feat: update go to 1.25, add permissions and envs (#49)

* chore(ci): update go to 1.25, add permissions and envs
* fix(ci): update pr-lint.yml
* chore: update go, fix linting
* fix: tests and linting
* fix(lint): lint fixes, renovate should now pass
* fix: updates, security upgrades
* chore: workflow updates, lint
* fix: more lint, checkmake, and other fixes
* fix: more lint, convert scripts to POSIX compliant
* fix: simplify codeql workflow
* tests: increase test coverage, fix found issues
* fix(lint): editorconfig checking, add to linters
* fix(lint): shellcheck, add to linters
* fix(lint): apply cr comment suggestions
* fix(ci): remove step-security/harden-runner
* fix(lint): remove duplication, apply cr fixes
* fix(ci): tests in CI/CD pipeline
* chore(lint): deduplication of strings
* fix(lint): apply cr comment suggestions
* fix(ci): actionlint
* fix(lint): apply cr comment suggestions
* chore: lint, add deps management

.github/workflows/build-test-publish.yml

@@ -9,8 +9,7 @@ on:
   release:
     types: [created]
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   test:
@@ -25,51 +24,60 @@ jobs:
       statuses: write
 
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout code
+      - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Set up Go
-        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - name: Setup Go
+        uses: ./.github/actions/setup
         with:
-          go-version-file: "./go.mod"
-          cache: true
+          token: ${{ github.token }}
 
-      - name: Install dependencies
-        run: go mod tidy
+      - name: Download dependencies
+        shell: bash
+        run: go mod download
 
-      - name: Run tests
-        run: go test -json ./... > test-results.json
-
-      - name: Generate coverage report
-        run: go test -coverprofile=coverage.out ./...
+      - name: Run tests with coverage
+        shell: bash
+        run: |
+          go test -race -covermode=atomic -json -coverprofile=coverage.out ./... | tee test-results.json
 
       - name: Check coverage
         id: coverage
+        if: always()
+        shell: bash
         run: |
+          if [[ ! -f coverage.out ]]; then
+            echo "coverage.out is missing; tests likely failed before producing coverage"
+            exit 1
+          fi
           coverage="$(go tool cover -func=coverage.out | grep total | awk '{print substr($3, 1, length($3)-1)}')"
           echo "total_coverage=$coverage" >> "$GITHUB_ENV"
           echo "Coverage: $coverage%"
 
       - name: Upload test results
+        if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: test-results
           path: test-results.json
 
       - name: Cleanup
-        run: rm coverage.out
+        if: always()
+        shell: bash
+        run: rm -f coverage.out test-results.json
 
       - name: Fail if coverage is below threshold
+        if: always()
+        shell: bash
         run: |
-          if (( $(echo "$total_coverage < 50" | bc -l) )); then
-            echo "Coverage ($total_coverage%) is below the threshold (50%)"
+          if [[ -z "${total_coverage:-}" ]]; then
+            echo "total_coverage is unset; previous step likely failed"
             exit 1
           fi
+          awk -v cov="$total_coverage" 'BEGIN{ if (cov < 60) exit 1; else exit 0 }' || {
+            echo "Coverage ($total_coverage%) is below the threshold (60%)"
+            exit 1
+          }
 
   build:
     name: Build Binaries
@@ -89,13 +97,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Set up Go
-        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - name: Setup Go
+        uses: ./.github/actions/setup
         with:
-          go-version-file: "./go.mod"
+          token: ${{ github.token }}
 
-      - name: Run go mod tidy
-        run: go mod tidy
+      - name: Download dependencies
+        run: go mod download
 
       - name: Build binary for ${{ matrix.goos }}-${{ matrix.goarch }}
         run: |
@@ -132,24 +140,24 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Download Linux binaries
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+      - name: Setup Go
+        uses: ./.github/actions/setup
         with:
-          name: gibidify-linux-amd64
-          path: .
+          token: ${{ github.token }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Log in to GitHub Container Registry
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-
-      - name: Build and push multi-arch Docker image
         run: |
-          chmod +x gibidify-linux-amd64
-          mv gibidify-linux-amd64 gibidify
-          docker buildx build --platform linux/amd64,linux/arm64,linux/arm/v7 \
-            --tag ghcr.io/${{ github.repository }}/gibidify:${{ github.ref_name }} \
-            --tag ghcr.io/${{ github.repository }}/gibidify:latest \
-            --push \
-            --squash .
+          echo "${{ github.token }}" | docker login ghcr.io \
+            -u "$(echo "${{ github.actor }}" | tr '[:upper:]' '[:lower:]')" \
+            --password-stdin
+
+      - name: Build and push Docker image
+        run: |
+          repo="$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
+          docker buildx build --platform linux/amd64 \
+            --tag "ghcr.io/${repo}/gibidify:${{ github.ref_name }}" \
+            --tag "ghcr.io/${repo}/gibidify:latest" \
+            --push .