name: Tests

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:
  schedule:
    - cron: '17 5 * * *'

permissions:
  contents: read

jobs:
  test:
    name: vet + fmt + tests
    if: github.event_name != 'schedule'
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Relevant changes
        id: changes
        run: |
          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
            git fetch --no-tags origin "$GITHUB_BASE_REF"
            base="origin/$GITHUB_BASE_REF"
          else
            base='${{ github.event.before }}'
          fi
          if git diff --quiet "$base"...HEAD -- '*.go' go.mod go.sum Dockerfile .dockerignore .github data release-tooling testdata README.md todo.md; then
            echo "code=false" >> "$GITHUB_OUTPUT"
          else
            echo "code=true" >> "$GITHUB_OUTPUT"
          fi
          if git diff --quiet "$base"...HEAD -- '*.go' go.mod go.sum release-tooling Dockerfile .dockerignore LICENSE DATA-LICENSES.md .github/workflows/packages.yml .github/workflows/test.yml; then
            echo "packaging=false" >> "$GITHUB_OUTPUT"
          else
            echo "packaging=true" >> "$GITHUB_OUTPUT"
          fi
          echo "base=$base" >> "$GITHUB_OUTPUT"
      - name: CHANGELOG entry for data changes
        run: |
          base='${{ steps.changes.outputs.base }}'
          if ! git diff --quiet "$base"...HEAD -- data testdata/shipped_shape.txt && git diff --quiet "$base"...HEAD -- CHANGELOG.md; then
            echo "::error::the shipped data changed without a CHANGELOG.md entry (see the README's Versioning)"
            exit 1
          fi
      # `docker build` streams the context to the daemon. A compose bind-mount of
      # `.` mounts an empty host dir instead, because the job is itself a container.
      - name: Latest supported Go
        if: ${{ steps.changes.outputs.code == 'true' }}
        run: docker build .
      # Runs even when the step above failed, so a red build says whether the
      # failure is version-specific.
      - name: Lowest supported Go
        if: ${{ !cancelled() && steps.changes.outputs.code == 'true' }}
        run: docker build --build-arg GO_VERSION=1.22.12 --target portable .
      - name: Package repositories, signed with throwaway keys
        if: ${{ !cancelled() && steps.changes.outputs.packaging == 'true' }}
        run: |
          docker build -f release-tooling/package-repos.Dockerfile --target throwaway-keys --output "$RUNNER_TEMP/keys" .
          PACKAGES_GPG_KEY="$(cat "$RUNNER_TEMP/keys/gpg.asc")" PACKAGES_RSA_KEY="$(cat "$RUNNER_TEMP/keys/rsa.pem")" \
            docker build -f release-tooling/package-repos.Dockerfile --target checks \
            --secret id=gpg,env=PACKAGES_GPG_KEY --secret id=rsa,env=PACKAGES_RSA_KEY .

  vulnerabilities:
    name: Known vulnerabilities in this Go version and the required modules
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      actions: write
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Fetch govulncheck's report from vuln.go.dev
        run: docker build --no-cache-filter vulnerabilities --target vulnerability-report --output "$RUNNER_TEMP/vulnerabilities" .
      - name: File each one in todo.md
        id: file
        run: python3 release-tooling/file_vulnerabilities.py "$RUNNER_TEMP/vulnerabilities/report.json" todo.md
      - name: Propose the filed items
        if: failure() && steps.file.outcome == 'failure' && github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if git diff --quiet todo.md || [ "$(gh pr list --head vulnerabilities --state open --json number --jq length)" != 0 ]; then
            exit 0
          fi
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git switch -C vulnerabilities
          git commit -qam "File the known vulnerabilities govulncheck reports"
          git push -qf "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" vulnerabilities
          gh pr create --head vulnerabilities --title "File the known vulnerabilities govulncheck reports" \
            --body "govulncheck reports known vulnerabilities in the Go version or a required module, and no release is cut until they are gone. This files them atop the next release in todo.md; each item names the bump that fixes it."
          # A pull request the workflow's token opens starts no workflow.
          gh workflow run test.yml --ref vulnerabilities

  release:
    name: Release from CHANGELOG.md
    needs: [test, vulnerabilities]
    if: github.event_name == 'push'
    runs-on: ubuntu-26.04
    permissions:
      contents: write
    outputs:
      tag: ${{ steps.publish.outputs.tag }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - id: publish
        run: python3 release-tooling/publish_release.py
        env:
          FORGE_API_URL: ${{ github.api_url }}
          FORGE_REPOSITORY: ${{ github.repository }}
          FORGE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SHA: ${{ github.sha }}

  packages:
    needs: release
    if: needs.release.outputs.tag != ''
    permissions:
      contents: write
      packages: write
      pages: write
      id-token: write
    uses: ./.github/workflows/packages.yml
    with:
      tag: ${{ needs.release.outputs.tag }}
    secrets:
      TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
      PACKAGES_GPG_KEY: ${{ secrets.PACKAGES_GPG_KEY }}
      PACKAGES_RSA_KEY: ${{ secrets.PACKAGES_RSA_KEY }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}