Sonar on all mods

.github/actions/changed-modules/action.yml

@@ -0,0 +1,50 @@
+name: Changed Go modules
+description: |
+  Lists the Go modules a run should check, for a matrix of per-module jobs.
+
+  Every module is listed on a push, on a run with no changeset, and when any file under .github
+  changes. Otherwise a module is listed when any file in its directory changed, Go or not, since
+  embedded files are built in too. A file belongs to the deepest module containing it, and an
+  example module counts as its parent (see script/go-modules.sh).
+
+  Expects a checkout with full history.
+
+outputs:
+  modules:
+    description: A JSON array of module paths relative to the repository root, the root module as ".".
+    value: ${{ steps.resolve.outputs.modules }}
+
+runs:
+  using: composite
+  steps:
+    - name: Modules with changed files
+      id: changed
+      uses: smartcontractkit/.github/actions/changed-modules-go@changed-modules-go/v1
+      with:
+        no-change-behaviour: all
+        file-patterns: "**"
+        module-patterns: |
+          **
+          !**/vendor/**
+
+    - name: Workflow changes
+      id: workflows
+      uses: smartcontractkit/.github/actions/changed-modules-go@changed-modules-go/v1
+      with:
+        no-change-behaviour: none
+        file-patterns: .github/**
+
+    - name: Resolve modules
+      id: resolve
+      shell: bash
+      env:
+        CHANGED: ${{ steps.changed.outputs.modules-json }}
+        WORKFLOWS: ${{ steps.workflows.outputs.modules-json }}
+      run: |
+        if [[ "$GITHUB_EVENT_NAME" == push || ( -n "$WORKFLOWS" && "$WORKFLOWS" != "[]" ) ]]; then
+          modules=$(script/go-modules.sh)
+        else
+          modules=$(jq -r '.[]' <<< "$CHANGED" | while read -r module; do script/go-modules.sh parent "$module"; done)
+        fi
+        modules=$(jq -Rsc 'split("\n") | map(select(. != "")) | unique' <<< "$modules")
+        echo "modules=$modules" | tee -a "$GITHUB_OUTPUT"

.github/workflows/go-mod-cache.yml

@@ -1,7 +1,7 @@
 name: Go Module Cache
 
 # This workflow is responsible for updating the Go Module Cache.
-# It will maintain the cache: linux-gomod-1-<hash>
+# It will maintain a cache per module: linux-gomod-1-<hash of its go.sum>
 # All other workflows should only restore this cache.
 
 # This workflow is useful because it will:
@@ -25,9 +25,31 @@
   workflow_dispatch:
 
 jobs:
+  modules:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      modules: ${{ steps.modules.outputs.modules }}
+    steps:
+      - name: Checkout the repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: List modules
+        id: modules
+        run: echo "modules=$(script/go-modules.sh | jq -Rsc 'split("\n") | map(select(. != ""))')" | tee -a "$GITHUB_OUTPUT"
+
   go-cache:
-    name: Go Mod Cache
+    # Each module's cache is keyed by its own go.sum, so each is filled by its own run.
+    name: Go Mod Cache (${{ matrix.module }})
+    needs: modules
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: ${{ fromJSON(needs.modules.outputs.modules) }}
     permissions:
       contents: read
       pull-requests: read
@@ -41,13 +63,21 @@
         id: setup-go
         uses: ./.github/actions/setup-go
         with:
+          # hashFiles rejects ./go.sum, so the root module's files are named bare.
+          go-version-file: ${{ matrix.module == '.' && 'go.mod' || format('{0}/go.mod', matrix.module) }}
+          go-module-file: ${{ matrix.module == '.' && 'go.sum' || format('{0}/go.sum', matrix.module) }}
           only-modules: "true"
           restore-module-cache-only: "false"
 
       - name: Install Dependencies
         if: ${{ steps.setup-go.outputs.primary-cache-hit-modules != 'true' }}
         shell: bash
+        env:
+          MODULE: ${{ matrix.module }}
         run: |
           echo "::group::go mod download"
-          go mod download
+          # A module's examples are built in its run, so their dependencies share its cache.
+          for module in "$MODULE" $(script/go-modules.sh examples "$MODULE"); do
+            go -C "$module" mod download
+          done
           echo "::endgroup::"

.github/workflows/golangci_lint.yml

@@ -1,6 +1,10 @@
 name: golangci-lint
 
 on:
+  # Pushes to main give Sonar's view of main a lint report of its own commit.
+  push:
+    branches:
+      - main
   pull_request:
   merge_group:
   schedule:
@@ -13,7 +17,7 @@ jobs:
       contents: read
       pull-requests: read
     outputs:
-      modules: ${{ steps.changed-modules.outputs.modules-json }}
+      modules: ${{ steps.changed-modules.outputs.modules }}
     steps:
       - name: Checkout the repo
         uses: actions/checkout@v5
@@ -23,21 +27,7 @@ jobs:
 
       - name: Changed modules
         id: changed-modules
-        uses: smartcontractkit/.github/actions/changed-modules-go@changed-modules-go/v1
-        with:
-          # when scheduled/workflow_dispatch, run against all modules
-          no-change-behaviour: all
-          file-patterns: |
-            **/*.go
-            **/go.mod
-            **/go.sum
-          # The commentparsing examples are modules only so they can model a downstream consumer
-          # of the library, which takes the local replace directives gomoddirectives rejects.
-          # x-config.yml still builds them, regenerates them and fails on a diff.
-          module-patterns: |
-            **
-            !**/vendor/**
-            !x/config/commentparsing/examples/**
+        uses: ./.github/actions/changed-modules
 
   lint-module:
     # Avoid running in merge queue since we run in PR's and have an optional
@@ -96,6 +86,7 @@ jobs:
     if: ${{ github.event_name != 'merge_group' }}
     needs: [detect-modules, lint-module]
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Lint complete
         run: echo "All lint jobs completed"

.github/workflows/keystore.yml

@@ -7,6 +7,13 @@ on: [push, merge_group, pull_request]
 jobs:
   changes:
     name: detect changes
+    # pkg.yml checks keystore on pull requests to main, in the merge queue and on pushes to main.
+    # This workflow checks only the events it doesn't: pushes to other branches, and pull requests
+    # to them.
+    if: >-
+      !(github.event_name == 'merge_group' ||
+        (github.event_name == 'pull_request' && github.base_ref == 'main') ||
+        (github.event_name == 'push' && github.ref_name == 'main'))
     runs-on: ubuntu-latest
     outputs:
       keystore-src: ${{ steps.keystore-changes.outputs.src }}
@@ -21,7 +28,7 @@ jobs:
           filters: |
             src:
             - 'keystore/**'
-            - '.github/workflows/keystore.yml'
+            - '.github/**'
 
   run-tests:
     name: run tests

.github/workflows/observability.yml

@@ -4,9 +4,16 @@ on:
   push:
     paths:
       - "observability-lib/**"
+      - ".github/**"
+
+permissions:
+  contents: read
 
 jobs:
   run-tests:
+    # pkg.yml checks observability-lib on pushes to main, so this workflow checks only pushes to
+    # other branches.
+    if: github.ref_name != 'main'
     defaults:
       run:
         working-directory: observability-lib