ci.yml

---
name: CI

'on':
  push:
    branches: ["main", "release-**", "feat_*", "feature/**"]
  pull_request:
    branches: ["**"]

permissions:
  contents: read
  actions: read
  pull-requests: read

jobs:
  yaml-lint:
    name: YAML Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.x"

      - name: Install yamllint
        run: pip install --upgrade yamllint

      - name: Run yamllint
        run: yamllint . --config-file .yamllint.yaml

  go-quality:
    name: Go Quality Suite
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: "1.25"
          cache-dependency-path: cli/go.sum

      - name: Check gofmt diffs
        working-directory: cli
        run: |
          set -euo pipefail
          fmt_output="$(gofmt -l .)"
          if [[ -n "$fmt_output" ]]; then
            echo "gofmt reported differences; run 'gofmt -w' on:"
            echo "$fmt_output"
            exit 1
          fi

      - name: Run go vet
        working-directory: cli
        run: go vet ./...

      - name: Run Go tests with coverage
        working-directory: cli
        env:
          COVERAGE_TARGET: ${{ vars.CODE_COVERAGE_TARGET || 65 }}
          PACKAGE_SKIP_LIST: ${{ vars.PACKAGE_SKIP_LIST || '' }}
        run: |
          set -euo pipefail
          mapfile -t pkgs < <(go list ./...)
          if [[ -n "${PACKAGE_SKIP_LIST}" ]]; then
            IFS=',' read -ra skip_arr <<< "${PACKAGE_SKIP_LIST}"
            for skip in "${skip_arr[@]}"; do
              trimmed="$(echo "${skip}" | xargs)"
              if [[ -z "$trimmed" ]]; then
                continue
              fi
              for i in "${!pkgs[@]}"; do
                if [[ "${pkgs[$i]}" == "$trimmed" ]]; then
                  unset 'pkgs[i]'
                fi
              done
            done
          fi
          if [[ ${#pkgs[@]} -eq 0 ]]; then
            echo "No Go packages left to test after applying skip list."
            exit 1
          fi
          go test -covermode=atomic -coverprofile=coverage.out "${pkgs[@]}"
          coverage_line=$(go tool cover -func=coverage.out | tee coverage.txt | awk '/^total:/ {print $3}')
          if [[ -z "$coverage_line" ]]; then
            echo "Unable to determine overall coverage from coverage.txt"
            exit 1
          fi
          coverage_value="${coverage_line%\%}"
          target="${COVERAGE_TARGET:-65}"
          if ! python3 -c "import sys; cov=float(sys.argv[1]); target=float(sys.argv[2]); print(f'Total coverage: {cov:.2f}% (target {target:.2f}%)'); sys.exit(0 if cov >= target else 1)" "$coverage_value" "$target"; then
            echo "Coverage ${coverage_value}% is below target ${target}%"
            exit 1
          fi

      - name: Upload coverage artifacts
        if: ${{ !env.ACT }}
        uses: actions/upload-artifact@v7
        with:
          name: cli-coverage-${{ github.sha }}
          path: |
            cli/coverage.out
            cli/coverage.txt
          if-no-files-found: error

      - name: Run gosec
        uses: dell/common-github-actions/gosec-runner@main
        with:
          excludes: ${{ vars.GOSEC_EXCLUDES || 'G117,G602,G703,G704' }}

      - name: Run code sanitizer
        uses: dell/common-github-actions/code-sanitizer@main
        with:
          args: ${{ (env.ACT == 'true' && github.workspace || '/github/workspace') }}/cli

      - name: Malware scan
        uses: dell/common-github-actions/malware-scanner@main
        with:
          directories: .
          options: -ri

  engine-build:
    name: Engine Build & Tests
    runs-on: ubuntu-latest
    needs:
      - go-quality
      - yaml-lint
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install JDK 21 for act
        if: ${{ env.ACT }}
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install \
            -y \
            --no-install-recommends \
            openjdk-21-jdk \
            ca-certificates \
            libibverbs-dev \
            librdmacm-dev
          java -version

      - name: Set up Temurin JDK 21
        if: ${{ !env.ACT }}
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "21"
          cache: gradle

      - name: Install RDMA build dependencies
        if: ${{ !env.ACT }}
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends \
            libibverbs-dev \
            librdmacm-dev

      - name: Show version metadata
        run: |
          echo "VERSION=$(cat VERSION)"
          echo "GIT_COMMIT=$(git rev-parse --short HEAD)"

      - name: Spotless formatting check
        working-directory: engine
        run: ./gradlew spotlessCheck --no-daemon

      - name: Error Prone static analysis
        working-directory: engine
        run: |
          ./gradlew \
            -I tools/errorprone-init.gradle \
            :core:spt-base:compileJava \
            :core:spt-base:compileTestJava \
            --rerun-tasks \
            -x test \
            --no-daemon

      - name: Gradle unit tests
        working-directory: engine
        run: ./gradlew test --no-daemon

      - name: Assemble engine distribution
        working-directory: engine
        run: ./gradlew :bundle:assembleDist --no-daemon

      - name: Upload engine dist bundle
        if: ${{ !env.ACT }}
        uses: actions/upload-artifact@v7
        with:
          name: engine-dist-${{ github.sha }}
          path: engine/bundle/build/dist
          if-no-files-found: error

  cli-build:
    name: CLI Build & Artifact
    runs-on: ubuntu-latest
    needs:
      - go-quality
      - yaml-lint
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: "1.25"
          cache-dependency-path: cli/go.sum

      - name: Build CLI binary (stamped)
        run: |
          make build-cli
          mkdir -p dist/cli
          VERSION=$(cat VERSION)
          cp cli/spt dist/cli/spt-linux-amd64-${VERSION}
          cli/spt version

      - name: Upload CLI binary
        if: ${{ !env.ACT }}
        uses: actions/upload-artifact@v7
        with:
          name: cli-linux-amd64-${{ github.sha }}
          path: dist/cli
          if-no-files-found: error