feat: add go-lint, go-test, commitlint and license-headers composite actions

.github/actions/codeql-scan/README.md

@@ -412,7 +412,7 @@ jobs:
   codeql-go:
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       - uses: NVIDIA/dsx-github-actions/.github/actions/codeql-scan@main
         with:
           languages: "go"
@@ -558,7 +558,7 @@ jobs:
   build-and-scan:
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
 
       # CodeQL will trace this build
       - uses: NVIDIA/dsx-github-actions/.github/actions/codeql-scan@main

.github/actions/commitlint/README.md

@@ -0,0 +1,52 @@
+# Commitlint Action
+
+A GitHub Composite Action that validates commit messages against [Conventional Commits](https://www.conventionalcommits.org/) using `commitlint`.
+
+## Usage
+
+```yaml
+steps:
+  - uses: actions/checkout@v4
+    with:
+      fetch-depth: 0  # Required to access commit history
+  - name: Lint Commits
+    uses: NVIDIA/dsx-github-actions/.github/actions/commitlint@main
+```
+
+### With custom config
+
+```yaml
+steps:
+  - uses: actions/checkout@v4
+    with:
+      fetch-depth: 0
+  - name: Lint Commits
+    uses: NVIDIA/dsx-github-actions/.github/actions/commitlint@main
+    with:
+      config-file: '.commitlintrc.js'
+```
+
+## Inputs
+
+| Input | Description | Required | Default |
+| :--- | :--- | :--- | :--- |
+| `config-file` | Path to commitlint config file. If empty, uses default discovery. | `false` | `''` |
+| `from` | Lint commits starting from this ref (exclusive). | `false` | `''` |
+| `to` | Lint commits up to this ref (inclusive). | `false` | `HEAD` |
+| `node-version` | Node.js version to use. | `false` | `20` |
+
+## Behavior
+
+1. **Set up Node.js** using `actions/setup-node`.
+2. **Install commitlint** packages (`@commitlint/cli` and `@commitlint/config-conventional`).
+3. **Determine commit range** automatically:
+   - If `from` input is provided, uses that ref.
+   - In PR context: lints commits from the base branch (`origin/$GITHUB_BASE_REF`).
+   - In push context: lints only the latest commit (`HEAD~1..HEAD`).
+   - On initial commits or shallow clones: lints `HEAD` only.
+4. **Run commitlint** with verbose output.
+
+## Notes
+
+- The calling workflow must use `actions/checkout` with `fetch-depth: 0` (or at least enough depth to cover all commits in the PR) for commitlint to access the full commit range.
+- npm packages are installed with `--ignore-scripts` for supply chain safety.

.github/actions/commitlint/action.yml

@@ -0,0 +1,88 @@
+# Copyright (c) 2026, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: 'Commit Lint'
+description: 'Validate commit messages against conventional commits using commitlint'
+
+inputs:
+  config-file:
+    description: 'Path to commitlint config file. If empty, uses default discovery (commitlint.config.js, .commitlintrc.js, etc.)'
+    required: false
+    default: ''
+  from:
+    description: 'Lint commits starting from this ref (exclusive). Defaults to the base of the PR or the parent of HEAD.'
+    required: false
+    default: ''
+  to:
+    description: 'Lint commits up to this ref (inclusive). Defaults to HEAD.'
+    required: false
+    default: 'HEAD'
+  node-version:
+    description: 'Node.js version to use'
+    required: false
+    default: '20'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up Node.js
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    - name: Install commitlint
+      shell: bash
+      run: npm install --no-package-lock --no-save --ignore-scripts @commitlint/cli @commitlint/config-conventional
+
+    - name: Determine commit range
+      id: range
+      shell: bash
+      env:
+        INPUT_FROM: ${{ inputs.from }}
+      run: |
+        if [ -n "$INPUT_FROM" ]; then
+          echo "from=$INPUT_FROM" >> "$GITHUB_OUTPUT"
+        elif [ -n "$GITHUB_BASE_REF" ]; then
+          # PR context: lint commits from base branch
+          echo "from=origin/$GITHUB_BASE_REF" >> "$GITHUB_OUTPUT"
+        elif git rev-parse HEAD~1 >/dev/null 2>&1; then
+          # Push context: lint only the latest commit
+          echo "from=HEAD~1" >> "$GITHUB_OUTPUT"
+        else
+          # Initial commit or shallow clone: skip range, lint HEAD only
+          echo "from=" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Run commitlint
+      shell: bash
+      env:
+        COMMITLINT_FROM: ${{ steps.range.outputs.from }}
+        COMMITLINT_TO: ${{ inputs.to }}
+        COMMITLINT_CONFIG: ${{ inputs.config-file }}
+      run: |
+        CONFIG_FLAG=""
+        if [ -n "$COMMITLINT_CONFIG" ]; then
+          CONFIG_FLAG="--config $COMMITLINT_CONFIG"
+        fi
+
+        FROM_FLAG=""
+        if [ -n "$COMMITLINT_FROM" ]; then
+          FROM_FLAG="--from $COMMITLINT_FROM"
+          echo "Linting commits from $COMMITLINT_FROM to $COMMITLINT_TO"
+        else
+          echo "Linting commit $COMMITLINT_TO"
+        fi
+
+        # shellcheck disable=SC2086
+        npx commitlint $FROM_FLAG --to "$COMMITLINT_TO" $CONFIG_FLAG --verbose

.github/actions/go-lint/README.md

@@ -0,0 +1,46 @@
+# Go Lint Action
+
+A GitHub Composite Action that runs a Go linting suite: `golangci-lint`, `go fmt` check, and `go vet`.
+
+## Usage
+
+```yaml
+steps:
+  - uses: actions/checkout@v4
+  - name: Go Lint
+    uses: NVIDIA/dsx-github-actions/.github/actions/go-lint@main
+    with:
+      working-directory: '.'
+```
+
+### With vendor mode and custom config
+
+```yaml
+steps:
+  - uses: actions/checkout@v4
+  - name: Go Lint
+    uses: NVIDIA/dsx-github-actions/.github/actions/go-lint@main
+    with:
+      go-flags: '-mod=vendor'
+      config-path: '.golangci.yml'
+      golangci-lint-args: '--timeout=5m'
+```
+
+## Inputs
+
+| Input | Description | Required | Default |
+| :--- | :--- | :--- | :--- |
+| `go-version` | Go version to use (e.g., `1.25.5`). If empty, uses `go.mod`. | `false` | `''` |
+| `go-version-file` | Path to `go.mod` for version detection. | `false` | `go.mod` |
+| `working-directory` | Working directory for lint commands. | `false` | `.` |
+| `golangci-lint-version` | golangci-lint version. | `false` | `v2.11` |
+| `golangci-lint-args` | Additional arguments for `golangci-lint run`. | `false` | `''` |
+| `config-path` | Path to `.golangci.yml` config file. | `false` | `''` |
+| `go-flags` | `GOFLAGS` environment variable (e.g., `-mod=vendor`). | `false` | `''` |
+
+## Behavior
+
+1. **Set up Go** using `actions/setup-go` with caching enabled.
+2. **Check go fmt** by running `gofmt -l` on all `.go` files (excluding `vendor/`). Fails if any files are unformatted.
+3. **Run go vet** on all packages.
+4. **Run golangci-lint** via `golangci/golangci-lint-action`.

.github/actions/go-lint/action.yml

@@ -0,0 +1,99 @@
+# Copyright (c) 2026, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: 'Go Lint'
+description: 'Run Go linting suite: golangci-lint, go fmt check, and go vet'
+
+inputs:
+  go-version:
+    description: 'Go version to use (e.g., 1.25.5). If empty, uses go.mod version.'
+    required: false
+    default: ''
+  go-version-file:
+    description: 'Path to go.mod for version detection. Used when go-version is empty.'
+    required: false
+    default: 'go.mod'
+  working-directory:
+    description: 'Working directory for running lint commands'
+    required: false
+    default: '.'
+  golangci-lint-version:
+    description: 'golangci-lint version to use'
+    required: false
+    default: 'v2.11'
+  golangci-lint-args:
+    description: 'Additional arguments for golangci-lint run'
+    required: false
+    default: ''
+  config-path:
+    description: 'Path to .golangci.yml config file. If empty, uses default discovery.'
+    required: false
+    default: ''
+  go-flags:
+    description: 'GOFLAGS environment variable (e.g., -mod=vendor)'
+    required: false
+    default: ''
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up Go
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      with:
+        go-version: ${{ inputs.go-version }}
+        go-version-file: ${{ inputs.go-version == '' && format('{0}/{1}', inputs.working-directory, inputs.go-version-file) || '' }}
+        cache: true
+        cache-dependency-path: ${{ inputs.working-directory }}/go.sum
+
+    - name: Check go fmt
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        GOFLAGS: ${{ inputs.go-flags }}
+      run: |
+        echo "::group::go fmt"
+        UNFMT=$(find . -name '*.go' -not -path './vendor/*' -exec gofmt -l {} + 2>&1)
+        FIND_EXIT=$?
+        if [ "$FIND_EXIT" -ne 0 ] && [ -z "$UNFMT" ]; then
+          echo "::error::gofmt check failed unexpectedly (exit code $FIND_EXIT)"
+          echo "::endgroup::"
+          exit 1
+        fi
+        if [ -n "$UNFMT" ]; then
+          echo "::error::The following files are not formatted:"
+          echo "$UNFMT"
+          echo "::endgroup::"
+          echo "Run 'gofmt -w .' to fix formatting."
+          exit 1
+        fi
+        echo "All files formatted correctly."
+        echo "::endgroup::"
+
+    - name: Run go vet
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        GOFLAGS: ${{ inputs.go-flags }}
+      run: |
+        echo "::group::go vet"
+        go vet ./...
+        echo "::endgroup::"
+        # Note: go vet ./... already skips vendor/ by default
+
+    - name: Run golangci-lint
+      uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+      with:
+        version: ${{ inputs.golangci-lint-version }}
+        working-directory: ${{ inputs.working-directory }}
+        args: ${{ inputs.config-path != '' && format('--config {0} {1}', inputs.config-path, inputs.golangci-lint-args) || inputs.golangci-lint-args }}

.github/actions/go-test/README.md

@@ -0,0 +1,65 @@
+# Go Test Action
+
+A GitHub Composite Action that runs Go tests with race detection, coverage reporting, and JUnit XML output via `gotestsum`.
+
+## Usage
+
+```yaml
+steps:
+  - uses: actions/checkout@v4
+  - name: Go Test
+    uses: NVIDIA/dsx-github-actions/.github/actions/go-test@main
+```
+
+### With custom packages and flags
+
+```yaml
+steps:
+  - uses: actions/checkout@v4
+  - name: Go Test
+    uses: NVIDIA/dsx-github-actions/.github/actions/go-test@main
+    with:
+      packages: './pkg/...'
+      test-flags: '-v -count=1 -timeout=10m'
+      go-flags: '-mod=vendor'
+      artifact-name: 'test-results-${{ matrix.go-version }}'
+```
+
+## Inputs
+
+| Input | Description | Required | Default |
+| :--- | :--- | :--- | :--- |
+| `go-version` | Go version to use (e.g., `1.25.5`). If empty, uses `go.mod`. | `false` | `''` |
+| `go-version-file` | Path to `go.mod` for version detection. | `false` | `go.mod` |
+| `working-directory` | Working directory for running tests. | `false` | `.` |
+| `packages` | Go packages to test. | `false` | `./...` |
+| `race` | Enable race detector. | `false` | `true` |
+| `coverage` | Enable coverage reporting. | `false` | `true` |
+| `coverage-file` | Coverage output file name. | `false` | `coverage.out` |
+| `junit` | Generate JUnit XML report via `gotestsum`. | `false` | `true` |
+| `junit-file` | JUnit XML output file name. | `false` | `junit-report.xml` |
+| `test-flags` | Additional flags passed to `go test`. | `false` | `-v -count=1` |
+| `go-flags` | `GOFLAGS` environment variable (e.g., `-mod=vendor`). | `false` | `''` |
+| `gotestsum-version` | `gotestsum` version to install. | `false` | `v1.12.0` |
+| `upload-artifacts` | Upload coverage and JUnit reports as workflow artifacts. | `false` | `true` |
+| `artifact-name` | Name for uploaded artifact (override to avoid collisions in matrix builds). | `false` | `go-test-results` |
+
+## Outputs
+
+| Output | Description |
+| :--- | :--- |
+| `coverage-file` | Path to coverage output file. |
+| `junit-file` | Path to JUnit XML report. |
+
+## Behavior
+
+1. **Set up Go** using `actions/setup-go` with caching enabled.
+2. **Install gotestsum** (pinned version) if JUnit output is enabled.
+3. **Run tests** with configurable race detection, coverage, and JUnit output.
+4. **Display coverage summary** showing the total coverage percentage.
+5. **Upload artifacts** (coverage and JUnit reports) with 7-day retention.
+
+## Notes
+
+- When using matrix builds, set `artifact-name` to a unique value per matrix cell to avoid upload collisions (e.g., `artifact-name: 'test-results-${{ matrix.go-version }}'`).
+- All shell inputs are routed through environment variables to prevent expression injection.