ci.yml

name: CI

on:
  pull_request:
    branches: [master]

# `pull_request`, never `pull_request_target`: a fork's code must run with a read-only token and
# no access to secrets. Only `changes` needs to read the PR itself.
permissions:
  contents: read

jobs:
  # A release PR carries nothing but the bumped VERSION, and the release it was cut for already
  # built both targets from that very commit. Deciding it here rather than with `paths-ignore`
  # is what keeps `ci-ok` reporting: a required check that never runs blocks the PR forever.
  changes:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      code: ${{ steps.f.outputs.code }}
    steps:
      - id: f
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          files=$(gh pr view ${{ github.event.pull_request.number }} --json files -q '.files[].path')
          if [ "$files" = "VERSION" ]; then
            echo "code=false" >> "$GITHUB_OUTPUT"
            echo "Version-only PR; skipping the build."
          elif printf '%s\n' "$files" | grep -qx VERSION; then
            # The release workflow bumps VERSION and applies its own `bump` on top of whatever it
            # reads, so a hand-edit that reaches master is counted twice and skips a minor. That
            # is how 0.5 was lost. A version-only PR is the release's own and passes above.
            echo "::error::VERSION is the release workflow's to move. Drop it from this PR."
            exit 1
          else
            echo "code=true" >> "$GITHUB_OUTPUT"
          fi

  test:
    needs: changes
    if: needs.changes.outputs.code == 'true'
    strategy:
      fail-fast: false
      matrix:
        # Same images the release builds on, so a toolchain the shipped binary cannot be built
        # with fails here rather than at release time.
        os: [ubuntu-22.04, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
        with:
          # This job compiles and runs code the PR supplies, so it must not leave a usable token
          # behind for a build script to pick up. Checkout v6 moved that token out of
          # `.git/config` and into `$RUNNER_TEMP`, which is still readable from the job.
          persist-credentials: false
      - name: Install Linux deps
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxi-dev libxfixes-dev \
            libxss-dev libxtst-dev libxrender-dev libxinerama-dev \
            libcurl4-openssl-dev zlib1g-dev \
            libxkbcommon-dev libwayland-dev wayland-protocols libgl1-mesa-dev libegl1-mesa-dev \
            libasound2-dev libpulse-dev libdbus-1-dev libudev-dev
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug
      - name: Build
        run: cmake --build build --config Debug
      - name: Test
        run: ctest --test-dir build -C Debug --output-on-failure
      # The installer is otherwise compiled only by the release workflow, which is run by hand —
      # so a typo in the script would first surface halfway through cutting a release, after the
      # release branch has already been pushed. Compiling it here makes that a failed check
      # instead. The output is thrown away; that it compiles at all is the whole test.
      # PowerShell, not bash: Git Bash rewrites any argument that starts with a '/' into a
      # Windows path, so ISCC's own /D switches arrive as filenames and it refuses the lot.
      - name: Compile the installer script
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $iscc = "C:\Program Files (x86)\Inno Setup 6\ISCC.exe"
          if (-not (Test-Path $iscc)) { choco install innosetup -y --no-progress }
          & $iscc /Qp `
            "/DAppVersion=0.0.0" `
            "/DSourceExe=..\build\Debug\PathOfPriceCheck.exe" `
            "/DOutDir=..\build\installer-check" `
            "/DOutName=ci-check" `
            packaging\PathOfPriceCheck.iss
          if ($LASTEXITCODE -ne 0) { exit 1 }

  # The one check master requires. It runs on every PR whatever the matrix did, because a
  # required check that is skipped never reports and leaves the PR unmergeable.
  ci-ok:
    needs: [changes, test]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Gate
        run: |
          set -euo pipefail
          changes='${{ needs.changes.result }}'
          test='${{ needs.test.result }}'
          # Skipped is a pass: it is what a version-only PR looks like. Failure and cancellation
          # are not, and neither is a `changes` job that could not decide.
          if [ "$changes" = "success" ] && { [ "$test" = "success" ] || [ "$test" = "skipped" ]; }; then
            echo "ok (changes: $changes, test: $test)"
          else
            echo "::error::changes: $changes, test: $test"
            exit 1
          fi