built successfully"

      - name: Test multi-party setup
        run: |
          # This would require more complex setup with network simulation
          echo "Multi-party integration tests would run here"

  release:
    name: Release
    runs-on: lux-build-amd64
    needs: [lint, test, build, security, integration]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Build release binaries
        run: |
          # Build for multiple platforms
          platforms=("linux/amd64" "linux/arm64" "darwin/amd64" "darwin/arm64" "windows/amd64")
          for platform in "${platforms[@]}"; do
            platform_split=(${platform//\// })
            GOOS=${platform_split[0]}
            GOARCH=${platform_split[1]}
            output_name="threshold-cli-${GOOS}-${GOARCH}"
            if [ $GOOS = "windows" ]; then
              output_name+='.exe'
            fi
            echo "Building ${output_name}..."
            GOOS=$GOOS GOARCH=$GOARCH go build -ldflags "-s -w" -o "bin/${output_name}" ./cmd/threshold-cli
          done

      - name: Create checksums
        run: |
          cd bin
          sha256sum * > checksums.txt
          cd ..

      - name: Upload release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-binaries
          path: bin/