name: Tests

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    name: vet + fmt + tests
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Relevant changes
        id: changes
        run: |
          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
            git fetch --no-tags origin "$GITHUB_BASE_REF"
            base="origin/$GITHUB_BASE_REF"
          else
            base='${{ github.event.before }}'
          fi
          if git diff --quiet "$base"...HEAD -- '*.go' go.mod go.sum Dockerfile .dockerignore .github data release-tooling testdata README.md; then
            echo "code=false" >> "$GITHUB_OUTPUT"
          else
            echo "code=true" >> "$GITHUB_OUTPUT"
          fi
          echo "base=$base" >> "$GITHUB_OUTPUT"
      - name: CHANGELOG entry for data changes
        run: |
          base='${{ steps.changes.outputs.base }}'
          if ! git diff --quiet "$base"...HEAD -- data testdata/shipped_shape.txt && git diff --quiet "$base"...HEAD -- CHANGELOG.md; then
            echo "::error::the shipped data changed without a CHANGELOG.md entry (see the README's Versioning)"
            exit 1
          fi
      # `docker build` streams the context to the daemon. A compose bind-mount of
      # `.` mounts an empty host dir instead, because the job is itself a container.
      - name: Latest supported Go
        if: ${{ steps.changes.outputs.code == 'true' }}
        run: docker build .
      # Runs even when the step above failed, so a red build says whether the
      # failure is version-specific.
      - name: Lowest supported Go
        if: ${{ !cancelled() && steps.changes.outputs.code == 'true' }}
        run: docker build --build-arg GO_VERSION=1.22.12 --target portable .

  release:
    name: Release from CHANGELOG.md
    needs: test
    if: github.event_name == 'push'
    runs-on: ubuntu-26.04
    permissions:
      contents: write
    outputs:
      tag: ${{ steps.publish.outputs.tag }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - id: publish
        run: python3 release-tooling/publish_release.py
        env:
          FORGE_API_URL: ${{ github.api_url }}
          FORGE_REPOSITORY: ${{ github.repository }}
          FORGE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SHA: ${{ github.sha }}

  packages:
    needs: release
    if: needs.release.outputs.tag != ''
    permissions:
      contents: write
      packages: write
    uses: ./.github/workflows/packages.yml
    with:
      tag: ${{ needs.release.outputs.tag }}
    secrets:
      TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
      AUR_KEY: ${{ secrets.AUR_KEY }}
      CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}