ci.yaml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - main

permissions:
  contents: write
  pull-requests: write
  issues: write
  actions: write
  statuses: write
  checks: write
  repository-projects: read
  id-token: write
  packages: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.ref_name != github.event.repository.default_branch }}

jobs:
  pr-size-check:
    if: ${{ github.event_name == 'pull_request' && !contains(github.head_ref, 'release-please') }}
    name: PR Size Check
    runs-on: ubuntu-latest
    permissions:
      statuses: write
      pull-requests: read
    steps:
      - name: Validate PR Size
        uses: SolaceDev/solace-public-workflows/.github/actions/pr-size-check@main
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          max-lines: 1500

  # Validate conventional commits for PRs
  validate-conventional-commit:
    name: "Validate Conventional Commit"
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && !contains(github.head_ref, 'release-please') && github.event.pull_request.user.login != 'dependabot[bot]'
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Validate PR Title
        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          types: |
            feat
            fix
            docs
            style
            refactor
            perf
            test
            build
            ci
            chore
            deps
            revert
          requireScope: false
          disallowScopes: |
            release
          subjectPattern: ^.+$
          subjectPatternError: |
            The subject "{subject}" found in the pull request title "{title}"
            didn't match the configured pattern. Please ensure that the subject
            is not empty.

  # Label PR based on changed files and determine which plugins to build
  label-pr:
    runs-on: ubuntu-24.04
    outputs:
      all_plugins: ${{ steps.resolve-changed.outputs.all_plugins }}
      pr_number: ${{ steps.resolve-changed.outputs.pr_number }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Label PR based on changes
        id: label-pr
        if: github.event_name == 'pull_request'
        uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          sync-labels: true
          configuration-path: .github/pr_labeler.yaml

      - name: Resolve changed plugins and build matrix payload
        id: resolve-changed
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: python3 .github/scripts/resolve_changed_plugins.py

  # Build and test each plugin that changed
  builds:
    needs: label-pr
    if: needs.label-pr.result == 'success' && needs.label-pr.outputs.all_plugins != '[]'
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.label-pr.outputs.all_plugins) }}
    name: Build Plugin - ${{ matrix.plugin_directory }}
    uses: ./.github/workflows/build-plugin.yaml
    with:
      plugin_directory: ${{ matrix.plugin_directory }}
    secrets:
      COMMIT_KEY: ${{ secrets.COMMIT_KEY }}
      FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
      SONARQUBE_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
      SONARQUBE_HOST_URL: ${{ secrets.SONARQUBE_HOST_URL }}

  # CI Status check - aggregates all job results
  ci-status:
    name: CI Status
    runs-on: ubuntu-latest
    needs: [label-pr, builds]
    if: always() && needs.label-pr.result == 'success'
    permissions:
      pull-requests: write
      issues: write
      checks: write
      actions: write
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1

      - name: Download plugin result artifacts
        if: always() && github.event_name == 'pull_request' && needs.label-pr.outputs.all_plugins != '[]' && (needs.builds.result == 'success' || needs.builds.result == 'skipped')
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: ci-plugin-result-*
          merge-multiple: true
          path: ci-plugin-results

      - name: Run reusable release readiness aggregation
        id: release_readiness_gate
        if: always() && github.event_name == 'pull_request' && contains(github.head_ref, 'release-please') && needs.label-pr.outputs.all_plugins != '[]' && (needs.builds.result == 'success' || needs.builds.result == 'skipped')
        continue-on-error: true
        uses: SolaceDev/solace-public-workflows/pr-release-readiness-check@main
        with:
          pr_number: ${{ github.event.pull_request.number }}
          github_token: ${{ github.token }}
          fossa_api_key: ${{ secrets.FOSSA_API_KEY }}
          sonarqube_token: ${{ secrets.SONARQUBE_TOKEN }}
          sonarqube_host_url: ${{ secrets.SONARQUBE_HOST_URL }}
          repo_owner: ${{ github.repository_owner }}
          base_branch: main
          check_name: Release Readiness Check
          comment_marker: Release Readiness Check Results
          update_pr_comment: "true"
          update_check_details: "true"
          fail_on_issues: "true"

      - name: Publish SonarQube Quality Gate check
        id: sonar_gate
        if: always() && github.event_name == 'pull_request' && !contains(github.head_ref, 'release-please') && needs.label-pr.outputs.all_plugins != '[]' && (needs.builds.result == 'success' || needs.builds.result == 'skipped')
        continue-on-error: true
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        uses: SolaceDev/solace-public-workflows/monorepo-ci-report-status@main
        with:
          check_type: sonarqube
          projects_json: ${{ needs.label-pr.outputs.all_plugins }}
          results_dir: ci-plugin-results
          github_token: ${{ secrets.GITHUB_TOKEN }}
          pr_number: ${{ github.event.pull_request.number }}
          sonarqube_host_url: ${{ secrets.SONARQUBE_HOST_URL }}
          check_name: SonarQube Quality Gate
          comment_on_pr: "true"
          comment_marker: SonarQube Quality Gate
          update_check_details: "true"
          fail_on_issues: "true"

      - name: Publish Unit Tests check
        id: unit_tests_gate
        if: always() && github.event_name == 'pull_request' && !contains(github.head_ref, 'release-please') && needs.label-pr.outputs.all_plugins != '[]' && (needs.builds.result == 'success' || needs.builds.result == 'skipped')
        continue-on-error: true
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        uses: SolaceDev/solace-public-workflows/monorepo-ci-report-status@main
        with:
          check_type: unit-tests
          projects_json: ${{ needs.label-pr.outputs.all_plugins }}
          results_dir: ci-plugin-results
          github_token: ${{ secrets.GITHUB_TOKEN }}
          pr_number: ${{ github.event.pull_request.number }}
          check_name: Unit Tests
          comment_on_pr: "false"
          update_check_details: "true"
          fail_on_issues: "true"

      - name: Publish FOSSA Guard check
        id: fossa_guard_gate
        if: always() && github.event_name == 'pull_request' && !contains(github.head_ref, 'release-please') && needs.label-pr.outputs.all_plugins != '[]' && (needs.builds.result == 'success' || needs.builds.result == 'skipped')
        continue-on-error: true
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        uses: SolaceDev/solace-public-workflows/monorepo-fossa-diff-report@main
        with:
          projects_json: ${{ needs.label-pr.outputs.all_plugins }}
          repo_owner: ${{ github.repository_owner }}
          head_ref: ${{ github.head_ref }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          check_name: FOSSA Guard
          comment_on_pr: "true"
          comment_marker: FOSSA Guard (PR Diff)
          update_check_details: "true"
          fail_on_issues: "true"

      - name: Check CI status
        run: |
          fail() {
            echo "$1"
            exit 1
          }

          if [[ "${{ needs.label-pr.outputs.all_plugins }}" == "[]" ]]; then
            echo "No plugins changed, skipping build and quality checks"
            exit 0
          fi

          if [[ "${{ needs.builds.result }}" != "success" && "${{ needs.builds.result }}" != "skipped" ]]; then
            fail "Build jobs failed"
          fi
          echo "Build jobs passed or were skipped"

          if [[ "${{ github.event_name }}" != "pull_request" ]]; then
            echo "All CI checks passed!"
            exit 0
          fi

          if [[ "${{ github.head_ref }}" == *"release-please"* ]]; then
            if [[ "${{ steps.release_readiness_gate.outcome }}" != "success" && "${{ steps.release_readiness_gate.outcome }}" != "skipped" ]]; then
              fail "Release readiness check failed"
            fi
            echo "Release readiness check passed or was skipped"
            echo "All CI checks passed!"
            exit 0
          fi

          if [[ "${{ steps.sonar_gate.outcome }}" != "success" && "${{ steps.sonar_gate.outcome }}" != "skipped" ]]; then
            fail "SonarQube quality gate failed"
          fi
          echo "SonarQube quality gate passed or was skipped"

          if [[ "${{ steps.unit_tests_gate.outcome }}" != "success" && "${{ steps.unit_tests_gate.outcome }}" != "skipped" ]]; then
            fail "Unit tests gate failed"
          fi
          echo "Unit tests gate passed or was skipped"

          if [[ "${{ steps.fossa_guard_gate.outcome }}" != "success" && "${{ steps.fossa_guard_gate.outcome }}" != "skipped" ]]; then
            fail "FOSSA guard failed"
          fi
          echo "FOSSA guard passed or was skipped"
          echo "All CI checks passed!"