kmsvc-proto/.forgejo/workflows/ci.yaml

name: ci

on:
  push:
  pull_request:

jobs:
  buf:
    runs-on: docker
    container:
      image: bufbuild/buf:latest
    steps:
      # actions/checkout@v4 is a JS action — it needs `node` inside the job's
      # container to run, but bufbuild/buf has no Node.js. Plain git clone has
      # no such dependency and works in any image.
      #
      # The runner's own homelab CA isn't trusted by this container's
      # default CA bundle, so https clone fails cert verification — install
      # the CA before cloning.
      - name: trust homelab CA
        env:
          HOMELAB_CA_CERT: ${{ secrets.HOMELAB_CA_CERT }}
        run: |
          mkdir -p /usr/local/share/ca-certificates
          echo "$HOMELAB_CA_CERT" > /usr/local/share/ca-certificates/homelab-ca.crt
          update-ca-certificates

      - name: checkout
        env:
          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git clone "https://x-access-token:${GIT_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: buf lint
        run: buf lint

      - name: buf breaking (against main)
        run: buf breaking --against '.git#branch=main'
        if: github.ref != 'refs/heads/main'

  codegen-check:
    runs-on: docker
    container:
      image: golang:1.25
    steps:
      # Same reason as the buf job: golang:1.25 has no Node.js, so the JS
      # action actions/checkout@v4 can't run here — plain git clone instead.
      - name: trust homelab CA
        env:
          HOMELAB_CA_CERT: ${{ secrets.HOMELAB_CA_CERT }}
        run: |
          mkdir -p /usr/local/share/ca-certificates
          echo "$HOMELAB_CA_CERT" > /usr/local/share/ca-certificates/homelab-ca.crt
          apt-get update -qq && apt-get install -y -qq ca-certificates >/dev/null
          update-ca-certificates

      - name: checkout
        env:
          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git clone "https://x-access-token:${GIT_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install buf and protoc plugins
        run: |
          go install github.com/bufbuild/buf/cmd/buf@latest
          go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
          go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@latest

      - name: Regenerate and diff
        run: |
          export PATH="$PATH:$(go env GOPATH)/bin"
          buf generate
          git diff --exit-code -- gen || (echo "::error::gen/ is out of date — run buf generate and commit the result" && exit 1)

      - name: go build
        run: go build ./...