pr.yml

# =============================================================================
# Pull Request Workflow – Merge Strategy Validation & Preflight Checks
# =============================================================================
#
# This workflow enforces merge strategy consistency and commit hygiene on
# pull requests targeting `main`, using label-driven validation.
#
# Key Behavior:
# -----------------------------------------------------------------------------
# 1. **Label-Gated Execution**:
#    - The workflow blocks execution until the PR is labeled with one of:
#      - `merge-squash`: Indicates squash merge will be used.
#      - `merge-regular`: Indicates regular merge will be used.
#    - If no label is present, the workflow fails early and provides guidance
#      for contributors and reviewers.
#    - If both labels are present, the workflow fails to prevent ambiguity.
#
# 2. **Squash Merge Validation**:
#    - Validates that the PR title and body conform to commit message standards.
#    - Performs a preflight check on the final commit of the PR.
#
# 3. **Regular Merge Validation**:
#    - Iterates through every commit in the PR.
#    - Validates each commit message against your project’s standards.
#    - Runs preflight logic on each commit individually.
#
# Goals:
# -----------------------------------------------------------------------------
# ✅ Enforce consistent commit history and clear merge intent.
# ✅ Prevent accidental merges without review of commit semantics.
# ✅ Ensure all commits are tested and validated before merge.
#
# Trigger:
# -----------------------------------------------------------------------------
# Runs on all pull request activity that could affect labels or commits:
# - `opened`, `edited`, `synchronize`, `labeled`, `unlabeled`
#
# What Contributors Should Know:
# -----------------------------------------------------------------------------
# - Add either the `merge-squash` or `merge-regular` label to proceed.
# - The workflow automatically re-runs after labeling.
# - Validation and preflight behavior is determined by the selected label.
#
# Example Workflow Outcomes:
# -----------------------------------------------------------------------------
# - ✅ Label = `merge-squash` → Title/body validation + 1 preflight check.
# - ✅ Label = `merge-regular` → Commit-by-commit validation + multiple checks.
# - ❌ No label → Fast failure with instructions.
# - ❌ Both labels → Fast failure due to conflict.
#
# =============================================================================

name: Pull Request

on:
  pull_request:
    types: [ opened, edited, synchronize, labeled, unlabeled ]

jobs:

  # -----------------------------------------------
  # Block workflow until merge-strategy label exists
  # -----------------------------------------------
  check-merge-strategy-label:
    runs-on: ubuntu-latest
    outputs:
      has_label: ${{ steps.haslabel.outputs.has_label }}
      squash_merge: ${{ steps.haslabel.outputs.squash_merge }}
    steps:
      - name: Check for merge-strategy label
        id: haslabel
        run: |
          LABELS=$(echo '${{ toJson(github.event.pull_request.labels) }}' | jq -r '.[].name')
          HAS_SQUASH="false"
          HAS_REGULAR="false"
          for l in $LABELS; do
          if [[ "$l" == "merge-squash" ]]; then
            HAS_SQUASH="true"
          elif [[ "$l" == "merge-regular" ]]; then
            HAS_REGULAR="true"
          fi
          done
          
          # Check for conflicting labels
          if [[ "$HAS_SQUASH" == "true" && "$HAS_REGULAR" == "true" ]]; then
            echo ""
            echo "❌ Both 'merge-squash' and 'merge-regular' labels are present. Please choose only ONE merge strategy label."
            exit 1
          fi
          
          HAS_LABEL="false"
          SQUASH_MERGE="false"
          if [[ "$HAS_SQUASH" == "true" ]]; then
            HAS_LABEL="true"
            SQUASH_MERGE="true"
          elif [[ "$HAS_REGULAR" == "true" ]]; then
            HAS_LABEL="true"
          fi
          
          echo "has_label=$HAS_LABEL" >> $GITHUB_OUTPUT
          echo "squash_merge=$SQUASH_MERGE" >> $GITHUB_OUTPUT
          if [[ "$HAS_LABEL" != "true" ]]; then
            echo ""
            echo "❌ PR must have either a 'merge-squash' or 'merge-regular' label to indicate the preferred merge strategy."
            echo "👉 Please add one of these labels to this PR. The workflow will run automatically after labeling."
            echo ""
            echo "ℹ️  What happens next:"
            echo "    - If you choose 'merge-squash', the workflow will validate the PR title and description as the final commit message, and run preflight checks against the last commit in this PR."
            echo "    - If you choose 'merge-regular', the workflow will validate every individual commit message in the PR, and run preflight checks for each commit."
            echo ""
            echo "This ensures the commit history matches your chosen merge strategy and all code passes quality checks before merging."  
            exit 1
          fi

  # -----------------------------------------------
  # Squash merge validation
  # -----------------------------------------------
  validate-squash-merge:
    needs: check-merge-strategy-label
    if: needs.check-merge-strategy-label.outputs.has_label == 'true' && needs.check-merge-strategy-label.outputs.squash_merge == 'true'
    runs-on: ubuntu-latest
    env:
      PR_TITLE: ${{ github.event.pull_request.title }}
      PR_BODY: ${{ github.event.pull_request.body }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Update permissions for scripts
        run: find ./devops/scripts -type f -name '*.sh' -exec chmod +x {} +

      - name: Store PR Title + Description
        run: |
          mkdir -p .tmp
          echo "$PR_TITLE" > .tmp/commit-msg.txt
          if [[ -n "$PR_BODY" ]]; then
            echo "" >> .tmp/commit-msg.txt
            echo "$PR_BODY" >> .tmp/commit-msg.txt
          fi

      - name: Validate PR Title + Description (squash merge)
        run: |
          chmod +x ./scripts/commit-msg-check.sh
          ./scripts/commit-msg-check.sh .tmp/commit-msg.txt

      - name: Get Last Commit SHA
        id: get_last_commit
        run: |
          LAST_COMMIT_SHA=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits" | jq -r '.[-1].sha')
          echo "last_commit=$LAST_COMMIT_SHA" >> $GITHUB_OUTPUT

      - name: Run Preflight Check (squash)
        uses: ./.github/workflows/preflight-check.yml
        with:
          ref: "${{ steps.get_last_commit.outputs.last_commit }}"

  # -----------------------------------------------
  # Regular merge validation
  # -----------------------------------------------
  validate-regular-merge:
    needs: check-merge-strategy-label
    if: needs.check-merge-strategy-label.outputs.has_label == 'true' && needs.check-merge-strategy-label.outputs.squash_merge == 'false'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Update permissions for scripts
        run: find ./devops/scripts -type f -name '*.sh' -exec chmod +x {} +

      - name: Fetch and Process Commit Messages
        run: |
          mkdir -p .tmp/commits
          curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits" \
            | jq -r '.[] | "\(.sha)\n\(.commit.message)\n===END===" ' > .tmp/all-commits.txt
          awk '/^===END===$/ {close(f); c++; next} {if (!f) f=sprintf(".tmp/commits/%03d.txt", c); print >> f}' .tmp/all-commits.txt

      - name: Validate Each Commit Message (regular merge)
        run: |
          chmod +x ./scripts/commit-msg-check.sh
          failed_commits=()
          for file in .tmp/commits/*.txt; do
            commit_hash=$(head -n 1 "$file")
            tail -n +2 "$file" > .tmp/commit-message.txt
            ./scripts/commit-msg-check.sh .tmp/commit-message.txt
            if [ $? -ne 0 ]; then
              echo "❌ Commit message validation failed for $commit_hash"
              failed_commits+=("$commit_hash")
            fi
          done
          if [ ${#failed_commits[@]} -gt 0 ]; then
            echo "❌ The following commits failed validation:"
            printf '%s\n' "${failed_commits[@]}"
            exit 1
          fi

      - name: Get All Commit SHAs
        id: get_commit_shas
        run: |
          PR_COMMITS=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits" \
            | jq -r '.[].sha')
          echo "$PR_COMMITS" > .tmp/commit-shas.txt

      - name: Run Preflight Check for Each Commit (regular merge)
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
        run: |
          failed_commits=()
          while IFS= read -r COMMIT_SHA; do
            if [[ -z "$COMMIT_SHA" ]]; then continue; fi
            # Call preflight reusable workflow, or use gh workflow run if appropriate
            # Here we just echo; insert your logic here
            echo "Would trigger preflight check for commit: $COMMIT_SHA"
          done < .tmp/commit-shas.txt