ci.yaml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

name: CI

on:
  push:
    branches:
      - main
      - renovate/**
    tags:
      - "v*.*.*"
  pull_request:
  workflow_dispatch:
    inputs:
      dir_chart_version:
        required: false
        type: string
        description: "Override the version of the dir Helm chart to install for the tests."
      dirctl_image_tag:
        required: false
        type: string
        description: "Override the tag of the dir-ctl Docker image to use in the tests."

# Declare default permissions as read-only; jobs that need more request it explicitly.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.result.outputs.code }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Check for code changes
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
          filters: |
            code:
              - '!CHANGELOG.md'
              - '!CODE_OF_CONDUCT.md'
              - '!CONTRIBUTING.md'
              - '!LICENSE'
              - '!MAINTAINERS.md'
              - '!README.md'
              - '!RELEASE.md'
              - '!SECURITY.md'
              - '!.gitignore'

      - name: Determine result
        id: result
        run: |
          # Always run for tag pushes (releases), otherwise use paths-filter result
          if [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then
            echo "code=true" >> $GITHUB_OUTPUT
          else
            echo "code=${{ steps.filter.outputs.code }}" >> $GITHUB_OUTPUT
          fi

  lint:
    name: Lint
    needs:
      - changes
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node env
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24.x"
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Check formatting
        run: npm run format:check

      - name: Lint
        run: npm run lint:check

  test:
    name: Test
    needs:
      - changes
    permissions:
      id-token: write
      contents: read
      packages: read
    uses: ./.github/workflows/reusable-test-sdk.yaml
    with:
      dir_chart_version: ${{ inputs.dir_chart_version }}
      dirctl_image_tag: ${{ inputs.dirctl_image_tag }}

  release:
    name: Release
    if: ${{ startsWith(github.ref, 'refs/tags/') }}
    needs:
      - lint
      - test
    permissions:
      contents: read
      id-token: write # Required for npm OIDC trusted publishing
    uses: ./.github/workflows/reusable-release-sdk.yaml

  success:
    name: Success
    if: ${{ !cancelled() && !contains(needs.*.result, 'cancelled') && !contains(needs.*.result, 'failure') }}
    needs:
      - changes
      - lint
      - test
      - release
    runs-on: ubuntu-latest
    steps:
      - name: Echo Success
        run: |
          if [[ "${{ needs.changes.outputs.code }}" == "true" ]]; then
            echo "::notice Success! All code checks passed."
          else
            echo "::notice Success! No code changes detected, skipped builds and tests."
          fi