sops/.github/workflows/cli.yml

name: CLI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  build:
    name: Build and test ${{ matrix.os }} ${{ matrix.arch }} ${{ matrix.go-version }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        os: [linux, darwin, windows]
        arch: [amd64, arm64]
        go-version: ['1.23', '1.24']
        exclude:
          - os: windows
            arch: arm64
    env:
      VAULT_VERSION: "1.14.0"
      VAULT_TOKEN: "root"
      VAULT_ADDR: "http://127.0.0.1:8200"
    steps:
      - name: Set up Go ${{ matrix.go-version }}
        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
        with:
          go-version: ${{ matrix.go-version }}
        id: go

      - name: Check out code into the Go module directory
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Vendor Go Modules
        run: make vendor

      - name: Restore go/toolchain lines of go.mod
        run: python3 .github/utils/patch-go.mod.py

      - name: Ensure clean working tree
        run: git diff --exit-code

      - name: Build ${{ matrix.os }}
        if: matrix.os != 'windows'
        run: GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} go build -o sops-${{ matrix.go-version }}-${{ matrix.os }}-${{ matrix.arch }}-${{ github.sha }} -v ./cmd/sops

      - name: Build ${{ matrix.os }}
        if: matrix.os == 'windows'
        run: GOOS=${{ matrix.os }} go build -o sops-${{ matrix.go-version }}-${{ matrix.os }}-${{ github.sha }} -v ./cmd/sops

      - name: Import test GPG keys
        run: for i in 1 2 3 4 5; do gpg --import pgp/sops_functional_tests_key.asc && break || sleep 15; done

      - name: Test
        run: make test

      - name: Upload artifact for ${{ matrix.os }}
        if: matrix.os != 'windows'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: sops-${{ matrix.go-version }}-${{ matrix.os }}-${{ matrix.arch }}-${{ github.sha }}
          path: sops-${{ matrix.go-version }}-${{ matrix.os }}-${{ matrix.arch }}-${{ github.sha }}

      - name: Upload artifact for ${{ matrix.os }}
        if: matrix.os == 'windows'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: sops-${{ matrix.go-version }}-${{ matrix.os }}-${{ github.sha }}
          path: sops-${{ matrix.go-version }}-${{ matrix.os }}-${{ github.sha }}
  test:
    name: Functional tests
    runs-on: ubuntu-latest
    needs: [build]
    strategy:
      matrix:
        go-version: ['1.24']
    env:
      VAULT_VERSION: "1.14.0"
      VAULT_TOKEN: "root"
      VAULT_ADDR: "http://127.0.0.1:8200"
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      # Rustup will detect toolchain version and profile from rust-toolchain.toml
      # It will download and install the toolchain and components automatically
      # and make them available for subsequent commands
      - name: Install Rust toolchain
        run: rustup show

      - name: Show Rust version
        run: cargo --version

      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
        with:
          name: sops-${{ matrix.go-version }}-linux-amd64-${{ github.sha }}

      - name: Move SOPS binary
        run: mv sops-${{ matrix.go-version }}-linux-amd64-${{ github.sha }} ./functional-tests/sops

      - name: Make SOPS binary executable
        run: chmod +x ./functional-tests/sops

      - name: Download Vault
        run: curl -O "https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && sudo unzip vault_${VAULT_VERSION}_linux_amd64.zip -d /usr/local/bin/

      - name: Start Vault server
        run: vault server -dev -dev-root-token-id="$VAULT_TOKEN" &

      - name: Enable Vault KV
        run: vault secrets enable -version=1 kv

      - name: Import test GPG keys
        run: for i in 1 2 3 4 5; do gpg --import pgp/sops_functional_tests_key.asc && break || sleep 15; done

      - name: Run tests
        run: cargo test
        working-directory: ./functional-tests

  # The 'check' job should depend on all other jobs so it's possible to configure branch protection only for 'check'
  # instead of having to explicitly list all individual jobs that need to pass.
  check:
    if: always()

    needs:
      - build
      - test

    runs-on: ubuntu-latest

    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          allowed-failures: docs, linters
          allowed-skips: non-voting-flaky-job
          jobs: ${{ toJSON(needs) }}