# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/github-workflow.json
name: .NET

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  NUGET_XMLDOC_MODE: ''
  DOTNET_MULTILEVEL_LOOKUP: 0

jobs:
  build:
    strategy:
      matrix:
        config:
          - Release
          - Debug

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0 # so that NerdBank.GitVersioning has access to history
    - name: Install Nix
      uses: cachix/install-nix-action@v31
      with:
        extra_nix_config: |
          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
    - name: Restore dependencies
      run: nix develop --command dotnet restore
    - name: Build
      run: 'nix develop --command dotnet build --no-restore --configuration ${{matrix.config}}'
    - name: Test
      run: |
          nix develop --command dotnet test --no-build --verbosity normal --configuration ${{matrix.config}} --framework net8.0 --filter 'FullyQualifiedName !~ FailingConsumer'

  selftest-intended-failures:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0 # so that NerdBank.GitVersioning has access to history
    - name: Install Nix
      uses: cachix/install-nix-action@v31
      with:
        extra_nix_config: |
          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
    - name: Restore dependencies
      run: nix develop --command dotnet restore
    - name: Build
      run: 'nix develop --command dotnet build --no-restore --configuration Release'
    - name: Test using self
      run: 'nix develop --command dotnet exec ./WoofWare.NUnitTestRunner/bin/Release/net6.0/WoofWare.NUnitTestRunner.dll ./FailingConsumer/bin/Release/net8.0/FailingConsumer.dll --trx TrxOut/out.trx || true'
    - name: Munge output
      run: 'nix develop --command xmlstarlet sel -N x="http://microsoft.com/schemas/VisualStudio/TeamTest/2010" -t -m "//x:UnitTestResult" -v "@testName" -o ": " -v ".//x:ErrorInfo/x:Message" -n TrxOut/out.trx > snapshot.txt'
    - name: Check output matches expected
      run: 'actual=$(cat snapshot.txt | sort) expected=$(cat FailingConsumer/expected.txt | sort) [ "$expected" == "$actual" ]'

  selftest:
    runs-on: ubuntu-latest
    permissions:
      actions: none
      checks: write
      contents: read
      deployments: none
      id-token: none
      issues: none
      discussions: none
      packages: none
      pages: none
      pull-requests: read
      repository-projects: none
      security-events: none
      statuses: read

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0 # so that NerdBank.GitVersioning has access to history
    - name: Install Nix
      uses: cachix/install-nix-action@v31
      with:
        extra_nix_config: |
          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
    - name: Restore dependencies
      run: nix develop --command dotnet restore
    - name: Build
      run: 'nix develop --command dotnet build --no-restore --configuration Release'
    - name: Test using self
      run: 'nix develop --command dotnet exec ./WoofWare.NUnitTestRunner/bin/Release/net6.0/WoofWare.NUnitTestRunner.dll ./Consumer/bin/Release/net8.0/Consumer.dll --trx TrxOut/out.trx'
    - name: Parse Trx files
      uses: NasAmin/trx-parser@v0.6.0
      if: always()
      id: trx-parser
      with:
        TRX_PATH: ${{ github.workspace }}/TrxOut
        REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  analyzers:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # so that NerdBank.GitVersioning has access to history
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: Prepare analyzers
        run: nix develop --command dotnet restore analyzers/analyzers.fsproj
      - name: Build project
        run: nix develop --command dotnet build ./WoofWare.NUnitTestRunner/WoofWare.NUnitTestRunner.fsproj
      - name: Run analyzers
        run: nix run .#fsharp-analyzers -- --project ./WoofWare.NUnitTestRunner/WoofWare.NUnitTestRunner.fsproj --analyzers-path ./.analyzerpackages/g-research.fsharp.analyzers/*/ --verbosity detailed --report ./analysis.sarif --treat-as-error GRA-STRING-001 GRA-STRING-002 GRA-STRING-003 GRA-UNIONCASE-001 GRA-INTERPOLATED-001 GRA-TYPE-ANNOTATE-001 GRA-VIRTUALCALL-001 GRA-IMMUTABLECOLLECTIONEQUALITY-001 GRA-JSONOPTS-001 GRA-LOGARGFUNCFULLAPP-001 GRA-DISPBEFOREASYNC-001 --exclude-analyzers PartialAppAnalyzer

  build-nix:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: Build
        run: nix build
      - name: Reproducibility check
        run: nix build --rebuild

  check-dotnet-format:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: Run Fantomas
        run: nix run .#fantomas -- --check .

  check-nix-format:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: Run Alejandra
        run: nix develop --command alejandra --check .

  linkcheck:
    name: Check links
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: Run link checker
        run: nix develop --command markdown-link-check README.md

  flake-check:
    name: Check flake
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: Flake check
        run: nix flake check

  nuget-pack:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0 # so that NerdBank.GitVersioning has access to history
    - name: Install Nix
      uses: cachix/install-nix-action@v31
      with:
        extra_nix_config: |
          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
    - name: Restore dependencies
      run: nix develop --command dotnet restore
    - name: Build
      run: nix develop --command dotnet build --no-restore --configuration Release
    - name: Pack
      run: nix develop --command dotnet pack --configuration Release
    - name: Upload NuGet artifact (lib)
      uses: actions/upload-artifact@v4
      with:
        name: nuget-package-lib
        path: WoofWare.NUnitTestRunner.Lib/bin/Release/WoofWare.NUnitTestRunner.Lib.*.nupkg
    - name: Upload NuGet artifact (tool)
      uses: actions/upload-artifact@v4
      with:
        name: nuget-package-tool
        path: WoofWare.NUnitTestRunner/bin/Release/WoofWare.NUnitTestRunner.*.nupkg

  expected-pack:
    needs: [nuget-pack]
    runs-on: ubuntu-latest
    steps:
      - name: Download NuGet artifact (lib)
        uses: actions/download-artifact@v4
        with:
          name: nuget-package-lib
          path: packed-lib
      - name: Check NuGet contents (lib)
        # Verify that there is exactly one nupkg in the artifact that would be NuGet published
        run: if [[ $(find packed-lib -maxdepth 1 -name 'WoofWare.NUnitTestRunner.Lib.*.nupkg' -printf c | wc -c) -ne "1" ]]; then exit 1; fi
      - name: Download NuGet artifact (tool)
        uses: actions/download-artifact@v4
        with:
          name: nuget-package-tool
          path: packed-tool
      - name: Check NuGet contents
        # Verify that there is exactly one nupkg in the artifact that would be NuGet published
        run: if [[ $(find packed-tool -maxdepth 1 -name 'WoofWare.NUnitTestRunner.*.nupkg' -printf c | wc -c) -ne "1" ]]; then exit 1; fi

  all-required-checks-complete:
    if: ${{ always() }}
    needs: [github-release-dry-run, check-dotnet-format, check-nix-format, build, build-nix, linkcheck, flake-check, analyzers, nuget-pack, expected-pack, selftest-intended-failures, selftest]
    runs-on: ubuntu-latest
    steps:
      - uses: G-Research/common-actions/check-required-lite@2b7dc49cb14f3344fbe6019c14a31165e258c059
        with:
          needs-context: ${{ toJSON(needs) }}

  attestation-lib:
    runs-on: ubuntu-latest
    needs: [all-required-checks-complete]
    if: ${{ !github.event.repository.fork && github.ref == 'refs/heads/main' }}
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - name: Download NuGet artifact
        uses: actions/download-artifact@v4
        with:
          name: nuget-package-lib
          path: packed
      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
        with:
          subject-path: "packed/*.nupkg"

  attestation-tool:
    runs-on: ubuntu-latest
    needs: [all-required-checks-complete]
    if: ${{ !github.event.repository.fork && github.ref == 'refs/heads/main' }}
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - name: Download NuGet artifact
        uses: actions/download-artifact@v4
        with:
          name: nuget-package-tool
          path: packed
      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
        with:
          subject-path: "packed/*.nupkg"

  nuget-publish-lib:
    runs-on: ubuntu-latest
    if: ${{ !github.event.repository.fork && github.ref == 'refs/heads/main' }}
    needs: [all-required-checks-complete]
    environment: main-deploy
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: Download NuGet artifact
        uses: actions/download-artifact@v4
        with:
          name: nuget-package-lib
          path: packed
      - name: Identify .NET
        id: identify-dotnet
        run: nix develop --command bash -c "echo dotnet=$(which dotnet) >> $GITHUB_OUTPUT"
      - name: Publish NuGet package
        uses: G-Research/common-actions/publish-nuget@2b7dc49cb14f3344fbe6019c14a31165e258c059
        with:
          package-name: WoofWare.NUnitTestRunner.Lib
          nuget-key: ${{ secrets.NUGET_API_KEY }}
          nupkg-dir: packed/
          dotnet: ${{ steps.identify-dotnet.outputs.dotnet }}

  nuget-publish-tool:
    runs-on: ubuntu-latest
    if: ${{ !github.event.repository.fork && github.ref == 'refs/heads/main' }}
    needs: [all-required-checks-complete]
    environment: main-deploy
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: Download NuGet artifact
        uses: actions/download-artifact@v4
        with:
          name: nuget-package-tool
          path: packed
      - name: Identify .NET
        id: identify-dotnet
        run: nix develop --command bash -c "echo dotnet=$(which dotnet) >> $GITHUB_OUTPUT"
      - name: Publish NuGet package
        uses: G-Research/common-actions/publish-nuget@2b7dc49cb14f3344fbe6019c14a31165e258c059
        with:
          package-name: WoofWare.NUnitTestRunner
          nuget-key: ${{ secrets.NUGET_API_KEY }}
          nupkg-dir: packed/
          dotnet: ${{ steps.identify-dotnet.outputs.dotnet }}

  github-release-dry-run:
    strategy:
      matrix:
        artifact:
        - nuget-package-tool
        - nuget-package-lib
    runs-on: ubuntu-latest
    needs: [nuget-pack]
    steps:
      - uses: actions/checkout@v4
      - name: Download NuGet artifact (tool)
        uses: actions/download-artifact@v4
        with:
          name: ${{ matrix.artifact }}
      - name: Compute package path
        id: compute-path
        run: |
          find . -maxdepth 1 -type f -name 'WoofWare.NUnitTestRunner.*.nupkg' -exec sh -c 'echo "output=$(basename "$1")" >> $GITHUB_OUTPUT' shell {} \;
      - name: Compute tag name
        id: compute-tag
        env:
          NUPKG_PATH: ${{ steps.compute-path.outputs.output }}
        run: echo "output=$(basename "$NUPKG_PATH" .nupkg)" >> $GITHUB_OUTPUT
      - name: Tag and release
        uses: G-Research/common-actions/github-release@19d7281a0f9f83e13c78f99a610dbc80fc59ba3b
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          target-commitish: ${{ github.sha }}
          tag: ${{ steps.compute-tag.outputs.output }}
          binary-contents: ${{ steps.compute-path.outputs.output }}
          dry-run: true

  github-release:
    strategy:
      matrix:
        artifact:
        - nuget-package-tool
        - nuget-package-lib
    runs-on: ubuntu-latest
    if: ${{ !github.event.repository.fork && github.ref == 'refs/heads/main' }}
    needs: [all-required-checks-complete]
    environment: main-deploy
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Download NuGet artifact (tool)
        uses: actions/download-artifact@v4
        with:
          name: ${{ matrix.artifact }}
      - name: Compute package path
        id: compute-path
        run: |
          find . -maxdepth 1 -type f -name 'WoofWare.NUnitTestRunner.*.nupkg' -exec sh -c 'echo "output=$(basename "$1")" >> $GITHUB_OUTPUT' shell {} \;
      - name: Compute tag name
        id: compute-tag
        env:
          NUPKG_PATH: ${{ steps.compute-path.outputs.output }}
        run: echo "output=$(basename "$NUPKG_PATH" .nupkg)" >> $GITHUB_OUTPUT
      - name: Tag and release
        uses: G-Research/common-actions/github-release@19d7281a0f9f83e13c78f99a610dbc80fc59ba3b
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          target-commitish: ${{ github.sha }}
          tag: ${{ steps.compute-tag.outputs.output }}
          binary-contents: ${{ steps.compute-path.outputs.output }}