ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  dotnet:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json
      - run: dotnet restore HitTheKit.sln
      - run: dotnet test HitTheKit.sln --no-restore --configuration Release
      - run: ./scripts/check-nuget-vulnerabilities.sh

  repository-contracts:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Validate public-readiness contracts
        run: bash tests/scripts/public-readiness-contract-tests.sh
      - name: Validate MPL licensing contracts
        run: bash tests/scripts/licensing-contract-tests.sh
      - name: Validate website localization contracts
        run: bash tests/scripts/website-localization-contract-tests.sh
      - name: Validate public Wiki contracts
        run: bash tests/scripts/wiki-contract-tests.sh
      - name: Validate asset provenance hashes
        run: bash tests/scripts/asset-provenance-contract-tests.sh
      - name: Validate bundled song manifests
        run: find src/HitTheKit.Unity/Assets/StreamingAssets/Songs -name song.json -print0 | xargs -0 -n1 jq empty
      - name: Reject commercial catalog metadata
        run: |
          if grep -R -i -E 'AC/DC|Highway to Hell|Nirvana|Audioslave|Van Halen|Ozzy Osbourne|Thirty Seconds to Mars|Hot Milk' \
            src/HitTheKit.Unity/Assets/StreamingAssets/Songs; then
            echo 'Commercial artist/title metadata must not be bundled.' >&2
            exit 1
          fi
      - name: Check Unity metadata pairs
        run: |
          missing=0
          while IFS= read -r -d '' path; do
            if [ ! -f "$path.meta" ]; then
              echo "Missing Unity meta file: $path.meta" >&2
              missing=1
            fi
          done < <(find src/HitTheKit.Unity/Assets -type f ! -name '*.meta' -print0)
          exit "$missing"

  macos-packaging-contracts:
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - run: bash tests/scripts/macos-signing-foundation-tests.sh
      - run: bash tests/scripts/windows-packaging-contract-tests.sh

  native-coremidi:
    runs-on: macos-15
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Build and test the macOS arm64 CoreMIDI plug-in
        run: ./scripts/build-coremidi-plugin-macos-arm64.sh

  unity-tests:
    name: Unity ${{ matrix.test-mode }}
    if: >-
      vars.UNITY_CI_ENABLED == 'true' &&
      (github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
      checks: write
    strategy:
      fail-fast: false
      matrix:
        test-mode: [editmode, playmode]
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json
      - name: Synchronize tested Core assembly into Unity
        run: ./scripts/sync-core-to-unity.sh
      - name: Run Unity tests
        id: unity-tests
        uses: game-ci/unity-test-runner@v4
        env:
          UNITY_LICENSE: ${{ secrets.UNITY_LICENSE }}
          UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
          UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
        with:
          projectPath: src/HitTheKit.Unity
          unityVersion: 6000.5.6f1
          testMode: ${{ matrix.test-mode }}
          artifactsPath: artifacts/unity-${{ matrix.test-mode }}
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          checkName: Unity ${{ matrix.test-mode }} results
      - name: Upload Unity test evidence
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: unity-${{ matrix.test-mode }}-results
          path: ${{ steps.unity-tests.outputs.artifactsPath }}
          if-no-files-found: warn
          retention-days: 14