ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:
  merge_group:
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: read  # for dorny/paths-filter in changes job

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  changes:
    # Detect whether source code changed. On non-PR events the job is skipped
    # (result == 'skipped'), causing downstream jobs to run via the condition below.
    # This pattern is used successfully in patchloom and attune-io/attune.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: filter
        with:
          filters: |
            code:
              - 'src/**'
              - 'test/**'
              - 'scripts/**'
              - 'package.json'
              - 'package-lock.json'
              - 'tsconfig*.json'
              - '.nvmrc'
              - '.github/actions/**'
              - '.github/workflows/**'  # any workflow change is "code" (fixes auto-approve.yml etc. being skipped)

  unit-test:
    needs: [changes]
    if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Run tests
        run: npm test

      - name: Check code coverage
        if: matrix.os == 'ubuntu-latest'
        id: coverage
        run: |
          output=$(npm run test:coverage 2>&1)
          echo "$output"
          pct=$(echo "$output" | grep 'all files' | head -1 | awk -F'|' '{gsub(/[[:space:]]/, "", $2); print $2}')
          echo "percentage=$pct" >> "$GITHUB_OUTPUT"

      - name: Determine badge color
        if: matrix.os == 'ubuntu-latest'
        id: color
        run: |
          pct="${{ steps.coverage.outputs.percentage }}"
          int_pct=${pct%.*}
          if [ "$int_pct" -ge 90 ]; then
            echo "color=brightgreen" >> "$GITHUB_OUTPUT"
          elif [ "$int_pct" -ge 80 ]; then
            echo "color=green" >> "$GITHUB_OUTPUT"
          elif [ "$int_pct" -ge 70 ]; then
            echo "color=yellowgreen" >> "$GITHUB_OUTPUT"
          elif [ "$int_pct" -ge 60 ]; then
            echo "color=yellow" >> "$GITHUB_OUTPUT"
          else
            echo "color=red" >> "$GITHUB_OUTPUT"
          fi

      - name: Update coverage badge
        if: matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main'
        continue-on-error: true
        uses: schneegans/dynamic-badges-action@0e50b8bad39e7e1afd3e4e9c2b7dd145fad07501 # v1.8.0
        with:
          auth: ${{ secrets.GIST_TOKEN }}
          gistID: d01e4551b744b77e2927555e43a4b935
          filename: coverage.json
          label: coverage
          message: ${{ steps.coverage.outputs.percentage }}%
          color: ${{ steps.color.outputs.color }}

  build:
    needs: [changes]
    if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Compile
        run: npm run compile

      - name: Package extension
        run: npm run package

  integration-test:
    needs: [changes, unit-test, build]
    if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - name: Harden runner
        if: runner.os == 'Linux'
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Compile extension and tests
        run: npm run compile && npm run compile-tests

      - name: Run extension integration tests (Linux)
        if: runner.os == 'Linux'
        run: xvfb-run -a npm run test:extension

      - name: Run extension integration tests
        if: runner.os != 'Linux'
        run: npm run test:extension

      - name: Setup UI test VS Code
        run: npx extest setup-tests --code_version max --extensions_dir .vscode-test/extensions

      - name: Patch test VS Code to run as background app
        run: bash scripts/hide-test-vscode.sh

      - name: Run UI tests (Linux)
        if: runner.os == 'Linux'
        run: xvfb-run -a npx extest run-tests './out-uitest/test/ui/*.test.js' --extensions_dir .vscode-test/extensions

      - name: Run UI tests
        if: runner.os != 'Linux'
        run: npx extest run-tests './out-uitest/test/ui/*.test.js' --extensions_dir .vscode-test/extensions

  ci:
    # Final gate job (if: always()). This is the recommended pattern (see patchloom
    # and attune) so that individual matrix jobs can use the changes filter without
    # breaking required status checks or Scorecard parsing.
    if: always()
    needs:
      - unit-test
      - build
      - integration-test
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: All CI jobs passed (or were correctly skipped for docs-only change)
        run: |
          results=("${{ needs.unit-test.result }}" "${{ needs.build.result }}" "${{ needs.integration-test.result }}")
          for r in "${results[@]}"; do
            if [[ "$r" != "success" && "$r" != "skipped" ]]; then
              echo "FAILED: dependency reported '$r'"
              exit 1
            fi
          done
          echo "CI gate passed."