ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read   # PILOT-113: least-privilege default

jobs:
  go:
    name: Go (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Vet
        run: go vet ./...

      - name: Build
        # cmd/{registry,beacon,rendezvous,nameserver,gateway,updater,pilot-ca}
        # were extracted to sibling pilot-protocol/* repos; only daemon
        # and pilotctl ship from this repo now.
        run: |
          go build ./cmd/daemon
          go build ./cmd/pilotctl

      - name: Test (pkg + cmd + internal, -short)
        # PR CI runs pkg/cmd/internal unit tests with -short. The full
        # ./tests/ integration suite (daemons + network round-trips)
        # was structurally too heavy for the 15m public-runner budget
        # (sustained 15m timeouts even with per-test deadline bumps in
        # PR #120). Integration is now exclusively in nightly.yml.
        # -short skips 3 known-slow stress tests in pkg/daemon and
        # pkg/daemon/udpio; everything else runs.
        #
        # t.TempDir() flakes with "mkdir <dir>/<TestName>/001: permission
        # denied" on the hosted runners when $TMPDIR points into /tmp.
        # /tmp (and /private/tmp on macOS) is world-writable with the
        # sticky bit (mode 1777); the runner's extra sandbox layer
        # (sandbox-exec on macOS, AppArmor on ubuntu) intermittently
        # denies the nested mkdir Go does for each parallel sub-test there,
        # which is why #316's `mktemp -d /tmp/...` + chmod 777 still failed
        # on #302/#321/#325 (and started hitting ubuntu too). The fix is to
        # keep temp OUT of the sticky /tmp tree and use a plain, per-user,
        # runner-owned directory instead:
        #   * macOS: the OS-native DARWIN_USER_TEMP_DIR (/var/folders/.../T)
        #     — a per-user temp with no sticky bit and no sandbox quirk.
        #   * Linux: a fresh dir under the runner-owned $RUNNER_TEMP.
        # No job/step-level `env: TMPDIR:` is set anywhere in this
        # workflow, so nothing overrides this export.
        run: |
          if [ "${RUNNER_OS}" = "macOS" ]; then
            TMPDIR="$(getconf DARWIN_USER_TEMP_DIR)"
          else
            TMPDIR="$(mktemp -d "${RUNNER_TEMP:-/tmp}/gotmpXXXXXX")"
          fi
          export TMPDIR
          echo "using TMPDIR=$TMPDIR"
          go test -short -count=1 -timeout 600s ./pkg/... ./cmd/... ./internal/...