name: Nightly
on:
  workflow_dispatch: {}   # Allow for manual triggers
  schedule:
    - cron:  '0 8 * * 0-4' # Sun-Thu, at 8:00 UTC

permissions:
  contents: read

env:
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}

jobs:
  race-detector:
    name: Go Race Detector
    runs-on: ubuntu-24.04
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Test with Race Detector
        run: make ci-go-race-detector

      - name: Slack Notification
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        if: failure() && env.SLACK_WEBHOOK_URL != ''
        with:
          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
            }

  native-fuzzer:
    name: Go Fuzzer (native)
    runs-on: ubuntu-24.04
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: .go-version

      - name: go test -fuzz
        run: go test ./ast -fuzz FuzzParseStatementsAndCompileModules -fuzztime 1h -v -run '^$'

      - name: Dump crashers
        if: ${{ failure() }}
        run: find ast/testdata/fuzz ! -name '*.stmt' ! -type d -print -exec cat {} \;

      - name: Slack Notification
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        if: failure() && env.SLACK_WEBHOOK_URL != ''
        with:
          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
            }

  go-perf:
    name: Go Perf
    runs-on: ubuntu-24.04
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Benchmark Test Golang
        run: make ci-go-perf
        timeout-minutes: 45
        env:
          DOCKER_RUNNING: 0

      - name: Slack Notification
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        if: failure() && env.SLACK_WEBHOOK_URL != ''
        with:
          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
            }
  govulncheck:
    name: Go vulnerability check
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: .go-version

      - run: cd build/tools && go install tool
      - run: govulncheck ./...

      - name: Slack Notification
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        if: failure() && env.SLACK_WEBHOOK_URL != ''
        with:
          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
            }

  test-ocp-with-opa-main:
    name: Test OCP with OPA main
    uses: ./.github/workflows/test-ocp-with-opa.yaml
    secrets:
      slack_webhook_url: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}

  test-regal-with-opa-main:
    name: Test Regal with OPA main
    uses: ./.github/workflows/test-regal-with-opa.yaml
    secrets:
      slack_webhook_url: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}

  test-envoy-with-opa-main:
    name: Test Envoy with OPA main
    uses: ./.github/workflows/test-envoy-with-opa.yaml
    secrets:
      slack_webhook_url: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}

  go-get-test:
    name: Go Get Smoke Test
    runs-on: ubuntu-24.04
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: .go-version

      - name: Test go get without proxy
        run: |
          mkdir -p /tmp/go-get-test
          cd /tmp/go-get-test

          go mod init test-go-get

          # Disable Go module proxy to test direct VCS access
          export GOPROXY=direct

          # Test go get with current main
          if go get github.com/open-policy-agent/opa@main 2>&1 | tee /tmp/go-get-output.log | grep -q "warning"; then
            echo "ERROR: Found warnings during go get:"
            grep "warning" /tmp/go-get-output.log
            exit 1
          fi

          echo "Success: No warnings found"
        timeout-minutes: 10

      - name: Slack Notification
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        if: failure() && env.SLACK_WEBHOOK_URL != ''
        with:
          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
            }
