name: hermetic-ci

on:
  push:
  pull_request:

permissions:
  contents: read

env:
  GOFLAGS: -mod=readonly
  GOTOOLCHAIN: local

jobs:
  test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Download locked modules
        run: go mod download
      - name: Formatting
        run: test -z "$(gofmt -l .)"
      - name: Hermetic full test suite
        run: ./scripts/test-hermetic.sh
      - name: Static analysis
        run: go vet ./...
      - name: Documentation contract
        run: ./scripts/check-docs.sh
      - name: Reproducible cross-builds and checksums
        run: ./scripts/test-release.sh
      - name: Clean-machine verification
        run: ./scripts/verify-clean-machine.sh