ci.yml

name: CI

on:
  push:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
      - '.github/workflows/markdown.yml'
      - '.github/markdownlint.json'
      - '.github/markdownlint.jsonc'
      - '.github/workflows/nightly.yml'
      - '.github/ISSUE_TEMPLATE/**'
  pull_request:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
      - '.github/workflows/markdown.yml'
      - '.github/markdownlint.json'
      - '.github/markdownlint.jsonc'
      - '.github/workflows/nightly.yml'
      - '.github/ISSUE_TEMPLATE/**'
  workflow_dispatch:
  merge_group:
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    strategy:
      matrix:
        platform: [ubuntu-24.04, windows-2022, macos-14]
        include:
          - platform: ubuntu-24.04
            target: linux
          - platform: windows-2022
            target: windows
          - platform: macos-14
            target: darwin
    runs-on: ${{ matrix.platform }}
    permissions:
      packages: read
    name: 'Build and test (${{ matrix.target }})'

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - run: git config --global core.autocrlf false
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          submodules: true

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          node-version-file: package.json
          registry-url: https://npm.pkg.github.com
          package-manager-cache: false

      - name: Set version
        if: runner.os == 'Linux' && github.repository_owner == 'Open-CMSIS-Pack'
        run: |
          DESCRIBE=$(git describe --tags --long --match 'v[0-9]*.[0-9]*.[0-9]*' 2>/dev/null || true)
          echo "DESCRIBE: ${DESCRIBE}"
          if [ -z "${DESCRIBE}" ]; then
            echo "No semver tag matching vX.Y.Z found."
            exit 1
          fi
          BASE_TAG=$(printf '%s\n' "${DESCRIBE}" | grep -Eo '^v[0-9]+\.[0-9]+\.[0-9]+')
          PR_QUALIFIER=$(printf '%s\n' "${DESCRIBE}" | grep -Eo '\-g[0-9a-f]+$' || true)
          BRANCH_QUALIFIER=$(printf '%s\n' "${DESCRIBE}" | grep -Eo '[0-9]+\-g[0-9a-f]+$' || true)
          SAFE_REF_NAME="${{ github.ref_name }}"
          SAFE_REF_NAME="${SAFE_REF_NAME//[^0-9A-Za-z-]/-}"

          case ${{ github.event_name }} in
            release)
              TAG="${{ github.event.release.tag_name }}"
              npm version --allow-same-version --no-git-tag-version --new-version "${TAG#v}"
              ;;
            pull_request)
              npm version -s --allow-same-version --no-git-tag-version --new-version "${BASE_TAG#v}"
              PR_VERSION="${BASE_TAG#v}-pr${{ github.event.number }}${PR_QUALIFIER}"
              npm version --no-git-tag-version --new-version "${PR_VERSION}" && echo "Prerelease version set succeeded" || echo "Prerelease version set FAILED with exit code $?"
              ;;
            *)
              npm version -s --allow-same-version --no-git-tag-version --new-version "${BASE_TAG#v}"
              PR_VERSION="${BASE_TAG#v}-${SAFE_REF_NAME}${BRANCH_QUALIFIER}"
              npm version --no-git-tag-version --new-version "${PR_VERSION}" && echo "Prerelease version set succeeded" || echo "Prerelease version set FAILED with exit code $?"
              ;;
          esac
          VERSION="$(jq -r ".version" < package.json)"
          sed -i "s/## Unreleased/## ${VERSION}/" CHANGELOG.md
          echo "Updated CHANGELOG with version ${VERSION}"

      - name: Remove badges
        if: runner.os == 'Linux'
        run: |
          sed -i "/https:\/\/qlty\.sh\/gh/d" README.md
          sed -i "/https:\/\/securityscorecards\.dev\/viewer/d" README.md
          sed -i "/https:\/\/img.shields.io\//d" README.md

      - name: Install dependencies
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: npm ci

      - name: Build on Windows or macOS
        if: runner.os != 'Linux'
        run: npm run build:no-lint

      - name: Build on Linux
        if: runner.os == 'Linux'
        run: npm run build

      - name: Check copyright
        run: npm run copyright:check

      - name: Test
        run: npm run test

      - name: Upload dist
        if: runner.os == 'Linux'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: |
            ./README.md
            ./CHANGELOG.md
            ./package.json
            ./dist
          retention-days: 1

      - name: Commit changelog
        if: false && github.event_name == 'release' && runner.os == 'Linux'
        run: |
          sed -i '3i ## Unreleased\n' CHANGELOG.md
          git checkout main
          git config user.name github-actions
          git config user.email git@github.com
          git add CHANGELOG.md
          git commit -m "Update CHANGELOG.md after release [skip ci]"
          git push

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: runner.os == 'Linux'
        with:
          name: test-coverage
          path: ./coverage

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-report-${{ matrix.target }}
          path: ./test-report.html

      - name: Publish coverage report to QLTY
        if: github.repository_owner == 'Open-CMSIS-Pack' && runner.os == 'Linux'
        uses: qltysh/qlty-action/coverage@a19242102d17e497f437d7466aa01b528537e899 # v2.2.0
        with:
          token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
          files: coverage/lcov.info

  package:
    name: Package
    runs-on: [ubuntu-latest]
    needs: build
    strategy:
      fail-fast: true
      matrix:
        target:
          - win32-x64
          - win32-arm64
          - linux-x64
          - linux-arm64
          - darwin-arm64
    permissions:
      packages: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Configure git settings
        run: git config --global core.autocrlf false

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          node-version-file: package.json
          registry-url: https://npm.pkg.github.com
          package-manager-cache: false

      - name: Download dist
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: .

      - name: Download tools
        run: |
          npm ci
          npm run download-tools -- --target ${{ matrix.target }} --no-cache

      - name: Create vsix package
        run: |
          npm run package -- --target ${{ matrix.target }}

      - name: Upload package
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vscode-cmsis-debugger-${{ matrix.target }}
          path: ./*.vsix
          retention-days: 1

  validate:
    name: Validate package (${{ matrix.target }})
    runs-on: ${{ matrix.platform }}
    needs: package
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: win32-x64
            platform: windows-2022
          - target: win32-arm64
            platform: windows-2022
          - target: linux-x64
            platform: ubuntu-24.04
          - target: linux-arm64
            platform: ubuntu-24.04
          - target: darwin-arm64
            platform: macos-14
    permissions:
      packages: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Configure git settings
        run: git config --global core.autocrlf false

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          node-version-file: package.json
          registry-url: https://npm.pkg.github.com
          package-manager-cache: false

      - name: Install dependencies
        run: npm ci

      - name: Download vsix package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: vscode-cmsis-debugger-${{ matrix.target }}

      - name: Validate VSIX contents
        shell: bash
        run: |
          VSIX_FILE=$(ls *.vsix)
          echo "Validating VSIX: $VSIX_FILE"
          npm run validate-tools -- --target ${{ matrix.target }} --vsix "$VSIX_FILE"

  publish:
    name: Publish release
    runs-on: [ubuntu-latest]
    if: github.event_name == 'release'
    needs: [ package, validate ]
    permissions:
      contents: write  # for softprops/action-gh-release to create a GitHub release
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Download packages
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: vscode-cmsis-debugger-*

      - name: Download coverage report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: test-coverage
          path: test-coverage # Required for single-match patterns by actions/download-artifact >= v5

      - name: Download test report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: test-report-linux
          path: test-report-linux # Required for single-match patterns by actions/download-artifact >= v5

      - name: Zip test report
        run: zip -r test-report.zip *
        working-directory: test-report-linux

      - name: Zip test coverage
        run: zip -r test-coverage.zip *
        working-directory: test-coverage
         
      - name: Attach packages
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          files: |
            **/*.vsix
            test-coverage/test-coverage.zip
            test-report-linux/test-report.zip