ci.yml

name: ci

on:
  workflow_dispatch:
  merge_group:
  pull_request:
  push:
    branches:
      - master
      - releases/*

# We set `concurrency` to prevent having this workflow being run on code that is not up-to-date on a PR (a user make multiple push in a quick manner).
# But on the main branch, we don't want that behavior.
# Having the workflow run on each merge commit is something we would like, that could help us where a regression was made and missed by previous checks.
#
# For that we use `head_ref` that is only defined on `pull-request` and fallback to `run_id` (this is a counter, so it's value is unique between workflow call).
concurrency:
  group: ci-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true


permissions:
  contents: read
  packages: read

jobs:
  dispatch:
    runs-on: ubuntu-22.04
    outputs:
      rust: ${{ steps.need-check.outputs.rust }}
      python: ${{ steps.need-check.outputs.python }}
      python-style-only: ${{ steps.need-check.outputs.python_style_only }}
      rust-platform-crates: ${{ steps.need-check.outputs.rust_platform_crates }}
      web: ${{ steps.need-check.outputs.web }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin v4.1.1
        timeout-minutes: 5

      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50  # pin v2.11.1
        id: changes
        with:
          list-files: shell
          filters: .github/filters/ci.yml
        timeout-minutes: 5

      - name: Determine which workflows need to be run
        id: need-check
        run: |
          env | grep NEED_CHECK_
          set -eux -o pipefail
          for check in $(env | grep -o 'NEED_CHECK_[a-z_]\+' ); do
            env_value=$(eval "echo \${$check}")
            echo "${check#NEED_CHECK_}=$env_value"
          done | tee -a $GITHUB_OUTPUT
        env:
          NEED_CHECK_rust: ${{ github.ref == 'refs/heads/master' || steps.changes.outputs.rust-jobs == 'true' }}
          NEED_CHECK_web: ${{ github.ref == 'refs/heads/master' || steps.changes.outputs.web-jobs == 'true' }}
          NEED_CHECK_python: ${{ github.ref == 'refs/heads/master' || steps.changes.outputs.python-jobs == 'true' }}
          # Basically we want to only check the python code style when we modify a file that ins't related to the parsec server (e.g.: bindings/generator/generate.py)
          # Thus don't require to run the python test.
          NEED_CHECK_python_style_only: ${{ steps.changes.outputs.python-jobs == 'false' && steps.changes.outputs.any-python-files == 'true' }}
          NEED_CHECK_rust_platform_crates: ${{ steps.changes.outputs.rust-platform-crates == 'true' }}

  # Github PR merging is configured to only require this job to pass
  ci-is-happy:
    name: ⭐ CI is happy ⭐
    needs:
      - dispatch
      - quality-assurance
      - python
      - rust
      - web
      - spelling
    runs-on: ubuntu-latest
    if: always()
    # Just a fail-safe timeout, see the fine grain per-task timeout instead
    timeout-minutes: 2
    steps:
      - name: Requirement fulfilled
        run: |
          #!python3
          import os
          import json

          NOT_A_JOB = ('python-style-only', 'rust-platform-crates')

          data = json.loads(os.environ["NEEDS"])

          print("NEEDS:", json.dumps(data, indent=4), sep="\n")

          # Check jobs aren't failed or cancelled.
          for name, job in data.items():
            if job["result"] in ("cancelled", "failure"):
              raise ValueError(f"The job `{name}` is in a invalid state: {job['result']}")

          # Check required jobs, here we just need to check that the state is `success` and not `skipped`.
          for job_name, required in data["dispatch"]["outputs"].items():
            if job_name in NOT_A_JOB:
              continue
            assert required in ("true", "false")
            job_result = data[job_name]["result"]
            if required == "true" and job_result != "success":
              raise ValueError(
                  f"The required job `{job_name}` should be in a success state but is not (state={job_result})"
              )
        env:
          NEEDS: ${{ toJSON(needs) }}
        shell: python

  spelling:
    uses: ./.github/workflows/cspell.yml

  ##############################################################################
  #                                   📊 Q&A                                   #
  ##############################################################################

  quality-assurance:
    name: 📊 Q&A
    # All linux jobs must run the same ubuntu version to avoid Rust caching issues !
    runs-on: ubuntu-20.04
    # Just a fail-safe timeout, see the fine grain per-task timeout instead
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin v4.1.1
        timeout-minutes: 5

      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50  # pin v2.11.1
        id: newsfragment-have-changed
        with:
          filters: |
            newsfragments:
              - newsfragments/**

      - name: Check tools version
        run: |
          echo "::add-matcher::.github/custom-problem-matchers/version-updater.json"
          python3 --version
          python3 misc/version_updater.py --check
          echo "::remove-matcher owner=version-updater::"
        timeout-minutes: 2

      - name: Check Commit Signature
        run: python .github/scripts/check_commit_signature.py

      - name: Check News fragments
        if: |
          startsWith(github.ref, 'refs/pull/')
          && !(
            startsWith(github.head_ref, 'yolo')
            || startsWith(github.head_ref, 'release')
            || startsWith(github.head_ref, 'revert')
            || startsWith(github.head_ref, 'acknowledge')
            )
          && steps.newsfragment-have-changed.outputs.newsfragments == 'true'
        run: |
          whereis git
          git fetch origin master
          python .github/scripts/check_newsfragments.py ${{ github.head_ref }}
        timeout-minutes: 5

      - name: Patch pre-commit for line-ending
        id: patched-pre-commit-config
        run: |
          TEMP_FILE=$(mktemp)
          sed '/id: mixed-line-ending/a\        args: [ --fix=lf ]' .pre-commit-config.yaml > $TEMP_FILE
          diff --unified .pre-commit-config.yaml $TEMP_FILE || true
          echo "path=$TEMP_FILE" >> $GITHUB_OUTPUT

      # Clippy basically compile the project, hence it's faster to run it in
      # the test-rust-matrix job where compilation cache is reused !
      - uses: ./.github/actions/use-pre-commit
        with:
          config-file: ${{ steps.patched-pre-commit-config.outputs.path }}
        env:
          SKIP: clippy,fmt,cspell,ruff,black,mypy,eslint
        timeout-minutes: 5

  python:
    needs:
      - dispatch
    if: needs.dispatch.outputs.python == 'true' || needs.dispatch.outputs.python-style-only == 'true'
    uses: ./.github/workflows/ci-python.yml
    with:
      style-only: ${{ needs.dispatch.outputs.python-style-only == 'true' }}

  rust:
    needs:
      - dispatch
    if: needs.dispatch.outputs.rust == 'true'
    uses: ./.github/workflows/ci-rust.yml
    with:
      run-wasm-tests: ${{ needs.dispatch.outputs.rust-platform-crates == 'true'}}

  web:
    needs:
      - dispatch
    if: needs.dispatch.outputs.web == 'true'
    uses: ./.github/workflows/ci-web.yml