ci.yml

name: CI Build and Test

on:
  push:
    branches: [ main, develop, '+([0-9])\.+([0-9])\.x-maintenance', '+([0-9])\.+([0-9])-rc' ]
  pull_request:
    branches: [ main, develop, '+([0-9])\.+([0-9])\.x-maintenance', '+([0-9])\.+([0-9])-rc' ]
  workflow_dispatch:
    inputs:
      protocol:
        description: 'RPC Protocol to test'
        required: true
        default: 'rpc_v2'
        type: choice
        options:
          - rpc_v2
          - legacy

defaults:
  run:
    shell: bash

jobs:
  build_docker:
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.meta.outputs.tags }}
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}/firebolt-cpp-transport-ci
          tags: type=sha

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: .github/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ github.workflow }}
          cache-to: type=gha,mode=max,scope=${{ github.workflow }}

  format_check:
    permissions:
      contents: read
      packages: read
    needs: [build_docker]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Run clang-format check
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
                git ls-files -- '*.cpp' '*.h' | xargs clang-format --dry-run --Werror \
            "

  build_project:
    permissions:
      contents: read
      packages: read
    needs: [build_docker]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version
        run: |
          VERSION=$(git describe --tags --dirty --match "v[0-9]*")
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "version: $VERSION"

      - name: Configure Project
        run: |
          ENABLE_LEGACY_RPC_V1="OFF"
          if [[ "${{ github.event_name }}" = "workflow_dispatch"  && "${{ github.event.inputs.protocol }}" = "legacy" ]]; then
            ENABLE_LEGACY_RPC_V1="ON"
          fi

          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              cmake -B build -S . \
                  -DCMAKE_BUILD_TYPE=Debug \
                  -DENABLE_TESTS=ON \
                  -DENABLE_LEGACY_RPC_V1=$ENABLE_LEGACY_RPC_V1 \
            "

      - name: Build Project
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c "cmake --build build --parallel"

      - name: Upload build directory
        uses: actions/upload-artifact@v4
        with:
          name: build-dir
          path: ${{ github.workspace }}/build

  unit_tests:
    permissions:
      contents: read
      packages: read
    needs: [build_docker, build_project]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download build directory
        uses: actions/download-artifact@v4
        with:
          name: build-dir
          path: ${{ github.workspace }}/build

      - name: Run Unit Tests
        run: |
          chmod +x ${{ github.workspace }}/build/test/utApp
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c "ctest --test-dir build/test"

      - name: Generate Coverage Report
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cd build \
              && mkdir -p coverage \
              && gcovr -r .. \
                    --exclude '.*/test/.*\.h' \
                    --exclude '.*/test/.*\.cpp' \
                    --gcov-ignore-parse-errors=negative_hits.warn \
                    --decisions \
                    --medium-threshold 50 --high-threshold 75 \
                    --html-details coverage/index.html \
                    --cobertura coverage.cobertura.xml \
                    --lcov coverage/coverage.info \
            "

      - name: Upload Coverage Report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: ${{ github.workspace }}/build/coverage/

      - name: Upload lcov artifact for coverage gate
        uses: actions/upload-artifact@v4
        with:
          name: coverage-lcov
          path: ${{ github.workspace }}/build/coverage/coverage.info

      - name: Code Coverage Summary Report
        uses: irongut/CodeCoverageSummary@v1.3.0
        with:
          filename: build/coverage.cobertura.xml
          badge: true
          hide_complexity: true
          format: markdown
          output: both
          thresholds: "50 75"
          fail_below_min: false

      - name: Add coverage summary to job summary
        run: cat code-coverage-results.md >> $GITHUB_STEP_SUMMARY

  coverage-gate:
    name: Coverage Gate
    needs: [unit_tests]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    # Step-level continue-on-error below avoids blocking PRs on transient fetch/download issues.
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Fetch baseline from build-metadata branch
        # Falls back to {} on first run or if the branch/file is absent.
        continue-on-error: true
        run: |
          set -euo pipefail
          if git fetch origin build-metadata 2>/dev/null && \
             git cat-file -e FETCH_HEAD:coverage-baseline.json 2>/dev/null; then
            git show FETCH_HEAD:coverage-baseline.json > coverage-baseline.json
          else
            echo '{}' > coverage-baseline.json
          fi

      - name: Download lcov artifact
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: coverage-lcov
          path: ./coverage-lcov

      - name: Compare coverage to baseline
        run: |
          python3 .github/scripts/compare_coverage.py \
            --baseline coverage-baseline.json \
            --unit ./coverage-lcov/coverage.info

  update-baseline:
    name: Update Coverage Baseline
    # Runs only on a direct push to develop when unit tests pass.
    # Updates unconditionally — the baseline always tracks actual coverage
    # so future runs compare against the current state, not a stale high-water mark.
    if: >
      github.event_name == 'push' &&
      github.ref == 'refs/heads/develop' &&
      needs.unit_tests.result == 'success'
    needs: [unit_tests]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    concurrency:
      group: update-baseline-develop
      cancel-in-progress: false
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Download lcov artifact
        uses: actions/download-artifact@v4
        with:
          name: coverage-lcov
          path: ./coverage-lcov

      - name: Write new baseline JSON
        run: |
          set -euo pipefail
          TIMESTAMP="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
          python3 .github/scripts/compare_coverage.py \
            --unit ./coverage-lcov/coverage.info \
            --output-json new-baseline.json \
            --commit "$GITHUB_SHA" \
            --timestamp "$TIMESTAMP"
          [[ -f new-baseline.json ]] || { echo "ERROR: no coverage data in lcov file" >&2; exit 1; }
          echo "New baseline:"; cat new-baseline.json

      - name: Commit and push to build-metadata branch
        run: |
          set -euo pipefail
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"

          if git fetch origin build-metadata 2>/dev/null; then
            git checkout -B build-metadata FETCH_HEAD
          else
            git checkout --orphan build-metadata
            git rm -rf . --quiet 2>/dev/null || true
          fi

          cp -f new-baseline.json coverage-baseline.json
          git add coverage-baseline.json

          if git diff --cached --quiet; then
            echo "Coverage baseline unchanged — no commit needed"
          else
            git commit -m "$(printf 'chore: update coverage baseline [skip ci]\n\nCommit : %s\nRun ID : %s' "$GITHUB_SHA" "$GITHUB_RUN_ID")"
            git push --force-with-lease origin build-metadata
            echo "Pushed updated baseline to build-metadata"
          fi