on.pr.yml

#
# Copyright (c) 2024 Elide Technologies, Inc.
#
# Licensed under the MIT license (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# https://opensource.org/license/mit/
#
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
# an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations under the License.
#

name: PR

# Labels to control this PR flow:
#
# - ci:api-check-bypass - Bypass API check failures.
# - ci:buf-breaking-ignore - Ignore breaking changes in the model.
# - ci:fmt-ignore - Ignore formatting failures.
# - ci:test-native - Run native tests.
# - ci:build-native - Run native builds.

"on":
  pull_request:
    types: [opened, reopened, synchronize]

permissions:
  contents: read

concurrency:
  group: "pr-${{ github.event.pull_request.number }}"
  cancel-in-progress: true

jobs:
  ##
  ## Job: Change Triage
  ##
  triage:
    name: "Triage"
    runs-on: ${{ vars.RUNNER_DEFAULT || 'ubuntu-latest' }}
    permissions:
      contents: "read"
    outputs:
      changes: ${{ steps.extract_branch.outputs.changes }}
      branch: ${{ steps.extract_branch.outputs.branch }}
      base: ${{ steps.filter.outputs.base }}
      natives: ${{ steps.filter.outputs.natives }}
      devcontainer: ${{ steps.filter.outputs.base }}
      model: ${{ steps.filter.outputs.model }}
      packages: ${{ steps.filter.outputs.packages }}
      tools: ${{ steps.filter.outputs.tools }}
      images: ${{ steps.filter.outputs.tools }}
      srcs: ${{ steps.filter.outputs.srcs }}
    steps:
      - name: "Setup: Harden Runner"
        uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
      - name: "Setup: Checkout"
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: "Triage: Branch Label"
        id: extract_branch
        shell: bash
        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
      - name: "Triage: PR Labels"
        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: "Triage: PR Changes"
        id: filter
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        with:
          filters: |
            base: &base
              - ".version"
              - ".release"
              - ".github/workflows/*.*"
            devcontainer: &ci
              - *base
              - ".devcontainer/*.*"
              - ".devcontainer/**/*.*"
            model: &model
              - *base
              - "proto/**/*.*"
            packages: &packages
              - *base
              - *model
              - "packages"
              - "packages/*"
              - "packages/**/*.*"
            tools: &tools
              - *base
              - "tools"
              - "tools/*"
              - "tools/**/*.*"
            images: &images
              - *base
              - "tools/images/*"
              - "tools/images/*.*"
              - "tools/images/**/*.*"
            srcs: &srcs
              - *base
              - *model
              - *packages
              - *tools
            natives: &natives
              - *base
              - "crates"
              - "crates/*"
              - "crates/**/*.*"
              - "third_party/Makefile"
              - "third_party/*/**/*.*"

  ##
  ## Job: Multi-platform Build
  ##
  pr-build:
    name: "Build"
    uses: ./.github/workflows/job.build.yml
    secrets: inherit
    needs: [triage]
    if: fromJson(needs.triage.outputs.model) || fromJson(needs.triage.outputs.packages) || fromJson(needs.triage.outputs.tools)
    permissions:
      contents: "write"
      actions: "read"
      id-token: "write"
      checks: "write"
      pull-requests: "write"
      packages: "read"
      security-events: "write"
    with:
      provenance: false
      native: ${{ contains(github.event.pull_request.labels.*.name, 'ci:build-native') || contains(github.event.head_commit.message, 'ci:build-native') }}

  ##
  ## Job: Multi-platform Build
  ##
  pr-test:
    name: "Build"
    uses: ./.github/workflows/job.test.yml
    secrets: inherit
    needs: [triage]
    if: fromJson(needs.triage.outputs.model) || fromJson(needs.triage.outputs.packages) || fromJson(needs.triage.outputs.tools)
    permissions:
      contents: "read"
      id-token: "write"
      checks: "write"
      packages: "read"
      pull-requests: "write"
    with:
      native: ${{ contains(github.event.pull_request.labels.*.name, 'ci:test-native') || contains(github.event.head_commit.message, 'ci:test-native') }}

  ##
  ## Job: API Check
  ##
  check-api:
    name: "Checks"
    uses: ./.github/workflows/checks.apicheck.yml
    needs: [triage]
    if: fromJson(needs.triage.outputs.srcs) && github.event.pull_request.draft == false
    secrets:
      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
    permissions:
      contents: "read"

  ##
  ## Job: Checks for Models
  ##
  check-model:
    name: "Checks"
    uses: ./.github/workflows/checks.model.yml
    needs: [triage]
    if: fromJson(needs.triage.outputs.model)
    secrets:
      BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
    permissions:
      contents: "read"
    with:
      ignore_breaking: ${{ contains(github.event.pull_request.labels.*.name, 'ci:buf-breaking-ignore') }}

  ##
  ## Job: Checks for Formatting/Style
  ##
  check-format:
    name: "Checks"
    uses: ./.github/workflows/checks.formatting.yml
    needs: [triage]
    if: fromJson(needs.triage.outputs.model) || fromJson(needs.triage.outputs.natives) || fromJson(needs.triage.outputs.srcs)
    secrets: inherit
    permissions:
      contents: "read"
    with:
      ignore_failures: ${{ contains(github.event.pull_request.labels.*.name, 'ci:fmt-ignore') }}

  ##
  ## Job: Clippy Check
  ##
  check-clippy:
    name: "Checks"
    uses: ./.github/workflows/checks.clippy.yml
    needs: [triage]
    if: fromJson(needs.triage.outputs.natives)
    permissions:
      contents: "read"

  ##
  ## Job: Check for Wrapper
  ##
  check-wrapper:
    name: "Checks"
    if: github.event.pull_request.draft == false
    uses: ./.github/workflows/checks.gradle-wrapper.yml
    needs: [triage]
    permissions:
      contents: "read"

  ##
  ## Job: Checks for Vulnerabilities/Licensing
  ##
  check-dependencies:
    name: "Checks"
    if: github.event.pull_request.draft == false
    uses: ./.github/workflows/checks.dependency-review.yml
    needs: [triage, pr-build]
    permissions:
      contents: "read"

  ##
  ## Job: Checks with CodeQL
  ##
  check-codeql:
    name: "Checks"
    if: github.event.pull_request.draft == false && fromJson(needs.triage.outputs.packages)
    uses: ./.github/workflows/checks.codeql.yml
    needs: [triage, pr-build]
    secrets:
      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
    permissions:
      actions: "read"
      contents: "read"
      security-events: "write"

  ##
  ## Job: Checks with Detekt
  ##
  check-detekt:
    name: "Checks"
    uses: ./.github/workflows/checks.detekt.yml
    needs: [triage, pr-build]
    secrets:
      GRADLE_CONFIGURATION_KEY: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
    permissions:
      contents: "read"
      security-events: "write"