pull-request.yml

name: Pull Request

# Triggers only on pull request lifecycle events:
#   - opened       (PR creation)
#   - synchronize  (push to the PR branch while the PR is open)
#   - reopened
# These are the default `pull_request` activity types — listed explicitly
# here for clarity. Pre-PR pushes don't run CI by design (saves minutes
# during early WIP commits).
on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: ['**']

permissions:
  contents: read

# Cancel an in-progress run when a new commit lands on the same PR.
concurrency:
  group: pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  verify:
    name: Verify (JDK 17)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      # PRs only run on JDK 17 (the minimum target). Forward-compat
      # regressions on JDK 21/25 are caught post-merge by main.yml.
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      # Validates the wrapper jar hash and caches Gradle home + wrapper
      # dists between runs.
      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Build, test, lint, coverage
        run: ./gradlew build --stacktrace

      - name: Upload test reports on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-reports
          path: |
            build/reports/tests/
            build/test-results/
          retention-days: 14

      # Coverage ratchet lives in Codecov: codecov.yml at the repo root
      # configures `threshold: 5%` so a PR fails the Codecov status check
      # if line coverage drops more than 5 pp vs the base branch.
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: build/reports/jacoco/test/jacocoTestReport.xml
          fail_ci_if_error: true

  # NOTE: integration tests are NOT run automatically on PR open/sync.
  # They are required for merge but only fire when a reviewer comments
  # `integrationtest` (JDK 17) or `integrationtestfull` (matrix 17/21/25)
  # — see .github/workflows/pr-integration-on-demand.yml. Branch-protection
  # rules should require the "Integration tests pass" check name produced
  # by that workflow before allowing merge to main.