ci.yml

name: CI

on:
  push:
    branches: [ main ]
    tags-ignore:
      - '**'
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 1 * * *'

# Cancel in-progress jobs or runs for the current workflow
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

# Set environment variables available in all jobs and steps
env:
  go_version: "1.23.4"
  python_version: "3.9"

jobs:
 # Check that a news file has been added to this branch when a PR is created
  assert-news:
    name: Assert news files (See CONTRIBUTING.md)
    runs-on: ubuntu-latest
    steps:
      # Checkout with full history for to allow compare with base branch
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.python_version }}
      - name: Install CI/CD tools
        run: pip install continuous-delivery-scripts && pip list
      - name: Assert news
        run: bash ./scripts/setup_github.sh && cd-assert-news -b $GIT_BRANCH
        env:
          GIT_TOKEN: ${{ secrets.GIT_SECRET }}
          GIT_BRANCH: ${{ github.head_ref || github.ref }}
      - name: Report failure if needed
        if: ${{ failure() }}
        run: |
          echo "::error:: News file missing (See CONTRIBUTING.md guide for details)."

  detect-secrets:
    name: Check for secrets
    runs-on: ubuntu-latest
    steps:
    - uses: actions/setup-python@v5
    - name: Install tools
      run: pip install detect-secrets==1.0.3 && pip list
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    # FIXME: GitLeaks requires a licence now
    #- name: Check for secrets using gitleaks
    #  uses: gitleaks/gitleaks-action@v2
    #  with:
    #    config-path: .gitleaks.toml
    - name: Check for secrets using detect-secrets
      run: git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline --exclude-files '.*go\.sum$' --exclude-files '.*\.html$' --exclude-files '.*\.properties$' --exclude-files 'ci.yml'
      working-directory: .

  build-and-test:
    uses: ./.github/workflows/update-client.yml
    needs: [assert-news, detect-secrets]
    secrets: inherit
    with:
      branch: ${{ github.head_ref || github.ref }}