ruby.yml

name: Ruby

on:
  push:
    branches: [ "master", "main" ]
    tags: [ "v*" ]
  pull_request:
    branches: ['**']
  workflow_dispatch:
  schedule:
    # schedule dayly tests, since dependencies are not intended to be locked
    # this means: at 23:42
    - cron: '42 23 * * *'

# see https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
permissions: {}

concurrency:
  group: '${{ github.workflow }}-${{ github.ref }}'
  cancel-in-progress: true

env:
  COVERAGE_DIR: coverage
  TESTS_COVERAGE_ARTIFACT: coverage

jobs:
  test:
    name: Ruby ${{ matrix.ruby }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        ruby:
          - '4.0.4'
          - '3.4.7'
          - '3.3.9'
          - '3.2.9'
          - '3.1.7'
          - '3.0.7'
          - '2.7.8'
    steps:
      - name: Checkout Code
        # see https://github.com/actions/checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Set up Ruby ${{ matrix.ruby }}
        # see https://github.com/ruby/setup-ruby
        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
        with:
          ruby-version: ${{ matrix.ruby }}
          # intentionally disabled to avoid cache poisoning risks flagged by zizmor
          bundler-cache: false
      - name: Install Dependencies
        run: bundle install
      - name: Run the default task
        run: bundle exec rake
      - name: Artifact coverage
        if: ${{ ! cancelled() }}
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: '${{ env.TESTS_COVERAGE_ARTIFACT }}_ruby${{ matrix.ruby }}'
          path: ${{ env.COVERAGE_DIR }}
          if-no-files-found: error
          retention-days: 7
  report-coverage:
    name: Publish test coverage
    needs: [ "test" ]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: fetch test artifacts
        # see https://github.com/actions/download-artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: '${{ env.TESTS_COVERAGE_ARTIFACT }}_*'
          merge-multiple: false
      - name: Run codacy-coverage-reporter
        env:
          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
        ## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
        if: ${{ env.CODACY_PROJECT_TOKEN != '' }}
        # see https://github.com/codacy/codacy-coverage-reporter-action
        uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1.3.0
        with:
          project-token: ${{ env.CODACY_PROJECT_TOKEN }}
          coverage-reports: '${{ env.TESTS_COVERAGE_ARTIFACT }}_*/coverage.xml'