name: ci
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  vet-and-test:
    runs-on: nightly
    steps:
      - name: Checkout
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          # 自包含检出（runner 无法访问 github.com 上的 actions/checkout）：固定 SHA 浅取回；凭据只经 GIT_CONFIG_* 环境变量以 URL 限定的 extraheader 传给单个 git 进程（不进命令行、不持久化）；强制检出并清理遗留文件，等价 actions/checkout 的 clean。
          case "$GITHUB_SHA" in *[!0-9a-fA-F]*|"") echo "Checkout requires a fixed commit SHA" >&2; exit 1;; esac
          url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
          git init -q .
          GIT_CONFIG_COUNT=3 \
            GIT_CONFIG_KEY_0="http.${url}.extraheader" GIT_CONFIG_VALUE_0="AUTHORIZATION: token ${TOKEN}" \
            GIT_CONFIG_KEY_1=credential.helper GIT_CONFIG_VALUE_1= \
            GIT_CONFIG_KEY_2=core.hooksPath GIT_CONFIG_VALUE_2=/dev/null \
            git fetch -q --depth=1 "$url" "$GITHUB_SHA"
          git checkout -q -f --detach FETCH_HEAD
          git clean -ffdxq
          unset TOKEN
      - run: go vet ./... && go test -count=1 ./...
  docker-checkout-hostgateway:
    runs-on: ubuntu-latest
    options: --add-host gitea:host-gateway
    env:
      GITHUB_SERVER_URL: http://gitea:3000
    steps:
      - name: Checkout
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          # 自包含检出（runner 无法访问 github.com 上的 actions/checkout）：固定 SHA 浅取回；凭据只经 GIT_CONFIG_* 环境变量以 URL 限定的 extraheader 传给单个 git 进程（不进命令行、不持久化）；强制检出并清理遗留文件，等价 actions/checkout 的 clean。
          case "$GITHUB_SHA" in *[!0-9a-fA-F]*|"") echo "Checkout requires a fixed commit SHA" >&2; exit 1;; esac
          url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
          git init -q .
          GIT_CONFIG_COUNT=3 \
            GIT_CONFIG_KEY_0="http.${url}.extraheader" GIT_CONFIG_VALUE_0="AUTHORIZATION: token ${TOKEN}" \
            GIT_CONFIG_KEY_1=credential.helper GIT_CONFIG_VALUE_1= \
            GIT_CONFIG_KEY_2=core.hooksPath GIT_CONFIG_VALUE_2=/dev/null \
            git fetch -q --depth=1 "$url" "$GITHUB_SHA"
          git checkout -q -f --detach FETCH_HEAD
          git clean -ffdxq
          unset TOKEN
      - run: test -f go.mod && echo "docker-mode checkout via host-gateway OK"