go-test.yml

# Copyright 2026 Specter Ops, Inc.
#
# Licensed under the Apache License, Version 2.0
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0

name: Run Go tests

on:
  pull_request:
    branches:
      - "main"
      - "stage/**"
    types:
      - "opened"
      - "synchronize"
      - "reopened"

jobs:
  call-run-upload-main-coverage-files:
    uses: ./.github/workflows/upload-coverage-files.yml
  test:
    runs-on: ubuntu-latest
    needs: call-run-upload-main-coverage-files
    steps:
      - env:
          COV_FILE_ID: ${{ needs.call-run-upload-main-coverage-files.outputs.coverage-artifact-id }}
        run: echo "Artifact ID from previous job is $COV_FILE_ID"

      - name: Checkout source code for this repository
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # ratchet:actions/checkout@v5

      - name: Install Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # ratchet:actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
          check-latest: true

      - name: Run Tests
        run: |
          make test

      - name: Verify Generated Test Cases
        run: |
          make test_update
          git diff --exit-code

      - name: Parse Coverage Value From Feature Branch
        run: |
          echo "current_coverage=$(tail -n 1 .coverage/coverage.txt | awk '{print $3}' | awk 'sub("%", "")')" >> $GITHUB_ENV

      - name: Feature Branch Coverage Value
        run: |
          printf 'Coverage Value: %s\n' "$current_coverage"

      - name: Download Main Coverage
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # ratchet:actions/download-artifact@v8
        with:
          artifact-ids: ${{ needs.call-run-upload-main-coverage-files.outputs.coverage-artifact-id }}
          path: tmp/

      - name: Display structure of downloaded files
        run: ls -R

      - name: Parse Coverage Value From Main Branch
        run: |
          echo "main_coverage=$(tail -n 1 tmp/coverage.txt | awk '{print $3}' | awk 'sub("%", "")')" >> $GITHUB_ENV

      - name: Main Coverage Value
        run: |
          printf 'Coverage Value: %s\n' "$main_coverage"

      - name: Coverage Evaluation
        run: |
          if (( $(echo "$current_coverage < $main_coverage" | bc -l))); then
            echo "Failing the workflow. Coverage on feature branch ($current_coverage%) is below main branch ($main_coverage%)"
            exit 1
          else
            echo "Coverage is within the limits"
          fi
  integration-test-pg:
    name: Run integration tests (pg)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    services:
      postgres:
        image: index.docker.io/library/postgres@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941 # ratchet:postgres:18
        env:
          POSTGRES_USER: dawgs
          POSTGRES_PASSWORD: weneedbetterpasswords
          POSTGRES_DB: dawgs
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U dawgs -d dawgs"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Checkout source code for this repository
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # ratchet:actions/checkout@v5
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # ratchet:actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
          check-latest: true

      - name: Run integration tests
        env:
          CONNECTION_STRING: postgres://dawgs:weneedbetterpasswords@localhost:5432/dawgs?sslmode=disable
          DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE: "1"
          DAWGS_INTEGRATION_DISPOSABLE_TARGETS: postgresql://localhost:5432/dawgs
        run: |
          make test_integration

  integration-test-neo4j:
    name: Run integration tests (neo4j)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    services:
      neo4j:
        image: index.docker.io/library/neo4j@sha256:73b5a47eb9952f47fcc42fcc80bdd6bd0d6b71eea9a1a345c216675498c790e4 # ratchet:neo4j:4.4.42
        env:
          NEO4J_AUTH: neo4j/weneedbetterpasswords
        ports:
          - 7687:7687
        options: >-
          --health-cmd "wget -q -O /dev/null http://localhost:7474 || exit 1"
          --health-interval 15s
          --health-timeout 10s
          --health-retries 10
          --health-start-period 40s
    steps:
      - name: Checkout source code for this repository
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # ratchet:actions/checkout@v5
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # ratchet:actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
          check-latest: true

      - name: Run integration tests
        env:
          CONNECTION_STRING: neo4j://neo4j:weneedbetterpasswords@localhost:7687
          DAWGS_INTEGRATION_ALLOW_DESTRUCTIVE: "1"
          DAWGS_INTEGRATION_DISPOSABLE_TARGETS: neo4j://localhost:7687/<default>
        run: |
          make test_integration

  bdd-integration-test-pg:
    name: Run BDD integration tests (pg)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    services:
      postgres:
        image: index.docker.io/library/postgres@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941 # ratchet:postgres:18
        env:
          POSTGRES_USER: dawgs
          POSTGRES_PASSWORD: weneedbetterpasswords
          POSTGRES_DB: dawgs
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U dawgs -d dawgs"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Checkout source code for this repository
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # ratchet:actions/checkout@v5
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # ratchet:actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
          check-latest: true

      - name: Run BDD integration tests
        env:
          CONNECTION_STRING: postgres://dawgs:weneedbetterpasswords@localhost:5432/dawgs?sslmode=disable
        run: |
          make test_bdd_integration

  bdd-integration-test-neo4j:
    name: Run BDD integration tests (neo4j)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    services:
      neo4j:
        image: index.docker.io/library/neo4j@sha256:73b5a47eb9952f47fcc42fcc80bdd6bd0d6b71eea9a1a345c216675498c790e4 # ratchet:neo4j:4.4.42
        env:
          NEO4J_AUTH: neo4j/weneedbetterpasswords
        ports:
          - 7687:7687
        options: >-
          --health-cmd "wget -q -O /dev/null http://localhost:7474 || exit 1"
          --health-interval 15s
          --health-timeout 10s
          --health-retries 10
          --health-start-period 40s
    steps:
      - name: Checkout source code for this repository
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # ratchet:actions/checkout@v5
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # ratchet:actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
          check-latest: true

      - name: Run BDD integration tests
        env:
          CONNECTION_STRING: neo4j://neo4j:weneedbetterpasswords@localhost:7687
        run: |
          make test_bdd_integration