ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  detect-changes:
    if: ${{ !cancelled() }}
    name: Detect Changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      core: ${{ steps.manual.outputs.core || steps.filter.outputs.core }}
      infra: ${{ steps.manual.outputs.infra || steps.filter.outputs.infra }}
      docs: ${{ steps.manual.outputs.docs || steps.filter.outputs.docs }}
      run_ci: ${{ steps.manual.outputs.run_ci || (steps.filter.outputs.core == 'true' || steps.filter.outputs.infra == 'true' || steps.filter.outputs.docs == 'true') }}
      run_pages: ${{ steps.manual.outputs.run_pages || steps.filter.outputs.docs }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Force CI for manual dispatch
        id: manual
        if: ${{ github.event_name == 'workflow_dispatch' }}
        run: |
          {
            echo "core=true"
            echo "infra=true"
            echo "docs=true"
            echo "run_ci=true"
            echo "run_pages=true"
          } >> "${GITHUB_OUTPUT}"
      - name: Classify changed files
        id: filter
        if: ${{ github.event_name != 'workflow_dispatch' }}
        uses: dorny/paths-filter@v4.0.1
        with:
          base: ${{ github.ref }}
          filters: .github/filters/changes.yml

      - name: Summarize detected changes
        run: |
          cat <<'EOF' >> "${GITHUB_STEP_SUMMARY}"
          ## Change Detection
          - Event: `${{ github.event_name }}`
          - Core: `${{ steps.manual.outputs.core || steps.filter.outputs.core || 'false' }}`
          - Infra: `${{ steps.manual.outputs.infra || steps.filter.outputs.infra || 'false' }}`
          - Docs: `${{ steps.manual.outputs.docs || steps.filter.outputs.docs || 'false' }}`
          - Run CI: `${{ steps.manual.outputs.run_ci || (steps.filter.outputs.core == 'true' || steps.filter.outputs.infra == 'true' || steps.filter.outputs.docs == 'true') }}`
          - Run Pages: `${{ steps.manual.outputs.run_pages || steps.filter.outputs.docs || 'false' }}`
          EOF

  lint:
    if: ${{ !cancelled() && needs.detect-changes.outputs.run_ci == 'true' }}
    name: Lint
    runs-on: ubuntu-latest
    needs:
      - detect-changes
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Install just
        uses: taiki-e/install-action@v2
        with:
          tool: just
      - name: Run lint
        run: just lint

  build:
    if: ${{ !cancelled() && needs.detect-changes.outputs.run_ci == 'true' }}
    name: Build
    runs-on: ubuntu-latest
    needs:
      - detect-changes
      - lint
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Install just
        uses: taiki-e/install-action@v2
        with:
          tool: just
      - name: Run build
        run: just build

  tests:
    if: ${{ !cancelled() && needs.detect-changes.outputs.run_ci == 'true' }}
    name: Tests
    runs-on: ubuntu-latest
    needs:
      - detect-changes
      - build
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Install just
        uses: taiki-e/install-action@v2
        with:
          tool: just
      - name: Run tests
        run: just test
      - name: Emit detect-changes fragment through the action
        id: smoke-detect-changes
        uses: ./
        with:
          mode: emit-fragment
          emit-job: detect-changes
          emit-result: success
          emit-outputs: |
            run_ci=true
            run_pages=false
          emit-file: /github/runner_temp/github-actionspec-e2e/fragments/detect-changes.json
      - name: Emit lint fragment through the action
        id: smoke-lint
        uses: ./
        with:
          mode: emit-fragment
          emit-job: lint
          emit-result: success
          emit-file: /github/runner_temp/github-actionspec-e2e/fragments/lint.json
      - name: Emit build fragment through the action
        id: smoke-build
        uses: ./
        with:
          mode: emit-fragment
          emit-job: build
          emit-result: success
          emit-file: /github/runner_temp/github-actionspec-e2e/fragments/build.json
      - name: Emit tests fragment through the action
        id: smoke-tests
        uses: ./
        with:
          mode: emit-fragment
          emit-job: tests
          emit-result: success
          emit-file: /github/runner_temp/github-actionspec-e2e/fragments/tests.json
      - name: Emit docker fragment through the action
        id: smoke-docker
        uses: ./
        with:
          mode: emit-fragment
          emit-job: docker
          emit-result: success
          emit-file: /github/runner_temp/github-actionspec-e2e/fragments/docker.json
      - name: Emit pages fragment through the action
        id: smoke-pages
        uses: ./
        with:
          mode: emit-fragment
          emit-job: pages
          emit-result: skipped
          emit-file: /github/runner_temp/github-actionspec-e2e/fragments/pages.json
      - name: Capture emitted smoke fragments through the action
        id: smoke-capture
        uses: ./
        with:
          mode: capture
          workflow: ci.yml
          ref-name: main
          capture-job-files: |
            ${{ steps.smoke-detect-changes.outputs.fragment-path }}
            ${{ steps.smoke-lint.outputs.fragment-path }}
            ${{ steps.smoke-build.outputs.fragment-path }}
            ${{ steps.smoke-tests.outputs.fragment-path }}
            ${{ steps.smoke-docker.outputs.fragment-path }}
            ${{ steps.smoke-pages.outputs.fragment-path }}
          capture-file: /github/runner_temp/github-actionspec-e2e/current/workflow-run.json
      - name: Validate captured smoke payload through the action
        uses: ./
        with:
          workflow: ci.yml
          actual: ${{ steps.smoke-capture.outputs.capture-path }}
          report-file: /github/runner_temp/github-actionspec-e2e/current/validation-report.json
          dashboard-file: /github/runner_temp/github-actionspec-e2e/current/dashboard.md
          write-summary: false
      - name: Validate passing fixture directory
        uses: ./
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/passing
          report-file: /github/runner_temp/github-actionspec-smoke/passing-dir-report.json
          dashboard-file: /github/runner_temp/github-actionspec-smoke/passing-dir-dashboard.md
          write-summary: false
      - name: Validate passing fixture list
        uses: ./
        with:
          repo: .
          workflow: ci.yml
          actual: |
            tests/fixtures/ci/ci-main-success.json
            tests/fixtures/ci/ci-main-pages.json
            tests/fixtures/ci/ci-main-noop.json
          report-file: /github/runner_temp/github-actionspec-smoke/passing-list-report.json
          dashboard-file: /github/runner_temp/github-actionspec-smoke/passing-list-dashboard.md
          write-summary: false
      - name: Reject non-main workflow run
        id: wrong-ref
        continue-on-error: true
        uses: ./
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/ci-non-main-ref.json
          report-file: /github/runner_temp/github-actionspec-smoke/wrong-ref-report.json
          dashboard-file: /github/runner_temp/github-actionspec-smoke/wrong-ref-dashboard.md
          write-summary: false
      - name: Reject skipped build on main
        id: skipped-build
        continue-on-error: true
        uses: ./
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/ci-build-skipped.json
          report-file: /github/runner_temp/github-actionspec-smoke/skipped-build-report.json
          dashboard-file: /github/runner_temp/github-actionspec-smoke/skipped-build-dashboard.md
          write-summary: false
      - name: Reject pages run that stays skipped
        id: skipped-pages
        continue-on-error: true
        uses: ./
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/ci-pages-enabled-but-skipped.json
          report-file: /github/runner_temp/github-actionspec-smoke/skipped-pages-report.json
          dashboard-file: /github/runner_temp/github-actionspec-smoke/skipped-pages-dashboard.md
          write-summary: false
      - name: Reject downstream jobs when run_ci is false
        id: run-ci-disabled
        continue-on-error: true
        uses: ./
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/ci-run-ci-disabled-build-ran.json
          report-file: /github/runner_temp/github-actionspec-smoke/run-ci-disabled-report.json
          dashboard-file: /github/runner_temp/github-actionspec-smoke/run-ci-disabled-dashboard.md
          write-summary: false
      - name: Validate expected smoke outcomes
        if: ${{ always() }}
        run: |
          set -euo pipefail

          if [[ "${{ steps.wrong-ref.outcome }}" != "failure" ]]; then
            echo "::error::The non-main fixture should fail validation."
            exit 1
          fi

          if [[ "${{ steps.skipped-build.outcome }}" != "failure" ]]; then
            echo "::error::The skipped build fixture should fail validation."
            exit 1
          fi

          if [[ "${{ steps.skipped-pages.outcome }}" != "failure" ]]; then
            echo "::error::The skipped pages fixture should fail validation."
            exit 1
          fi

          if [[ "${{ steps.run-ci-disabled.outcome }}" != "failure" ]]; then
            echo "::error::The run_ci=false fixture should fail when downstream jobs run."
            exit 1
          fi
      - name: Prepare matrix dashboard workspace
        run: mkdir -p "${{ runner.temp }}/github-actionspec-dashboard/current" "${{ runner.temp }}/github-actionspec-dashboard/baseline"
      - name: Generate current validation report
        id: current-matrix
        continue-on-error: true
        run: just validate-repo-report . ci.yml tests/fixtures/ci "${{ runner.temp }}/github-actionspec-dashboard/current/validation-report.json"
      - name: Find baseline matrix artifact
        id: baseline-matrix
        uses: actions/github-script@v9
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const workflowId = "ci.yml";
            const artifactName = "ci-matrix-dashboard";

            async function findArtifactUrl(branch, eventName) {
              const runs = await github.paginate(github.rest.actions.listWorkflowRuns, {
                owner,
                repo,
                workflow_id: workflowId,
                branch,
                event: eventName,
                per_page: 50,
              });

              for (const run of runs) {
                if (run.id === context.runId || run.status !== "completed") {
                  continue;
                }

                const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
                  owner,
                  repo,
                  run_id: run.id,
                  per_page: 100,
                });

                const artifact = artifacts.data.artifacts.find(
                  (entry) => entry.name === artifactName && !entry.expired,
                );

                if (artifact) {
                  core.setOutput("baseline_run_id", String(run.id));
                  core.setOutput("baseline_source", `${eventName}:${branch}`);
                  return artifact.archive_download_url;
                }
              }

              return "";
            }

            let url = "";
            if (context.eventName === "pull_request" && context.payload.pull_request?.head?.ref) {
              url = await findArtifactUrl(context.payload.pull_request.head.ref, "pull_request");
            }

            if (!url) {
              url = await findArtifactUrl("main", "push");
            }

            core.setOutput("download_url", url);
      - name: Download baseline matrix artifact
        if: ${{ steps.baseline-matrix.outputs.download_url != '' }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
          BASELINE_URL: ${{ steps.baseline-matrix.outputs.download_url }}
        run: |
          curl -fsSL \
            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            -L "${BASELINE_URL}" \
            -o "${{ runner.temp }}/github-actionspec-dashboard/baseline/baseline.zip"
          unzip -q "${{ runner.temp }}/github-actionspec-dashboard/baseline/baseline.zip" -d "${{ runner.temp }}/github-actionspec-dashboard/baseline"
      - name: Generate matrix dashboard through the action
        id: matrix-dashboard
        continue-on-error: true
        uses: ./
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci
          report-file: /github/runner_temp/github-actionspec-dashboard/current/validation-report.json
          baseline-report: /github/runner_temp/github-actionspec-dashboard/baseline/validation-report.json
          dashboard-file: /github/runner_temp/github-actionspec-dashboard/current/dashboard.md
          comment-pr: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
          github-token: ${{ github.token }}
      - name: Upload matrix dashboard artifact
        if: ${{ always() }}
        uses: actions/upload-artifact@v7
        with:
          name: ci-matrix-dashboard
          path: |
            ${{ runner.temp }}/github-actionspec-dashboard/current/validation-report.json
            ${{ runner.temp }}/github-actionspec-dashboard/current/dashboard.md
      - name: Generate coverage
        run: just coverage-ci
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          use_oidc: true
          fail_ci_if_error: true
          files: ./target/llvm-cov/lcov.info

  remote-action-integration:
    if: ${{ !cancelled() && needs.detect-changes.outputs.run_ci == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    name: Remote Action Integration
    runs-on: ubuntu-latest
    needs:
      - detect-changes
      - tests
    steps:
      - name: Checkout repository fixtures
        uses: actions/checkout@v6
      - name: Validate passing fixture directory
        uses: v4lproik/github-actionspec-rs@main
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/passing
      - name: Validate passing fixture list
        uses: v4lproik/github-actionspec-rs@main
        with:
          repo: .
          workflow: ci.yml
          actual: |
            tests/fixtures/ci/ci-main-success.json
            tests/fixtures/ci/ci-main-pages.json
            tests/fixtures/ci/ci-main-noop.json
      - name: Reject non-main workflow run
        id: wrong-ref
        continue-on-error: true
        uses: v4lproik/github-actionspec-rs@main
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/ci-non-main-ref.json
      - name: Reject skipped build on main
        id: skipped-build
        continue-on-error: true
        uses: v4lproik/github-actionspec-rs@main
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/ci-build-skipped.json
      - name: Reject pages run that stays skipped
        id: skipped-pages
        continue-on-error: true
        uses: v4lproik/github-actionspec-rs@main
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/ci-pages-enabled-but-skipped.json
      - name: Reject downstream jobs when run_ci is false
        id: run-ci-disabled
        continue-on-error: true
        uses: v4lproik/github-actionspec-rs@main
        with:
          repo: .
          workflow: ci.yml
          actual: tests/fixtures/ci/ci-run-ci-disabled-build-ran.json
      - name: Validate expected plugin outcomes
        if: ${{ always() }}
        run: |
          set -euo pipefail

          if [[ "${{ steps.wrong-ref.outcome }}" != "failure" ]]; then
            echo "::error::The non-main fixture should fail validation."
            exit 1
          fi

          if [[ "${{ steps.skipped-build.outcome }}" != "failure" ]]; then
            echo "::error::The skipped build fixture should fail validation."
            exit 1
          fi

          if [[ "${{ steps.skipped-pages.outcome }}" != "failure" ]]; then
            echo "::error::The skipped pages fixture should fail validation."
            exit 1
          fi

          if [[ "${{ steps.run-ci-disabled.outcome }}" != "failure" ]]; then
            echo "::error::The run_ci=false fixture should fail when downstream jobs run."
            exit 1
          fi
      - name: Summarize remote action integration
        if: ${{ always() }}
        run: |
          cat <<'EOF' >> "${GITHUB_STEP_SUMMARY}"
          ## Remote Action Integration
          - Action reference: `v4lproik/github-actionspec-rs@main`
          - Passing directory: `tests/fixtures/ci/passing`
          - Passing file list:
            - `ci-main-success.json`
            - `ci-main-pages.json`
            - `ci-main-noop.json`
          - Expected failing fixtures:
            - `ci-non-main-ref.json`
            - `ci-build-skipped.json`
            - `ci-pages-enabled-but-skipped.json`
            - `ci-run-ci-disabled-build-ran.json`
          EOF

  docker:
    if: ${{ !cancelled() && needs.detect-changes.outputs.run_ci == 'true' && needs.tests.result == 'success' && (needs.remote-action-integration.result == 'success' || needs.remote-action-integration.result == 'skipped') }}
    name: Docker
    runs-on: ubuntu-latest
    needs:
      - detect-changes
      - tests
      - remote-action-integration
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Install just
        uses: taiki-e/install-action@v2
        with:
          tool: just
      - name: Validate runtime image
        run: just runtime-ci
      - name: Check publish credentials
        id: publish-check
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          if [[ -n "${DOCKERHUB_USERNAME}" && -n "${DOCKERHUB_TOKEN}" ]]; then
            echo "enabled=true" >> "${GITHUB_OUTPUT}"
          else
            echo "enabled=false" >> "${GITHUB_OUTPUT}"
          fi
      - name: Log in to Docker Hub
        if: ${{ steps.publish-check.outputs.enabled == 'true' }}
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Publish runtime image
        if: ${{ steps.publish-check.outputs.enabled == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
        run: just docker-push-runtime docker.io/valproik/github-actionspec-rs:latest
      - name: Skip publish when credentials are missing
        if: ${{ steps.publish-check.outputs.enabled != 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
        run: echo "Docker Hub credentials are not configured; skipping runtime image publish."

  pages:
    if: ${{ !cancelled() && needs.detect-changes.outputs.run_pages == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    name: Pages
    runs-on: ubuntu-latest
    needs:
      - detect-changes
      - docker
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Check Pages enablement
        id: pages-check
        uses: actions/github-script@v9
        with:
          script: |
            try {
              await github.rest.repos.getPages({
                owner: context.repo.owner,
                repo: context.repo.repo,
              });
              core.setOutput("enabled", "true");
            } catch (error) {
              if (error.status === 404) {
                core.setOutput("enabled", "false");
                return;
              }
              throw error;
            }
      - name: Configure Pages
        if: ${{ steps.pages-check.outputs.enabled == 'true' }}
        uses: actions/configure-pages@v6
      - name: Upload site artifact
        if: ${{ steps.pages-check.outputs.enabled == 'true' }}
        uses: actions/upload-pages-artifact@v5
        with:
          path: docs
      - name: Deploy to GitHub Pages
        if: ${{ steps.pages-check.outputs.enabled == 'true' }}
        id: deployment
        uses: actions/deploy-pages@v5
      - name: Skip when Pages is not enabled
        if: ${{ steps.pages-check.outputs.enabled != 'true' }}
        run: |
          cat <<'EOF' >> "${GITHUB_STEP_SUMMARY}"
          ## Pages Skipped
          GitHub Pages is not enabled for this repository yet.

          Enable Pages and select GitHub Actions as the source to publish the site.
          EOF

  runtime-contract-validation:
    if: ${{ always() && !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    name: Runtime Contract Validation
    runs-on: ubuntu-latest
    needs:
      - detect-changes
      - lint
      - build
      - tests
      - remote-action-integration
      - docker
      - pages
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Emit detect-changes runtime fragment
        id: runtime-detect-changes
        uses: ./
        with:
          mode: emit-fragment
          emit-job: detect-changes
          emit-result: ${{ needs.detect-changes.result }}
          emit-outputs: |
            run_ci=${{ needs.detect-changes.outputs.run_ci }}
            run_pages=${{ needs.detect-changes.outputs.run_pages }}
          emit-file: /github/runner_temp/github-actionspec-runtime/fragments/detect-changes.json
      - name: Emit lint runtime fragment
        id: runtime-lint
        uses: ./
        with:
          mode: emit-fragment
          emit-job: lint
          emit-result: ${{ needs.lint.result }}
          emit-file: /github/runner_temp/github-actionspec-runtime/fragments/lint.json
      - name: Emit build runtime fragment
        id: runtime-build
        uses: ./
        with:
          mode: emit-fragment
          emit-job: build
          emit-result: ${{ needs.build.result }}
          emit-file: /github/runner_temp/github-actionspec-runtime/fragments/build.json
      - name: Emit tests runtime fragment
        id: runtime-tests
        uses: ./
        with:
          mode: emit-fragment
          emit-job: tests
          emit-result: ${{ needs.tests.result }}
          emit-file: /github/runner_temp/github-actionspec-runtime/fragments/tests.json
      - name: Emit docker runtime fragment
        id: runtime-docker
        uses: ./
        with:
          mode: emit-fragment
          emit-job: docker
          emit-result: ${{ needs.docker.result }}
          emit-file: /github/runner_temp/github-actionspec-runtime/fragments/docker.json
      - name: Emit pages runtime fragment
        id: runtime-pages
        uses: ./
        with:
          mode: emit-fragment
          emit-job: pages
          emit-result: ${{ needs.pages.result }}
          emit-file: /github/runner_temp/github-actionspec-runtime/fragments/pages.json
      - name: Capture runtime workflow payload
        id: runtime-capture
        uses: ./
        with:
          mode: capture
          workflow: ci.yml
          ref-name: ${{ github.ref_name }}
          capture-job-files: |
            ${{ steps.runtime-detect-changes.outputs.fragment-path }}
            ${{ steps.runtime-lint.outputs.fragment-path }}
            ${{ steps.runtime-build.outputs.fragment-path }}
            ${{ steps.runtime-tests.outputs.fragment-path }}
            ${{ steps.runtime-docker.outputs.fragment-path }}
            ${{ steps.runtime-pages.outputs.fragment-path }}
          capture-file: /github/runner_temp/github-actionspec-runtime/current/workflow-run.json
      - name: Validate runtime workflow payload
        id: runtime-validate
        uses: ./
        with:
          repo: .
          workflow: ci.yml
          actual: ${{ steps.runtime-capture.outputs.capture-path }}
          report-file: /github/runner_temp/github-actionspec-runtime/current/validation-report.json
          dashboard-file: /github/runner_temp/github-actionspec-runtime/current/dashboard.md
      - name: Upload runtime contract artifact
        if: ${{ always() }}
        uses: actions/upload-artifact@v7
        with:
          name: ci-runtime-contract
          path: |
            ${{ steps.runtime-capture.outputs.capture-path }}
            ${{ steps.runtime-validate.outputs.report-path }}
            ${{ steps.runtime-validate.outputs.dashboard-path }}