lint.yml

name: Lint

on:
  workflow_call:
    inputs:
      container-path:
        description: "Path to built container at registry"
        required: true
        type: string
      runs-on:
        description: "Runner label to use"
        required: true
        type: string
    outputs:
      freshness:
        description: "current or superseded relative to develop's tip at the end of lint; empty if unknown"
        value: ${{ jobs.lint.outputs.freshness }}

jobs:
  lint:
    name: Run linters
    runs-on: ${{ inputs.runs-on }}
    outputs:
      freshness: ${{ steps.freshness.outputs.freshness }}
    container:
      image: ${{ inputs.container-path }} # zizmor: ignore[unpinned-images] built earlier in this run by build-container.yml
      options: --user root
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false
          fetch-depth: 50

      - name: Initial setup
        run: |
          git config --global --add safe.directory "$PWD"
          git fetch --no-tags -fu origin develop:develop
        shell: bash

      - name: Run linters
        run: |
          export BUILD_TARGET="linux64"
          export CHECK_DOC=1

          # Determine if this is a PR and set commit range accordingly
          if [ "${GITHUB_EVENT_NAME}" = "pull_request_target" ]; then
            export COMMIT_RANGE="$(git merge-base origin/develop HEAD)..HEAD"
            export PULL_REQUEST="true"
          elif [ "${GITHUB_EVENT_NAME}" = "push" ] && [ "${GITHUB_REF}" != "refs/heads/develop" ] && [ "${GITHUB_REF}" != "refs/heads/master" ]; then
            # For push events on feature branches, check against develop
            export COMMIT_RANGE="$(git merge-base origin/develop HEAD)..HEAD"
            export PULL_REQUEST="true"
          else
            # For pushes to develop/master or other events
            export COMMIT_RANGE="HEAD~..HEAD"
            export PULL_REQUEST="false"
          fi

          echo "Event name: ${GITHUB_EVENT_NAME}"
          echo "Ref: ${GITHUB_REF}"
          echo "COMMIT_RANGE=${COMMIT_RANGE}"
          echo "PULL_REQUEST=${PULL_REQUEST}"
          echo "Running git log for commit range:"
          git log --oneline ${COMMIT_RANGE} || echo "Could not show commit range"

          ./ci/dash/lint.sh
        shell: bash

      - name: Check whether develop has moved on
        id: freshness
        if: github.event_name == 'push' && github.ref_name == github.event.repository.default_branch
        run: |
          # Left unset when the lookup fails: tests still run, but only a
          # verified-current run may cancel another run's tests.
          tip="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)" || true
          if [[ "${tip}" == "${GITHUB_SHA}" ]]; then
            echo "freshness=current" >> "${GITHUB_OUTPUT}"
          elif [[ -n "${tip}" ]]; then
            echo "freshness=superseded" >> "${GITHUB_OUTPUT}"
            echo "Superseded by ${tip}: this run's tests will be skipped"
          fi
        shell: bash