name: Lint

on:
  push:
    tags:
      - v*
  pull_request:

permissions:
  contents: read
  pull-requests: read

jobs:
  golangci-lint:
    name: golangci-lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version: "1.27"
      - name: golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
        with:
          # NOTE: Version and args must match scripts/lint.sh
          version: v2.13.2
          args: --enable bodyclose,copyloopvar,misspell --timeout 10m
  man-page-staleness:
    name: man-page-staleness
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version: "1.27"
      - name: Regenerate man page
        run: make man
      - name: Check for staleness
        run: |
          if ! git diff --exit-code docs/man/trufflehog.1; then
            echo "::error::docs/man/trufflehog.1 is stale. Run 'make man' and commit the result."
            exit 1
          fi
  semgrep:
    name: semgrep
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - run: semgrep --config=hack/semgrep-rules/detectors.yaml pkg/detectors/
  checksecretparts:
    # Reports detector packages that construct detectors.Result without
    # populating SecretParts. See hack/checksecretparts/README.md.
    name: checksecretparts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version: "1.27"
      - name: Run checksecretparts
        run: go run ./hack/checksecretparts -fail ./pkg/detectors