feat(go): add TLS integration tests and examples

.github/actions/go/pre-merge/action.yml

@@ -72,41 +72,41 @@ runs:
         # Create reports directory
         mkdir -p ../../reports
 
-        # Run tests with coverage
-        go test -v -race -coverprofile=../../reports/go-coverage.out ./...
+        # Run unit tests with coverage (integration tests run in e2e task)
+        go test -v -race -coverprofile=../../reports/go-coverage.out $(go list ./... | grep -v /tests)
 
         # Generate coverage report
         go tool cover -html=../../reports/go-coverage.out -o ../../reports/go-coverage.html
 
         # Run tests with JSON output for better reporting
-        go test -v -json ./... > ../../reports/go-tests.json
+        go test -v -json $(go list ./... | grep -v /tests) > ../../reports/go-tests.json
 
     - name: Lint
       if: inputs.task == 'lint'
-      uses: golangci/golangci-lint-action@v6
+      uses: golangci/golangci-lint-action@v7
       with:
-        version: v1.64.8
+        version: v2.11.3
         working-directory: foreign/go
         args: --timeout=5m
-        cache: false
+        skip-cache: true
 
     - name: Lint BDD
       if: inputs.task == 'lint' && hashFiles('bdd/go/go.mod') != ''
-      uses: golangci/golangci-lint-action@v6
+      uses: golangci/golangci-lint-action@v7
       with:
-        version: v1.64.8
+        version: v2.11.3
         working-directory: bdd/go
         args: --timeout=5m
-        cache: false
+        skip-cache: true
 
     - name: Lint Examples
       if: inputs.task == 'lint' && hashFiles('examples/go/go.mod') != ''
-      uses: golangci/golangci-lint-action@v6
+      uses: golangci/golangci-lint-action@v7
       with:
-        version: v1.64.8
+        version: v2.11.3
         working-directory: examples/go
         args: --timeout=5m
-        cache: false
+        skip-cache: true
 
     - name: Build
       shell: bash
@@ -121,13 +121,24 @@ runs:
       if: inputs.task == 'e2e'
       uses: ./.github/actions/utils/setup-rust-with-cache
 
+    - name: Build Iggy server Docker image for TLS tests
+      if: inputs.task == 'e2e'
+      id: docker_build
+      uses: ./.github/actions/utils/docker-build-test-server
+      with:
+        image-tag: "iggy-server:test"
+        libc: "glibc"
+        profile: "debug"
+
     - name: Setup server for e2e tests
       if: inputs.task == 'e2e'
       uses: ./.github/actions/utils/server-start
 
     - name: Run e2e tests
       shell: bash
       if: inputs.task == 'e2e'
+      env:
+        IGGY_SERVER_DOCKER_IMAGE: ${{ steps.docker_build.outputs.docker_image }}
       run: |
         echo "🧪 Running Go e2e tests..."
 
@@ -142,7 +153,7 @@ runs:
         mkdir -p reports
 
         # Run foreign/go e2e tests with coverage
-        echo "Running foreign/go e2e tests..."
+        echo "Running foreign/go e2e tests (including TLS integration tests)..."
         cd foreign/go
         go test -v -race \
           -coverprofile=../../reports/go-coverage-e2e-sdk.out \

.github/actions/utils/setup-go-with-cache/action.yml

@@ -25,7 +25,7 @@ inputs:
   go-version:
     description: "Go version to use"
     required: false
-    default: "1.23.0"
+    default: "1.25.0"
   read-cache:
     description: "Whether to read from cache"
     required: false

bdd/go/Dockerfile

@@ -15,7 +15,7 @@
 # specific language governing permissions and limitations
 # under the License.
 
-FROM golang:1.23.10-alpine
+FROM golang:1.25.0-alpine
 
 RUN apk add --no-cache gcc musl-dev
 

bdd/go/go.mod

@@ -1,6 +1,6 @@
 module github.com/apache/iggy/bdd/go
 
-go 1.23.0
+go 1.25.0
 
 replace github.com/apache/iggy/foreign/go => ../../foreign/go
 
@@ -16,20 +16,20 @@ require (
 	github.com/avast/retry-go/v5 v5.0.0 // indirect
 	github.com/cucumber/gherkin/go/v26 v26.2.0 // indirect
 	github.com/cucumber/messages/go/v21 v21.0.1 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gofrs/uuid v4.4.0+incompatible // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-memdb v1.3.5 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/spf13/pflag v1.0.7 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	golang.org/x/tools v0.31.0 // indirect
+	golang.org/x/net v0.45.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
+	golang.org/x/tools v0.37.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

bdd/go/go.sum

@@ -11,8 +11,8 @@ github.com/cucumber/messages/go/v22 v22.0.0/go.mod h1:aZipXTKc0JnjCsXrJnuZpWhtay
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
@@ -39,8 +39,8 @@ github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uG
 github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -71,16 +71,16 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
-golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
-golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
+golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

examples/go/getting-started/consumer/main.go

@@ -37,10 +37,10 @@ var (
 )
 
 func main() {
+	serverAddr, tcpOptions := getTcpOptions()
+
 	cli, err := client.NewIggyClient(
-		client.WithTcp(
-			tcp.WithServerAddress(getTcpServerAddr()),
-		),
+		client.WithTcp(tcpOptions...),
 	)
 	if err != nil {
 		log.Fatal(err)
@@ -51,6 +51,7 @@ func main() {
 		}
 	}()
 
+	log.Printf("Connecting to server at %s", serverAddr)
 	_, err = cli.LoginUser(common.DefaultRootUsername, common.DefaultRootPassword)
 	if err != nil {
 		log.Fatal(err)
@@ -121,14 +122,31 @@ func handleMessage(message iggcon.IggyMessage) error {
 	return nil
 }
 
-func getTcpServerAddr() string {
+func getTcpOptions() (string, []tcp.Option) {
 	tcpServerAddr := flag.String("tcp-server-address", "127.0.0.1:8090", "TCP server address")
+	tlsEnabled := flag.Bool("tls", false, "Enable TLS")
+	tlsCAFile := flag.String("tls-ca-file", "", "Path to CA certificate file for TLS")
+	tlsDomain := flag.String("tls-domain", "", "TLS server domain name for SNI")
 	flag.Parse()
 
 	if _, err := net.ResolveTCPAddr("tcp", *tcpServerAddr); err != nil {
 		log.Fatalf("Invalid server address %s! Usage: --tcp-server-address <server-address>", *tcpServerAddr)
 	}
 
-	log.Printf("Using server address: %s\n", *tcpServerAddr)
-	return *tcpServerAddr
+	tcpOptions := []tcp.Option{
+		tcp.WithServerAddress(*tcpServerAddr),
+	}
+
+	if *tlsEnabled {
+		tcpOptions = append(tcpOptions, tcp.WithTLS(true))
+		if *tlsCAFile != "" {
+			tcpOptions = append(tcpOptions, tcp.WithTLSCAFile(*tlsCAFile))
+		}
+		if *tlsDomain != "" {
+			tcpOptions = append(tcpOptions, tcp.WithTLSDomain(*tlsDomain))
+		}
+		log.Printf("TLS enabled with CA file: %s, domain: %s", *tlsCAFile, *tlsDomain)
+	}
+
+	return *tcpServerAddr, tcpOptions
 }

examples/go/getting-started/producer/main.go

@@ -39,10 +39,10 @@ var (
 )
 
 func main() {
+	serverAddr, tcpOptions := getTcpOptions()
+
 	cli, err := client.NewIggyClient(
-		client.WithTcp(
-			tcp.WithServerAddress(getTcpServerAddr()),
-		),
+		client.WithTcp(tcpOptions...),
 	)
 	if err != nil {
 		log.Fatal(err)
@@ -53,6 +53,7 @@ func main() {
 		}
 	}()
 
+	log.Printf("Connecting to server at %s", serverAddr)
 	if _, err := cli.LoginUser(common.DefaultRootUsername, common.DefaultRootPassword); err != nil {
 		log.Fatalf("Login failed: %v", err)
 	}
@@ -125,14 +126,31 @@ func produceMessages(client iggcon.Client) error {
 	}
 }
 
-func getTcpServerAddr() string {
+func getTcpOptions() (string, []tcp.Option) {
 	tcpServerAddr := flag.String("tcp-server-address", "127.0.0.1:8090", "TCP server address")
+	tlsEnabled := flag.Bool("tls", false, "Enable TLS")
+	tlsCAFile := flag.String("tls-ca-file", "", "Path to CA certificate file for TLS")
+	tlsDomain := flag.String("tls-domain", "", "TLS server domain name for SNI")
 	flag.Parse()
 
 	if _, err := net.ResolveTCPAddr("tcp", *tcpServerAddr); err != nil {
 		log.Fatalf("Invalid server address %s! Usage: --tcp-server-address <server-address>", *tcpServerAddr)
 	}
 
-	log.Printf("Using server address: %s\n", *tcpServerAddr)
-	return *tcpServerAddr
+	tcpOptions := []tcp.Option{
+		tcp.WithServerAddress(*tcpServerAddr),
+	}
+
+	if *tlsEnabled {
+		tcpOptions = append(tcpOptions, tcp.WithTLS(true))
+		if *tlsCAFile != "" {
+			tcpOptions = append(tcpOptions, tcp.WithTLSCAFile(*tlsCAFile))
+		}
+		if *tlsDomain != "" {
+			tcpOptions = append(tcpOptions, tcp.WithTLSDomain(*tlsDomain))
+		}
+		log.Printf("TLS enabled with CA file: %s, domain: %s", *tlsCAFile, *tlsDomain)
+	}
+
+	return *tcpServerAddr, tcpOptions
 }

examples/go/go.mod

@@ -1,6 +1,6 @@
 module github.com/apache/iggy/examples/go
 
-go 1.23.0
+go 1.25.0
 
 replace github.com/apache/iggy/foreign/go => ../../foreign/go
 
@@ -9,5 +9,5 @@ require github.com/apache/iggy/foreign/go v0.0.0-00010101000000-000000000000
 require (
 	github.com/avast/retry-go/v5 v5.0.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 )

examples/go/go.sum

@@ -4,8 +4,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

foreign/go/client/tcp/tcp_core.go

@@ -362,12 +362,13 @@ func (c *IggyTcpClient) connect() error {
 			// TLS logic
 			tlsConfig, err := c.createTLSConfig()
 			if err != nil {
+				_ = connection.Close()
 				return err
 			}
 
 			tlsConn := tls.Client(connection, tlsConfig)
 			if err := tlsConn.Handshake(); err != nil {
-				connection.Close()
+				_ = connection.Close()
 				return fmt.Errorf("TLS handshake failed: %w", err)
 			}