name: CI
on:
  pull_request:
  push:
    branches:
      - main
    paths-ignore:
      - '**.md'
      - 'CONTRIBUTING.md'

jobs:
  check-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: go mod tidy
      - run: go build ./...
      - run: go vet ./...
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v8
        with:
          version: v2.13.2
          args: --timeout=5m
      - run: go test -race -v -shuffle=on -coverprofile=coverage.out -timeout=5m ./...
      - run: go tool cover -func=coverage.out | tail -10  # basic coverage report

  vulncheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
      - run: govulncheck ./...