ci.yml

name: CI

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  workflow_dispatch:

permissions:
  contents: read
  actions: read
  security-events: read
  pull-requests: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  LC_ALL: C.UTF-8
  LANG: C.UTF-8
  CI_DEFER_ARTIFACT_LINK_RESOLUTION: "1"

defaults:
  run:
    shell: bash

jobs:
  pr-labeling:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          fetch-tags: true
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "20"
      - name: Run Entry Check
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash -euo pipefail tools/ci/bin/run.sh pr-labeling
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-pr-labeling
          path: artifacts/ci/pr-labeling/
          if-no-files-found: error

  preflight:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          fetch-tags: true
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "20"
      - name: Run Entry Check
        env:
          GH_TOKEN: ${{ github.token }}
          CODEQL_DEFAULT_SETUP_GUARDRAIL_TOKEN: ${{ secrets.CODEQL_DEFAULT_SETUP_GUARDRAIL_TOKEN }}
        run: bash -euo pipefail tools/ci/bin/run.sh preflight
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-preflight
          path: artifacts/ci/preflight/
          if-no-files-found: error

  docs-links-full:
    runs-on: ubuntu-latest
    needs: preflight
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh docs-links-full
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-docs-links-full
          path: artifacts/ci/docs-links-full/
          if-no-files-found: error

  versioning-svt:
    runs-on: ubuntu-latest
    needs: preflight
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          fetch-tags: true
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh versioning-svt
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-versioning-svt
          path: artifacts/ci/versioning-svt/
          if-no-files-found: error

  version-convergence:
    runs-on: ubuntu-latest
    needs: preflight
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Run Entry Check (repo-local convergence)
        # Remote release/NuGet convergence is enforced in release gates and
        # NuGet Online Convergence workflow to avoid main-branch deadlocks
        # during the normal sequence merge -> tag/release -> registry propagation.
        env:
          REQUIRE_REMOTE: "0"
        run: bash -euo pipefail tools/ci/bin/run.sh version-convergence
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-version-convergence
          path: artifacts/ci/version-convergence/
          if-no-files-found: error

  naming-snt:
    runs-on: ubuntu-latest
    needs: preflight
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh naming-snt
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-naming-snt
          path: artifacts/ci/naming-snt/
          if-no-files-found: error

  build:
    runs-on: ubuntu-latest
    needs: [preflight, versioning-svt, version-convergence, naming-snt]
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh build
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-build
          path: artifacts/ci/build/
          if-no-files-found: error

  api-contract:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh api-contract
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-api-contract
          path: artifacts/ci/api-contract/
          if-no-files-found: error

  pack:
    runs-on: ubuntu-latest
    needs: [build, versioning-svt]
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh pack
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-pack
          path: artifacts/ci/pack/
          if-no-files-found: error

  consumer-smoke:
    runs-on: ubuntu-latest
    needs: pack
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Download Pack Artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: ci-pack
          path: artifacts/ci/pack
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh consumer-smoke
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-consumer-smoke
          path: artifacts/ci/consumer-smoke/
          if-no-files-found: error

  package-backed-tests:
    runs-on: ubuntu-latest
    needs: pack
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Download Pack Artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: ci-pack
          path: artifacts/ci/pack
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh package-backed-tests
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-package-backed-tests
          path: artifacts/ci/package-backed-tests/
          if-no-files-found: error

  security-nuget:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh security-nuget
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-security-nuget
          path: artifacts/ci/security-nuget/
          if-no-files-found: error

  tests-bdd-coverage:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh tests-bdd-coverage
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-tests-bdd-coverage
          path: artifacts/ci/tests-bdd-coverage/
          if-no-files-found: error

  summary:
    runs-on: ubuntu-latest
    needs: [docs-links-full, naming-snt, versioning-svt, version-convergence, api-contract, consumer-smoke, package-backed-tests, security-nuget, tests-bdd-coverage]
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: |
            8.0.x
            10.0.102
      - name: Download Required Artifacts (retry/backoff)
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash tools/ci/bin/download_summary_artifacts.sh "${GITHUB_RUN_ID}"
      - name: Run Entry Check
        run: bash -euo pipefail tools/ci/bin/run.sh summary
      - name: Upload Artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ci-summary
          path: artifacts/ci/summary/
          if-no-files-found: error