# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: tazelish-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-15, windows-2025]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # The hosted Windows image carries LLVM, whose clang-cl the Bazel
      # configuration uses.
      - if: runner.os == 'Windows'
        shell: pwsh
        run: '"BAZEL_LLVM=C:\Program Files\LLVM" | Out-File -FilePath $env:GITHUB_ENV -Append'
      - run: bazelisk test //...
      - run: bazelisk build //:tazelish

  coverage-report:
    name: Coverage report
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # Clang's own coverage, read by the LLVM tools of the runner's Clang.
      - run: >-
          bazelisk coverage //Tests:tests
          --combined_report=lcov
          --instrumentation_filter=^//:
          --repo_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1
          --repo_env=BAZEL_LLVM_PROFDATA=/usr/bin/llvm-profdata-18
          --repo_env=BAZEL_LLVM_COV=/usr/bin/llvm-cov-18
      - run: cp "$(bazelisk info output_path)/_coverage/_coverage_report.dat" lcov.info
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: tazelish-coverage
          path: lcov.info
          if-no-files-found: error
          retention-days: 1

  coverage:
    # Fork PRs cannot receive the OIDC token required for Codecov uploads.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    needs: coverage-report
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    steps:
      # Keep the OIDC-capable job apart from the build.
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: tazelish-coverage
      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          use_oidc: true
          files: lcov.info
          fail_ci_if_error: true

  required:
    name: CI Required
    if: always()
    needs: [test]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - env:
          RESULT: ${{ needs.test.result }}
        run: test "$RESULT" = success