ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # full history - Nerdbank.GitVersioning needs it to compute the version
          fetch-tags: true # belt-and-braces so a tagged commit's tags are always visible to NBGV

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: "8.0.x"

      - name: Restore
        run: dotnet restore

      # Run NBGV's own cloud step before build so it sets GitHub Actions environment
      # variables using the native file-command format. Without this, NBGV's MSBuild
      # task writes to $GITHUB_ENV using a format that newer runners reject.
      - name: Set version
        uses: dotnet/nbgv@master
        id: nbgv

      - name: Verify formatting
        run: dotnet format --verify-no-changes --no-restore

      - name: Build
        run: dotnet build --configuration Release --no-restore

      # Runs both Monnify.Tests and Monnify.IntegrationTests. The integration tests use
      # [SkippableFact] + Skip.IfNot(SandboxCredentials.IsAvailable, ...) (see
      # tests/Monnify.IntegrationTests/SandboxCredentials.cs) so they report as skipped here,
      # not failed - this runner has no MONNIFY_SANDBOX_API_KEY/SECRET_KEY configured on purpose.
      - name: Test
        run: dotnet test --configuration Release --no-build

      # Coverage is collected from Monnify.Tests only (run separately from the line above) -
      # IntegrationTests' skipped tests never execute SUT code, so including that project's
      # report would just dilute the denominator with the same assembly's line count again.
      - name: Test with coverage
        run: dotnet test tests/Monnify.Tests/Monnify.Tests.csproj --configuration Release --no-build --collect:"XPlat Code Coverage" --results-directory ./coverage

      # No external service required - just parses the cobertura report coverlet already
      # produces and fails the build below a fixed line-coverage floor. Current baseline is
      # ~95%; 85% leaves headroom for routine work while still catching a real regression.
      - name: Check coverage threshold
        run: |
          python3 - <<'PY'
          import glob, sys, xml.etree.ElementTree as ET

          THRESHOLD = 85.0
          files = glob.glob("./coverage/**/coverage.cobertura.xml", recursive=True)
          if not files:
              sys.exit("No coverage report found")

          root = ET.parse(files[0]).getroot()
          covered = int(root.get("lines-covered"))
          valid = int(root.get("lines-valid"))
          pct = 100 * covered / valid if valid else 0

          print(f"Line coverage: {pct:.2f}% ({covered}/{valid})")
          if pct < THRESHOLD:
              sys.exit(f"Coverage {pct:.2f}% is below the {THRESHOLD}% threshold")
          PY

      # Powers the coverage badge on the repo/README - requires the CODECOV_TOKEN repo
      # secret (from codecov.io, after activating this repo there). Separate from the
      # threshold check above, which stays local and doesn't depend on this succeeding.
      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          directory: ./coverage

      # Validates the package actually builds correctly across both target frameworks - this is
      # NOT a publish step, nothing here touches NuGet.org. No artifact is uploaded either, since
      # this is only a packaging sanity check, not a release.
      - name: Pack (validation only - not published)
        run: dotnet pack src/Monnify/Monnify.csproj --configuration Release --no-build --output ./artifacts