code_analysis.yml

name: code analysis

on: pull_request
  # push:
  #   branches: [ $default-branch ]
  # pull_request:
  #   branches: [ $default-branch ]

permissions:
  contents: read

jobs:
  clang-format:
    # For any event that is not a PR, the CI will always run. In PRs, the CI
    # can be skipped if the tag [skip-ci] is written in the title.
    if: |
        (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||
        (github.event_name == 'pull_request' && !(
          contains(github.event.pull_request.title, '[skip-ci]') ||
          contains(github.event.pull_request.labels.*.name, 'skip ci') ||
          contains(github.event.pull_request.labels.*.name, 'skip code analysis')
        ))

    runs-on: ubuntu-latest
    env:
      TRAVIS_BRANCH: ${{ github.base_ref }}
      TRAVIS_PULL_REQUEST_REPO: ${{ github.event.pull_request.head.repo.html_url }}
      TRAVIS_PULL_REQUEST_BRANCH: ${{ github.head_ref }}
      BASE_COMMIT: ${{ github.event.pull_request.base.sha }}
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 1024
        ref: ${{ github.event.pull_request.head.sha }}
    - name: Fetch base sha
      run: git fetch --depth=1024 origin +${{github.event.pull_request.base.sha}}:origin/base_sha
    - name: Determine merge base
      run: echo "MERGE_BASE=$(git merge-base ${{ github.event.pull_request.base.sha }} HEAD)" >> $GITHUB_ENV
    - name: install clang-format
      run: |
         wget https://apt.llvm.org/llvm.sh
         chmod u+x ./llvm.sh
         sudo ./llvm.sh 20
         sudo apt-get install -y clang-format-20
         PATH=/usr/lib/llvm-20/bin:${PATH}
    - name: run clang-format script
      run: |
        PATH=/usr/lib/llvm-20/bin:${PATH}
        .ci/format_script.sh

  clang-tidy:
    # For any event that is not a PR, the CI will always run. In PRs, the CI
    # can be skipped if the tag [skip-ci] is written in the title.
    if: |
       (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||
       (github.event_name == 'pull_request' && !(
         contains(github.event.pull_request.title, '[skip-ci]') ||
         contains(github.event.pull_request.labels.*.name, 'skip ci') ||
         contains(github.event.pull_request.labels.*.name, 'skip code analysis')
       ))

    runs-on:
       - self-hosted
       - linux
       - x64

    container:
      image: registry.cern.ch/root-ci/alma10:buildready
      options: '--security-opt label=disable --rm'
      env:
        OS_APPLICATION_CREDENTIAL_ID: '7f5b64a265244623a3a933308569bdba'
        OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
        OS_AUTH_TYPE: 'v3applicationcredential'
        OS_AUTH_URL: 'https://keystone.cern.ch/v3'
        OS_IDENTITY_API_VERSION: 3
        OS_INTERFACE: 'public'
        OS_REGION_NAME: 'cern'
        PYTHONUNBUFFERED: true

    env:
       TRAVIS_BRANCH: ${{ github.base_ref }}
       TRAVIS_PULL_REQUEST_REPO: ${{ github.event.pull_request.head.repo.html_url }}
       TRAVIS_PULL_REQUEST_BRANCH: ${{ github.head_ref }}
       BASE_COMMIT: ${{ github.event.pull_request.base.sha }}

    steps:
       - uses: actions/checkout@v6
         with:
            fetch-depth: 1
            ref: ${{ github.event.pull_request.head.sha }}
            path: ROOT-CI/src
       - name: Fetch base sha
         run: cd ROOT-CI/src && git fetch --depth=1 origin +${{github.event.pull_request.base.sha}}:origin/base_sha
       - name: Determine merge base
         run: echo "MERGE_BASE=$(cd ROOT-CI/src && git merge-base ${{ github.event.pull_request.base.sha }} HEAD)" >> $GITHUB_ENV
       - name: run clang-tidy script
         run: |
            ROOT-CI/src/.ci/tidy_script.sh

  ruff:
    if: |
        (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||
        (github.event_name == 'pull_request' && !(
          contains(github.event.pull_request.title, '[skip-ci]') ||
          contains(github.event.pull_request.labels.*.name, 'skip ci') ||
          contains(github.event.pull_request.labels.*.name, 'skip code analysis')
        ))

    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v6
      with:
        fetch-depth: 2

    - name: Get the list of changed files
      id: diff
      run: |
        git diff --diff-filter=AMR --name-only HEAD~1 | tee changed_files.txt

    - name: Install ruff
      uses: astral-sh/ruff-action@v3
      with:
        version: "latest"
        args: "--version"

    - name: Lint code
      run: |
        files=$(grep '\.py$' changed_files.txt || echo "")
        if [ -n "$files" ]; then
          echo "$files" | xargs ruff check --diff || true
          echo "$files" | xargs ruff check
        else
          echo "No python files to lint"
        fi

    - name: Format code
      if: always()
      run: |
        files=$(grep '\.py$' changed_files.txt || echo "")
        if [ -n "$files" ]; then
          apply_command=""
          failure=false
          for file in $files; do
            while IFS=- read -r start length; do
              [ -z "$start" ] && continue
              length=${length:-1}
              # Skip invalid ranges
              if [ "$start" -eq 0 ] || [ "$length" -eq 0 ]; then
                continue
              fi
              end=$((start + length))
              ruff format --diff --preview --range ${start}-${end} ${file} || failure=true
              apply_command+="ruff format --range $start-$end $file && "
            done < <(git diff --unified=0 HEAD~1 -- "$file" | grep '^@@' | sed -E 's/^@@ -[0-9]+(,[0-9]+)? \+([0-9]+)(,([0-9]+))? @@.*/\2-\4/')
          done

          if ${failure}; then
            echo -e "::error::Formatting failed. To apply the changes locally, run the following command:\n$apply_command"
            exit 123;
          fi
        else
          echo "No python files to format"
        fi