chore: bump dependencies, migrate CI to Nix, and modernize build tooling #427

	name: Run unit tests
	on:
	push:
	branches:
	- main
	pull_request:
	types: [opened, synchronize, reopened]

	jobs:
	tests:
	name: Tests
	runs-on: ubuntu-latest
	permissions:
	checks: write
	pull-requests: write

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Fetch target branch
	if: github.event_name == 'pull_request'
	run: \|
	git fetch origin ${{ github.event.pull_request.base.ref }}:${{ github.event.pull_request.base.ref }}

	- name: Install Nix
	uses: cachix/install-nix-action@19effe9fe722874e6d46dd7182e4b8b7a43c4a99 # v31.10.0

	- name: Check go.mod is tidy
	run: \|
	nix develop --command go mod tidy
	git diff --exit-code go.mod go.sum

	- name: Run Gosec Security Scanner
	run: nix develop --command gosec -exclude-dir=.gomod -exclude-dir=.go ./...

	- name: Run tests
	run: nix develop --command task test-coverage

	- name: Upload coverage reports to Codecov
	uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	files: coverage.out

Navigation Menu