ci.yml

## Main repository CI workflow.
## Fails if .github/workflows/** or .github/actions/** are changed - use ci-meta.yml instead.
## Excludes chore/ci branches because CI meta changes are handled by ci-meta.yml.
name: CI

on:
  # push:
  #   branches-ignore:
  #     - 'chore/ci/**'
  # pull_request:
  #   branches:
  #     - main
  #     - rel/**
  workflow_dispatch:

permissions:
  contents: write
  issues: write
  pull-requests: write

jobs:
  detect-scope:
    name: Detect Change Scope
    runs-on: ubuntu-latest
    outputs:
      has-common-scripts: ${{ steps.scope.outputs.has_common_scripts }}
      has-apps: ${{ steps.scope.outputs.has_apps }}
      has-supported-scope: ${{ steps.scope.outputs.has_supported_scope }}
    steps:
      - name: Checkout
        uses: ./.github/actions/checkout

      - name: Detect changed scope
        id: scope
        uses: ./.github/actions/detect-change-scope
        with:
          allowed-paths-regex: ^([^/]+$|apps/|common/|scripts/)
          disallowed-paths-regex: \.github/(actions|workflows)/
          invalid-scope-message: .github/workflows/** and .github/actions/** cannot change in this workflow. Use ci-meta.yml instead.
          fail-on-invalid: 'true'

  commit-lint:
    name: Commit Message Format
    needs: detect-scope
    if: needs.detect-scope.outputs.has-supported-scope == 'true' && (github.event_name == 'pull_request' || github.event_name == 'push')
    uses: ./.github/workflows/call-commit-lint.yml

  format-lint:
    name: Biome Checks
    needs: detect-scope
    if: needs.detect-scope.outputs.has-supported-scope == 'true'
    uses: ./.github/workflows/call-format-lint.yml

  schema-tests:
    name: Schema Validation Tests
    needs:
      - detect-scope
      - format-lint
    if: needs.detect-scope.outputs.has-supported-scope == 'true'
    uses: ./.github/workflows/call-tests-schema.yml

  unit-tests:
    name: Unit Tests
    needs: detect-scope
    if: needs.detect-scope.outputs.has-apps == 'true'
    uses: ./.github/workflows/call-tests-unit.yml

  integration-tests:
    name: Integration Tests
    needs:
      - detect-scope
      - unit-tests
    if: needs.detect-scope.outputs.has-apps == 'true' && github.event_name == 'pull_request'
    uses: ./.github/workflows/call-tests-integration.yml

  e2e-tests:
    name: E2E Tests
    needs:
      - detect-scope
      - integration-tests
    if: needs.detect-scope.outputs.has-apps == 'true' && github.event_name == 'pull_request'
    uses: ./.github/workflows/call-tests-e2e.yml
 
  security:
    name: Security Scan
    needs: detect-scope
    if: needs.detect-scope.outputs.has-supported-scope == 'true' && github.event_name == 'pull_request'
    uses: ./.github/workflows/call-security.yml

  release-please:
    name: Release Please
    runs-on: ubuntu-latest
    needs:
      - detect-scope
      - format-lint
      - schema-tests
      - unit-tests
      - integration-tests
      - e2e-tests
      - security
    if: needs.detect-scope.outputs.has-supported-scope == 'true' && github.event_name == 'push'
    env:
      RELEASE_PLEASE_APP_ID: ${{ vars['RELEASE_PLEASE_APP_ID'] }}
      RELEASE_PLEASE_APP_PRIVATE_KEY: ${{ secrets['RELEASE_PLEASE_APP_PRIVATE_KEY'] }}
    steps:
      - name: Validate GitHub App configuration
        run: |
          if [[ -z "$RELEASE_PLEASE_APP_ID" ]]; then
            echo "Missing Actions variable: RELEASE_PLEASE_APP_ID"
            exit 1
          fi
          if [[ -z "$RELEASE_PLEASE_APP_PRIVATE_KEY" ]]; then
            echo "Missing Actions secret: RELEASE_PLEASE_APP_PRIVATE_KEY"
            exit 1
          fi

      - name: Create GitHub App token
        id: app_token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ env.RELEASE_PLEASE_APP_ID }}
          private-key: ${{ env.RELEASE_PLEASE_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: |
            ${{ github.event.repository.name }}
          permission-contents: write
          permission-issues: write
          permission-pull-requests: write

      - name: Run release-please
        id: release
        uses: googleapis/release-please-action@v4
        with:
          token: ${{ steps.app_token.outputs.token }}
          target-branch: ${{ github.ref_name }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json