ci.yml

name: CI

on:
  push:
    branches:
      - master
      - 'feature/**'
      - 'v**'
  pull_request:
    branches:
      - master
      - 'feature/**'
      - 'v**'

env:
  GO_VERSION: '1.20'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Install dependencies
        run: sudo apt-get update && sudo apt-get install wabt

      - name: Clone
        uses: actions/checkout@v3
        with:
          # fetch all tags. required to update the embedded version
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v3
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Install Flow CLI
        run: sh -ci "$(curl -fsSL https://raw.githubusercontent.com/onflow/flow-cli/master/install.sh)" -- v1.5.0

      - name: Build
        run: make -j8 build

      - name: Test
        run: make ci

      - name: Cadence Testing Framework
        run: cd runtime/stdlib/contracts && flow test --cover --covercode="contracts" crypto_test.cdc

      - name: Upload coverage report
        uses: codecov/codecov-action@v2
        with:
          file: ./coverage.txt
          flags: unittests

      - name: Check tidy
        run: make check-tidy

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Clone
        uses: actions/checkout@v3

      - name: Setup Go
        uses: actions/setup-go@v3
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Lint
        run: make lint-github-actions

      - name: Check license headers
        run: make check-headers

  lint-json:
    name: Lint JSON
    runs-on: ubuntu-latest
    steps:
      - name: Clone
        uses: actions/checkout@v3

      - name: json-syntax-check
        uses: limitusus/json-syntax-check@v1
        with:
          pattern: "\\.json$"

  semgrep:
    name: Semgrep
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    # Skip any PR created by dependabot to avoid permission issues:
    if: (github.actor != 'dependabot[bot]')
    steps:
      - name: Clone
        uses: actions/checkout@v3

      - name: semgrep ci
        run: semgrep ci --config semgrep.yaml