build.yml

name: build

on:
  pull_request:
  push:
    branches-ignore:
      - gh-readonly-queue/**

  workflow_dispatch:
    inputs:
      dryRun:
        description: 'Dry-Run'
        default: 'true'
        required: false
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'maint/') && github.event_name != 'push' }}

env:
  HUSKY: 0
  DRY_RUN: ${{ github.ref_name != github.event.repository.default_branch && !startsWith(github.ref_name, 'maint/') }}

permissions:
  contents: read

jobs:
  setup:
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: ⚙️ Setup
        uses: containerbase/internal-tools/setup@4577a4226e81662520a9457dd271851c7ed6f8f8 # v4.6.81
        with:
          save-cache: true

  lint:
    runs-on: ubuntu-24.04
    needs: setup
    timeout-minutes: 15
    permissions:
      contents: read
      checks: write

    steps:
      - name: ⚙️ Setup
        uses: containerbase/internal-tools/setup@4577a4226e81662520a9457dd271851c7ed6f8f8 # v4.6.81

      - name: lint
        run: |
          # pnpm eslint -f gha
          pnpm prettier
          # pnpm lint:types

      - name: shellcheck
        if: ${{ github.event_name != 'merge_group' }}
        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1.32.0
        with:
          fail_level: any
          reporter: github-pr-annotations
          filter_mode: nofilter
          path: |
            .husky
          pattern: |
            *.sh
            *.bats
          check_all_files_with_shebangs: 'true'

  build:
    runs-on: ubuntu-24.04
    needs: setup
    timeout-minutes: 15

    env:
      NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages

    steps:
      - name: ⚙️ Setup
        uses: containerbase/internal-tools/setup@4577a4226e81662520a9457dd271851c7ed6f8f8 # v4.6.81

      - name: 📥 Setup Java
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: 'temurin'
          java-version: '17'
          cache: 'gradle'

      # https://github.com/dotnet/sdk/issues/39635
      - name: Remove pre-existing dotnet installs
        run: sudo apt remove --purge '^dotnet-.*' '^aspnetcore-.*'
      - name: 📥 Setup Dotnet
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
        with:
          global-json-file: global.json
          cache: true
          cache-dependency-path: '**/packages.lock.json'

      - name: Restore dotnet packages
        run: |
          dotnet workload restore
          dotnet restore --locked-mode

      - name: build
        run: pnpm build

      - name: upload dist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: |
            dist/

  test:
    runs-on: ubuntu-24.04
    needs:
      - build
    timeout-minutes: 15
    permissions:
      id-token: write

    steps:
      - name: ⚙️ Setup
        uses: containerbase/internal-tools/setup@4577a4226e81662520a9457dd271851c7ed6f8f8 # v4.6.81

      - name: fetch dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist

      - name: vitest
        run: pnpm test

      - name: Codecov test results
        if: github.event_name != 'merge_group' && !cancelled()
        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          use_oidc: true
          report_type: test_results

      - name: Codecov coverage results
        if: github.event_name != 'merge_group'
        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          use_oidc: true

  benchmark:
    runs-on: ubuntu-24.04
    needs:
      - build
    timeout-minutes: 5

    steps:
      - name: ⚙️ Setup
        uses: containerbase/internal-tools/setup@4577a4226e81662520a9457dd271851c7ed6f8f8 # v4.6.81

      - name: fetch dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist

      - name: benchmark
        run: pnpm vitest bench --run

  release:
    needs:
      - lint
      - build
      - test
      - benchmark
    runs-on: ubuntu-latest

    # tests shouldn't need more time
    timeout-minutes: 15

    permissions:
      contents: write
      id-token: write
      issues: write

    steps:
      # full checkout for semantic-release
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          show-progress: false
          filter: blob:none # we don't need all blobs

      - name: ⚙️ Setup
        uses: containerbase/internal-tools/setup@4577a4226e81662520a9457dd271851c7ed6f8f8 # v4.6.81
        with:
          checkout: false

      - name: fetch dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist

      - name: semantic-release
        run: |
          pnpm semantic-release --dry-run ${{env.DRY_RUN}} --ci ${{env.DRY_RUN != 'true'}}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Catch-all required check for test matrix
  success:
    needs:
      - lint
      - build
      - test
      - benchmark
      - release
    runs-on: ubuntu-24.04
    timeout-minutes: 1
    if: always()
    steps:
      - name: Fail for failed or skipped lint job
        if: |
          needs.lint.result == 'failure' ||
          needs.lint.result == 'skipped'
        run: exit 1

      - name: Fail for failed or skipped build job
        if: |
          needs.build.result == 'failure' ||
          needs.build.result == 'skipped'
        run: exit 1

      - name: Fail for failed or skipped test job
        if: |
          needs.test.result == 'failure' ||
          needs.test.result == 'skipped'
        run: exit 1

      - name: Fail for failed or skipped benchmark job
        if: |
          needs.benchmark.result == 'failure' ||
          needs.benchmark.result == 'skipped'
        run: exit 1

      - name: Fail for failed or skipped release job
        if: |
          needs.release.result == 'failure' ||
          needs.release.result == 'skipped'
        run: exit 1