module_ci.yml

# This is a generic workflow for Puppet module CI operations.
name: "Module CI"

on:
  workflow_call:
    inputs:
      runs_on:
        description: "The operating system used for the runner."
        required: false
        default: "ubuntu-latest"
        type: "string"
      flags:
        description: "Additional flags to pass to matrix_from_metadata_v3."
        required: false
        default: ''
        type: "string"
      run_shellcheck:
        description: "Run shellcheck on all bash files"
        required: false
        default: false
        type: "boolean"
      ruby_version:
        description: "Ruby version to use"
        required: false
        default: '3.2'
        type: "string"
      additional_packages:
        description: "Space-separated list of OS packages to install on the runner (apt-get)"
        required: false
        default: ''
        type: "string"

permissions:
  contents: read

jobs:
  setup_matrix:
    name: "Setup Test Matrix"
    runs-on: ${{ inputs.runs_on }}
    # Defense-in-depth: on `pull_request_target` (where this workflow runs
    # with secrets in scope), fork PRs require the `allowed-for-ci` label.
    # Non-`pull_request_target` invocations (plain `pull_request`,
    # `workflow_dispatch`, etc.) are unaffected and continue to run.
    if: >-
      github.event_name != 'pull_request_target' ||
      github.event.pull_request.head.repo.fork != true ||
      contains(github.event.pull_request.labels.*.name, 'allowed-for-ci')
    outputs:
      spec_matrix: ${{ steps.get-matrix.outputs.spec_matrix }}

    env:
      BUNDLE_WITHOUT: release_prep

    steps:

      - name: "Checkout"
        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"  # v6.0.3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: "Install additional packages"
        if: ${{ inputs.additional_packages != '' }}
        # Refresh the package index first: the runner image's baked-in apt lists can lag
        # behind the live archive, so installing straight away can 404 on a package whose
        # exact cached version has since been superseded and evicted from the mirror pool.
        run: |
          sudo apt-get update
          sudo apt-get install -y ${{ inputs.additional_packages }}

      - name: "Configure forge authentication"
        env:
          FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN || secrets.PUPPET_FORGE_TOKEN_PUBLIC }}
        run: |
          if [ -n "$FORGE_TOKEN" ]; then
            echo "PUPPET_FORGE_TOKEN=$FORGE_TOKEN" >> $GITHUB_ENV
            echo "BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM=forge-key:$FORGE_TOKEN" >> $GITHUB_ENV
          fi

      - name: "Setup ruby"
        uses: "ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f"  # v1.310.0
        with:
          ruby-version: ${{ inputs.ruby_version }}
          bundler-cache: true

      - name: "Bundle environment"
        run: |
          echo ::group::bundler environment
          bundle env
          echo ::endgroup::

      - name: Setup Spec Test Matrix
        id: get-matrix
        run: |
          bundle exec matrix_from_metadata_v3 ${{ inputs.flags }}

  spec:
    name: "Spec tests (Puppet: ${{matrix.puppet_version}}, Ruby Ver: ${{matrix.ruby_version}})"
    needs: "setup_matrix"
    runs-on: ${{ inputs.runs_on }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson( needs.setup_matrix.outputs.spec_matrix ) }}

    env:
      BUNDLE_WITHOUT: release_prep
      PUPPET_GEM_VERSION: ${{ matrix.puppet_version }}
      FACTER_GEM_VERSION: '~> 4.10'
      # Puppet 9 (8.99.x) prereleases live in an internal rubygems repo; the module Gemfile
      # reads PUPPET_GEM_SOURCE to fetch them. Inherited from the calling repo's secret; empty
      # for repos that don't set it, in which case the Gemfile falls back to puppetcore.
      PUPPET_GEM_SOURCE: ${{ secrets.PUPPET_GEM_SOURCE }}
      TWINGATE_PUBLIC_REPO_KEY: ${{ secrets.TWINGATE_PUBLIC_REPO_KEY }}
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    steps:
      - name: "Checkout"
        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"  # v6.0.3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: "Install additional packages"
        if: ${{ inputs.additional_packages != '' }}
        # Refresh the package index first: the runner image's baked-in apt lists can lag
        # behind the live archive, so installing straight away can 404 on a package whose
        # exact cached version has since been superseded and evicted from the mirror pool.
        run: |
          sudo apt-get update
          sudo apt-get install -y ${{ inputs.additional_packages }}

      - name: "Configure forge authentication"
        env:
          FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN || secrets.PUPPET_FORGE_TOKEN_PUBLIC }}
        run: |
          if [ -n "$FORGE_TOKEN" ]; then
            echo "PUPPET_FORGE_TOKEN=$FORGE_TOKEN" >> $GITHUB_ENV
            echo "BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM=forge-key:$FORGE_TOKEN" >> $GITHUB_ENV
          fi

      # The Puppet 9 lane resolves its gem from the internal Artifactory (PUPPET_GEM_SOURCE),
      # which is only reachable over Twingate. Gated to the puppet9 lane + key presence, so
      # Puppet 7/8 spec runs and repos without the key are completely unaffected.
      - name: "Install Twingate"
        if: matrix.puppet_version == '~> 9.0' && env.TWINGATE_PUBLIC_REPO_KEY != ''
        uses: "twingate/github-action@f1e69fc5af67b737d8597b759e5c607f567e77f2"  # v1
        with:
          service-key: ${{ env.TWINGATE_PUBLIC_REPO_KEY }}

      - name: "Fix DNS (Twingate)"
        if: matrix.puppet_version == '~> 9.0' && env.TWINGATE_PUBLIC_REPO_KEY != ''
        run: |
          sudo resolvectl dns eth0 ""
          sudo resolvectl dns sdwan0 100.95.0.251 100.95.0.252
          sudo resolvectl domain sdwan0 delivery.puppetlabs.net
          sudo resolvectl flush-caches
          resolvectl status
          nslookup artifactory.delivery.puppetlabs.net

      - name: "Setup ruby"
        uses: "ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f"  # v1.310.0
        with:
          ruby-version: ${{matrix.ruby_version}}
          bundler-cache: true

      - name: "Bundle environment"
        run: |
          echo ::group::bundler environment
          bundle env
          echo ::endgroup::

      - name: "shellcheck"
        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e  # v1
        if: |
          inputs.run_shellcheck &&
          inputs.runs_on == 'ubuntu-latest' &&
          matrix.ruby_version == '3.1'
        with:
          check_all_files_with_shebangs: "true"

      - name: "Run Static & Syntax Tests"
        run: |
          bundle exec rake syntax lint metadata_lint check:symlinks check:git_ignore check:dot_underscore check:test_file rubocop
          bundle exec dependency-checker metadata.json

      - name: "Run tests"
        env:
          # Generate coverage/.resultset.json for the Codecov upload below (same condition).
          SIMPLECOV: ${{ (inputs.runs_on == 'ubuntu-latest' && matrix.ruby_version == '3.2' && env.CODECOV_TOKEN != '') && 'yes' || 'no' }}
        run: |
          bundle exec rake parallel_spec

      - name: "Upload coverage reports to Codecov"
        if: |
          inputs.runs_on == 'ubuntu-latest' &&
          matrix.ruby_version == '3.2' &&
          env.CODECOV_TOKEN != ''
        uses: "codecov/codecov-action@v4"
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage/.resultset.json
          fail_ci_if_error: true
          verbose: true