# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Checks

on:
  push:
    branches: ["main", "v1", "mcp"]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: ["main", "v1", "mcp"]
  workflow_dispatch:

concurrency:
  # Pushing new changes to a branch will cancel any in-progress CI runs
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Restrict jobs in this workflow to have no permissions by default; permissions
# should be granted per job as needed using a dedicated `permissions` block
permissions: {}

jobs:
  ensure_snapshots_are_being_cleaned:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - run: scripts/report_uncleaned_snapshots.py
  filenames:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - run: |
          find . -mindepth 1 ! -regex '.*/[#@A-Za-z0-9._-]*' -print0 \
            | xargs -0 -I{} bash -c \
              'printf "::error file=%q::This filename contains undesired characters\n" "$1" && false' _ {}
  format:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: prettier
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run format action
        uses: ./.github/workflows/format-action
  tidy:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: go mod tidy
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"
          check-latest: true
      - run: go mod tidy -diff
  lint:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: golangci-lint
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"
          check-latest: true
      - name: Run lint action
        uses: ./.github/workflows/lint-action
  prepare_test_image_testdata:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - run: scripts/build_test_images.sh
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: image-testdata-${{ github.run_number }}-${{ github.run_attempt }}
          path: cmd/osv-scanner/scan/image/testdata/*.tar
          retention-days: 1
  tests:
    permissions:
      contents: read # to fetch code (actions/checkout)
    needs:
      - prepare_test_image_testdata
    name: Run unit tests
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: image-testdata-${{ github.run_number }}-*
          path: cmd/osv-scanner/scan/image/testdata/
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"
          check-latest: true
      - name: Run test action
        uses: ./.github/workflows/test-action
        with:
          codecov_token: ${{ secrets.CODECOV_TOKEN }}
  docker:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    env:
      # Required for buildx on docker 19.x
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"
          check-latest: true
      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
      - name: Run GoReleaser
        id: run-goreleaser
        uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean --snapshot
      - env:
          ARTIFACTS: ${{ steps.run-goreleaser.outputs.artifacts }}
        run: |
          echo "$ARTIFACTS" > output.json
          jq -r '.[] | select(
            .type == "Docker Image" and
            .goarch == "amd64" and
            .goos == "linux" and
            .extra.DockerConfig.dockerfile == "goreleaser.dockerfile"
          ) | .name' output.json | while read -r image; do
            echo "Testing image $image"

            exit_code=0
            docker run -v ${PWD}:/src $image -L /src/go.mod || exit_code=$?

            # fail if we get a non-zero exit code other than "vulnerabilities were found"
            if [[ $exit_code -ne 0 && $exit_code -ne 1  ]]; then
              exit $exit_code
            fi
          done