ci.yml

name: CI

on:
  push:
    branches: [develop, main]
  # All pull requests: stacked pull requests target each other, not develop.
  pull_request:

permissions:
  contents: read

# A new push cancels the older run for the same branch or pull request.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: ubuntu-latest

    steps:
    - name: Check out the repository
      uses: actions/checkout@v7
      with:
        fetch-depth: 0  # git describe needs the tags for the version

    - name: Set up Go
      uses: actions/setup-go@v7
      with:
        go-version: '1.27'
        check-latest: true

    - name: Run the checks
      run: make check

    # make check runs as the runner user, so the tests that need root skip.
    # They cover "sudo fly update": the owner of the binary, and a link that
    # a hostile owner of the binary folder puts in place of the new file.
    - name: Run the tests that need root
      run: sudo env "PATH=$PATH" "GOCACHE=$(go env GOCACHE)" "GOMODCACHE=$(go env GOMODCACHE)" go test -count=1 -run 'TestReplaceBinary' ./internal/release/

    - name: Build the release archives
      run: make release