ci.yml

name: CI

on:
  workflow_dispatch:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
    paths-ignore:
      - '**/*.md'
      - '.github/workflows/markdown.yml'
      - '.github/markdownlint.json'
      - '.github/markdownlint.jsonc'
      - '.github/workflows/nightly.yml'
      - '.github/ISSUE_TEMPLATE/**'
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  build:
    permissions:
      contents: write
      packages: read
      actions: read

    runs-on: [ubuntu-latest]
    name: 'Build'

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Configure git settings
        run: git config --global core.autocrlf false

      - name: Checkout repository
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.3.1
        with:
          submodules: true
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          node-version-file: package.json
          registry-url: https://npm.pkg.github.com
          package-manager-cache: false

      - name: Install dependencies
        env:
          GITHUB_TOKEN: ${{ github.token }}
          NODE_OPTIONS: --max-old-space-size=8192
        run: npm ci

      - name: Check copyright
        run: npm run copyright:check

      - name: Check links for insecure http URLs (only changed files)
        run: npm run check:links -- -m false

      - name: Lint check
        run: npm run lint

      - name: Run build
        run: npm run build

      - name: Update current version
        if: github.event_name != 'release'
        run: |
          # Increment patch version by 1 (e.g. 1.64.1 -> 1.64.2)
          BASE_VERSION=$(node -p "require('./package.json').version.split('-')[0]")
          IFS='.' read -r MAJOR MINOR PATCH <<< "$BASE_VERSION"
          if [ -z "$MAJOR" ] || [ -z "$MINOR" ] || [ -z "$PATCH" ]; then
            echo "Invalid semver: $BASE_VERSION"
            exit 1
          fi
          if ! [[ "$MAJOR" =~ ^[0-9]+$ && "$MINOR" =~ ^[0-9]+$ && "$PATCH" =~ ^[0-9]+$ ]]; then
            echo "Invalid semver components (non-numeric): $BASE_VERSION (MAJOR=$MAJOR, MINOR=$MINOR, PATCH=$PATCH)"
            exit 1
          fi
          NEXT_PATCH_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"

          # Get commit count: since last tag if exists, otherwise total commits
          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          if [ -n "$LAST_TAG" ]; then
            COMMIT_COUNT=$(git rev-list --count HEAD ^${LAST_TAG})
          else
            COMMIT_COUNT=$(git rev-list --count HEAD)
          fi

          # Get short commit SHA
          SHORT_SHA=$(git rev-parse --short HEAD)

          # Create PR version: 1.64.2-12-abc1234
          PR_VERSION="${NEXT_PATCH_VERSION}-${COMMIT_COUNT}-${SHORT_SHA}"
          echo "Setting version to ${PR_VERSION}"

          # Update package.json
          npm version "${PR_VERSION}" --no-git-tag-version

      - name: Remove badges
        run: |
          sed -i "/https:\/\/qlty\.sh\/gh/d" README.md
          sed -i "/https:\/\/securityscorecards\.dev\/viewer/d" README.md
          sed -i "/https:\/\/img.shields.io\//d" README.md

      - name: Ensure download-tools.sh is executable
        working-directory: .github/workflows
        run: chmod +x ./download-tools.sh

      - name: Download dependencies (win32-x64)
        working-directory: .github/workflows
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./download-tools.sh win32-x64

      - name: Package win32-x64
        run: npm run package -- --target win32-x64

      - name: Download dependencies (win32-arm64)
        working-directory: .github/workflows
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./download-tools.sh win32-arm64

      - name: Package win32-arm64
        run: npm run package -- --target win32-arm64

      - name: Download dependencies (linux-x64)
        working-directory: .github/workflows
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./download-tools.sh linux-x64

      - name: Package linux-x64
        run: npm run package -- --target linux-x64

      - name: Download dependencies (linux-arm64)
        working-directory: .github/workflows
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./download-tools.sh linux-arm64

      - name: Package linux-arm64
        run: npm run package -- --target linux-arm64

      - name: Download dependencies (darwin-x64)
        working-directory: .github/workflows
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./download-tools.sh darwin-x64

      - name: Package darwin-x64
        run: npm run package -- --target darwin-x64

      - name: Download dependencies (darwin-arm64)
        working-directory: .github/workflows
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./download-tools.sh darwin-arm64

      - name: Package darwin-arm64
        run: npm run package -- --target darwin-arm64

      - name: Upload win32-x64 VSIX package
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vscode-cmsis-solution-win32-x64
          path: ./*win32-x64*.vsix
          retention-days: 1

      - name: Upload win32-arm64 VSIX package
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vscode-cmsis-solution-win32-arm64
          path: ./*win32-arm64*.vsix
          retention-days: 1

      - name: Upload linux-x64 VSIX package
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vscode-cmsis-solution-linux-x64
          path: ./*linux-x64*.vsix
          retention-days: 1

      - name: Upload linux-arm64 VSIX package
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vscode-cmsis-solution-linux-arm64
          path: ./*linux-arm64*.vsix
          retention-days: 1

      - name: Upload darwin-x64 VSIX package
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vscode-cmsis-solution-darwin-x64
          path: ./*darwin-x64*.vsix
          retention-days: 1

      - name: Upload darwin-arm64 VSIX package
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: vscode-cmsis-solution-darwin-arm64
          path: ./*darwin-arm64*.vsix
          retention-days: 1

      - name: Create version bump patch
        run: git diff > new-version.patch

      - name: Store version bump patch
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: new-version-patch
          path: ./new-version.patch
          if-no-files-found: error

  test:
    name: 'Test (${{ matrix.target }})'
    runs-on: ${{ matrix.platform }}
    needs: [ build ]
    permissions:
      contents: write
      packages: read
      actions: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - target: win32-x64
            platform: windows-2022
          - target: linux-x64
            platform: ubuntu-24.04
          - target: darwin-arm64
            platform: macos-14
          - target: darwin-x64
            platform: macos-15-intel

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.3.1
        with:
          submodules: true
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          node-version-file: package.json
          registry-url: https://npm.pkg.github.com
          package-manager-cache: false

      - name: Install dependencies
        env:
          GITHUB_TOKEN: ${{ github.token }}
          NODE_OPTIONS: --max-old-space-size=8192
        run: npm ci

      - name: Run Test
        run: npm run test

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: ${{ matrix.target == 'linux-x64' }}
        with:
          name: unit-test-coverage
          path: ./coverage

      - name: Publish coverage report to QLTY
        if: github.repository_owner == 'Open-CMSIS-Pack' && matrix.target == 'linux-x64'
        uses: qltysh/qlty-action/coverage@a19242102d17e497f437d7466aa01b528537e899 # v2.2.0
        with:
          token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
          files: coverage/lcov.info

  publish:
    name: Publish release
    runs-on: [ubuntu-latest]
    if: github.event_name == 'release'
    needs: [ build, test ]
    permissions:
      contents: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Download packages
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: vscode-cmsis-solution-*

      - name: Download coverage report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: unit-test-coverage
          path: test-coverage

      - name: Attach packages
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          files: |
            **/*.vsix
            test-coverage/test-coverage.zip
            test-report-linux/test-report.zip