SEC-090: Automated trusted workflow pinning (2025-01-20) #386

	name: consul-telemetry-checks

	on:
	push:
	branches:
	- main
	- 'release/..x'
	pull_request:

	jobs:
	get-go-version:
	name: "Determine Go toolchain version"
	runs-on: ubuntu-latest
	outputs:
	go-version: ${{ steps.get-go-version.outputs.go-version }}
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Determine Go version
	id: get-go-version
	# We use .go-version as our source of truth for current Go
	# version, because "goenv" can react to it automatically.
	run: \|
	echo "Building with Go $(cat .go-version)"
	echo "go-version=$(cat .go-version)" >> $GITHUB_OUTPUT

	test:
	runs-on: ubuntu-latest
	needs:
	- get-go-version
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
	with:
	go-version: ${{ needs.get-go-version.outputs.go-version }}
	- name: Deps
	run: \|
	make deps
	- name: Test
	run: \|
	make go/test

	golangci:
	name: lint
	needs:
	- get-go-version
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
	with:
	go-version: ${{ needs.get-go-version.outputs.go-version }}
	- name: Deps
	run: \|
	make deps
	- name: Lint
	run: \|
	export PATH=$(go env GOPATH)/bin:$PATH
	make go/lint

	e2e:
	if: github.repository == 'hashicorp/consul-telemetry-collector' && contains(github.event.pull_request.labels.*.name, 'e2e')
	needs:
	[test, golangci]
	uses: ./.github/workflows/e2e.yml
	secrets: inherit

Provide feedback