ci.yml

name: CI

on:
  workflow_dispatch:
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review]
    branches: ["main"]
  push:
    branches: ["main"]

permissions:
  contents: read
  actions: read
  packages: read

jobs:
  # Compute once which path groups changed; every other job references these
  # outputs. dorny/paths-filter handles PR base diff, push base diff, and
  # empty results on non-diff events (workflow_dispatch); the `if:` guards
  # below explicitly opt manual runs back into running everything.
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      builds: ${{ steps.filter.outputs.builds }}
      tests:  ${{ steps.filter.outputs.tests }}
      docs:   ${{ steps.filter.outputs.docs }}
      cpp_checks: ${{ steps.filter.outputs.cpp_checks }}
      rust_release_check: ${{ steps.filter.outputs.rust_release_check }}
      docker: ${{ steps.filter.outputs.docker }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
        id: filter
        with:
          filters: |
            builds:
              - src/**
              - include/**
              - benchmarks/**
              - cpp-example-collection
              - cpp-example-collection/**
              - client-sdk-rust/**
              - cmake/**
              - CMakeLists.txt
              - CMakePresets.json
              - build*
              - .build*
              - vcpkg.json
              - .github/workflows/ci.yml
              - .github/workflows/builds.yml
            tests:
              - src/**
              - include/**
              - client-sdk-rust/**
              - cmake/**
              - .token_helpers/**
              - CMakeLists.txt
              - CMakePresets.json
              - build*
              - .build*
              - vcpkg.json
              - .github/workflows/ci.yml
              - .github/workflows/tests.yml
            docs:
              - README.md
              - include/**
              - docs/**
              - scripts/generate-docs.sh
              - .github/workflows/ci.yml
              - .github/workflows/generate-docs.yml
              - .github/workflows/publish-docs.yml
            cpp_checks:
              - src/**
              - include/**
              - benchmarks/**
              - client-sdk-rust/**
              - cmake/**
              - CMakeLists.txt
              - CMakePresets.json
              - scripts/clang-format.sh
              - scripts/clang-tidy.sh
              - .clang-format
              - .clang-tidy
              - .github/workflows/ci.yml
              - .github/workflows/cpp-checks.yml
            docker:
              - docker/**
              - .github/workflows/ci.yml
              - .github/workflows/docker-images.yml
            rust_release_check:
              - client-sdk-rust

  builds:
    name: Builds
    needs: changes
    if: ${{ needs.changes.outputs.builds == 'true' || github.event_name == 'workflow_dispatch' }}
    uses: ./.github/workflows/builds.yml
    secrets: inherit

  docker-images:
    name: Docker Images
    needs: changes
    if: ${{ (github.event_name == 'pull_request' && needs.changes.outputs.docker == 'true') || (github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.docker == 'true') || github.event_name == 'workflow_dispatch' }}
    permissions:
      contents: read
      actions: read
      packages: write
    uses: ./.github/workflows/docker-images.yml
    with:
      push_images: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    secrets: inherit

  tests:
    name: Tests
    needs: changes
    if: ${{ needs.changes.outputs.tests == 'true' || github.event_name == 'workflow_dispatch' }}
    uses: ./.github/workflows/tests.yml
    secrets: inherit

  # license-check is cheap (seconds) and broad enough that it should run on
  # every PR.
  license-check:
    name: License Check
    uses: ./.github/workflows/license_check.yml

  # link-check is cheap (seconds) and should run on every PR
  link-check:
    name: Link Check
    uses: ./.github/workflows/link_check.yml

  cpp-checks:
    name: C++ Checks
    needs: changes
    if: ${{ needs.changes.outputs.cpp_checks == 'true' || github.event_name == 'workflow_dispatch' }}
    uses: ./.github/workflows/cpp-checks.yml

  generate-docs:
    name: Generate Docs
    needs: changes
    if: ${{ needs.changes.outputs.docs == 'true' || github.event_name == 'workflow_dispatch' }}
    uses: ./.github/workflows/generate-docs.yml

  # Only runs on a client-sdk-rust submodule bump. Runs in parallel and is not a
  # dependency of builds/tests, so developer iteration against an unreleased
  # Rust commit still gets full build feedback in CI.
  rust-release-check:
    name: Rust Release Check
    needs: changes
    if: ${{ needs.changes.outputs.rust_release_check == 'true' || github.event_name == 'workflow_dispatch' }}
    uses: ./.github/workflows/rust-release-check.yml

  # Context: GitHub repository rulesets "required checks" actually need a job name to list.
  # This job is an aggregate job
  ci:
    name: CI
    runs-on: ubuntu-latest
    # List all the jobs that need to succeed for the CI to pass
    needs:
      - changes
      - builds
      - docker-images
      - tests
      - license-check
      - cpp-checks
      - generate-docs
      - link-check
      - rust-release-check
    if: always()
    steps:
      - name: Verify required CI jobs
        uses: suzuki-shunsuke/required-status-check-action@2b5a46064846b09381852c2c4217e898f639e768  # v0.1.3
        with:
          needs: ${{ toJson(needs) }}