lint.yml

name: golangci-lint
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read
  pull-requests: read # Use with `only-new-issues` option.

env:
  GO_VERSION: 1.21

jobs:
  golangci:
    name: check-linter
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false # golangci-lint maintains its own cache
      - name: set golangci-lint version # keep in sync with tools/go.mod
        run: |
          echo "GOLANGCI_LINT_VERSION=$(cd tools; go list -m -f '{{ .Version }}' github.com/golangci/golangci-lint)" >> "$GITHUB_ENV"
      - name: golangci-lint
        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
        with:
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          only-new-issues: true