From dbd878cddc61e4296a05eb9f09e085ce13277fe5 Mon Sep 17 00:00:00 2001
From: ChethanUK <chethanuk@outlook.com>
Date: Tue, 21 Jul 2026 16:15:19 +0200
Subject: [PATCH] ci: catch cross-platform build breaks, gofmt drift and untidy
 go.mod

CI builds one platform (linux/amd64) while release.yml ships six. The
repo has platform-gated source - shell_windows.go, procattr_windows.go
and their _unix twins - that CI never compiles, so a signature change to
shellCommand or configureProcessGroup compiles green on main and breaks
at tag time, after the tag is public.

Add a cross-compile matrix job covering the five targets the test job
does not, mirroring the shape release.yml:11-29 already runs on this
same runner pool. fail-fast: false so a failure names the target.

The job trusts the workspace the same way the test job does. The
container runs as root over a checkout owned by another uid, so git
reports dubious ownership and Go's VCS stamping - which runs when
building main packages - fails the build with "error obtaining VCS
status: exit status 128". Marking the checkout safe keeps stamping on
and consistent with the test job and the release builds, rather than
papering over it with -buildvcs=false.

Also add two cheap gates the repo lacked: gofmt -s drift (make fmt
rewrites and can never fail CI) and go mod tidy drift (make check
mutates, so it cannot gate either). Both print the remedy.

All six targets build clean today - this is a missing guard, not a fix.
---
 .github/workflows/ci.yml | 45 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74328b5e..b9aa7f26 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,6 +25,24 @@ jobs:
       - name: Trust workspace
         run: git config --global --replace-all safe.directory '*'
 
+      - name: Check formatting
+        run: |
+          unformatted="$(gofmt -s -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "::error::Not gofmt-clean. Run 'gofmt -s -w .' and commit:"
+            echo "$unformatted"
+            gofmt -s -d .
+            exit 1
+          fi
+
+      - name: Check go.mod is tidy
+        run: |
+          go mod tidy
+          if ! git diff --exit-code -- go.mod go.sum; then
+            echo "::error::go.mod/go.sum are not tidy. Run 'go mod tidy' and commit the diff above."
+            exit 1
+          fi
+
       - name: Vet
         run: go vet ./...
 
@@ -50,3 +68,30 @@ jobs:
 
       - name: Build
         run: go build -o /dev/null ./cmd/opencodereview
+
+  cross-compile:
+    runs-on: self-hosted
+    timeout-minutes: 20
+    container:
+      image: golang:1.26.5
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {goos: linux,   goarch: arm64}
+          - {goos: darwin,  goarch: amd64}
+          - {goos: darwin,  goarch: arm64}
+          - {goos: windows, goarch: amd64}
+          - {goos: windows, goarch: arm64}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Trust workspace
+        run: git config --global --replace-all safe.directory '*'
+
+      - name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: '0'
+        run: go build -o /dev/null ./...