ci-pr-only.yml

name: CI PR Only
# Jobs that run on PRs, but no other pipelines

on:
  workflow_call:
    inputs:
      commit-sha:
        description: The commit sha to run the CI on
        required: true
        type: string
      base-ref:
        description: The base branch of the PR
        required: false
        default: ${{ github.event.pull_request.base.ref }}
        type: string
      pr-number:
        description: 'The PR number'
        required: false
        default: ${{ github.event.pull_request.number }}
        type: string

env:
  CI_PROJECT_DIR: ${{ github.workspace }}
  ORG: ${{ github.repository_owner }}

jobs:

  # Run didc compatibility checks against the merge base
  didc_checks:
    name: Candid compatibility checks
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'CI_OVERRIDE_DIDC_CHECK') }}
    runs-on: &dind-small-setup
      labels: dind-small
    container: &container-setup
      image: ghcr.io/dfinity/ic-build@sha256:ea590bb4afc6c513a93f3cdd4e1a370babe068fea9650033dcea03859eb95afe
      options: >-
         -e NODE_NAME --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # Ensures we fetch the merge-base, which we compare against
          fetch-depth: 0
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || inputs.commit-sha }}
      - name: Run candid compatibility checks
        uses: ./.github/actions/bazel
        with:
          run: |
            export DID_CHECK_REV="$(git merge-base HEAD 'origin/${{ inputs.base-ref }}')"
            echo "DID_CHECK_REV=$DID_CHECK_REV"
            bazel test //... \
              --build_tag_filters="didc" \
              --test_tag_filters="didc"
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

# Runs linters and formatters on code to automatically fix issues
  autofix:
    name: Autofix
    runs-on: *dind-small-setup
    container: *container-setup
    timeout-minutes: 30
    steps:
      - name: Create GitHub App Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.PR_CREATION_BOT_APP_ID }}
          private-key: ${{ secrets.PR_CREATION_BOT_PRIVATE_KEY }}
      - &checkout-with-token
        name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || inputs.commit-sha }}
          token: ${{ steps.app-token.outputs.token }}
      - name: Run Linter
        id: linter
        uses: ./.github/actions/bazel
        with:
          run: |
            set -euo pipefail

            EXIT_STATUS=0

            bazel run :buildifier
            bazel run :shfmt-format
            bazel run :ruff-format
            bazel run :rustfmt
            bazel run :gazelle

            git add --all
            git status
            if ! git diff --cached --quiet; then
                # There are some changes staged
                git config --global user.email "infra+github-automation@dfinity.org"
                git config --global user.name "IDX GitHub Automation"
                git commit -m "Automatically fixing code for linting and formatting issues"
                git push

                # Because the buildifier made changes, fail the PR
                EXIT_STATUS=1
            fi

            exit "${EXIT_STATUS}"

  bazel-build-fuzzers-archives:
    name: Bazel Build Fuzzers Archives
    runs-on: &dind-large-setup
      labels: dind-large
    container: *container-setup
    timeout-minutes: 90
    steps:
      - &checkout
        name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.commit-sha }}
      - name: Filter Relevant Files
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: filter
        with:
          ref: ${{ inputs.commit-sha }}
          filters: |
            fuzzers:
              - '.github/workflows/ci-pr-only.yml'
              - 'bin/fuzzing/build-all-fuzzers.sh'
              - 'bazel/fuzz_testing.bzl'
      - name: Run Bazel Build Fuzzers Archives
        id: bazel-build-fuzzers-archives
        if: steps.filter.outputs.fuzzers == 'true'
        shell: bash
        run: |
          set -euo pipefail
          cd "${GITHUB_WORKSPACE}"/bin/fuzzing/
          ./build-all-fuzzers.sh --zip

  lock-generate:
    name: Lock Generate
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Create GitHub App Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.PR_CREATION_BOT_APP_ID }}
          private-key: ${{ secrets.PR_CREATION_BOT_PRIVATE_KEY }}
      - *checkout-with-token
      - name: Filter Relevant Files
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: filter
        with:
          ref: ${{ inputs.commit-sha }}
          filters: |
            lock-generate:
              - '.github/workflows/ci-pr-only.yml'
              - '.bazelrc'
              - '.bazelversion'
              - '**/*.bazel'
              - '**/*.bzl'
              - '**/*.lock'
              - '**/*.rs'
              - '**/*.toml'
      - name: Run Lock Generate
        id: lock-generate
        if: steps.filter.outputs.lock-generate == 'true'
        run: ./ci/scripts/lock-generate.sh

  generate-config-fixtures:
    name: Generate Config Fixtures
    runs-on: ubuntu-latest
    container: *container-setup
    timeout-minutes: 30
    steps:
      - name: Create GitHub App Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.PR_CREATION_BOT_APP_ID }}
          private-key: ${{ secrets.PR_CREATION_BOT_PRIVATE_KEY }}
      - *checkout-with-token
      - name: Filter Relevant Files
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: filter
        with:
          ref: ${{ inputs.commit-sha }}
          filters: |
            generate-config-fixtures:
              - '.github/workflows/ci-pr-only.yml'
              - 'rs/ic_os/config_types/**'
      - name: Run Generate Config Fixtures
        id: generate-config-fixtures
        if: steps.filter.outputs.generate-config-fixtures == 'true'
        run: ./ci/scripts/generate-config-fixtures.sh

  dependencies-check:
    name: Dependency Scan for PR
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
      pull-requests: write
    env:
      SHELL_WRAPPER: "/usr/bin/time"
      CARGO_AUDIT_VERSION: "0.22.0"
      CI_MERGE_REQUEST_IID: ${{ inputs.pr-number }}
      CI_PROJECT_PATH: ${{ github.repository }}
      CI_PIPELINE_ID: ${{ github.run_id }}
      CI_COMMIT_SHA: ${{ inputs.commit-sha }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
      SLACK_PSEC_BOT_OAUTH_TOKEN: ${{ secrets.SLACK_PSEC_BOT_OAUTH_TOKEN }}
      REPO_NAME: ${{ github.repository }}
    steps:
      - *checkout
      - name: Filter Relevant Files
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: filter
        with:
          ref: ${{ inputs.commit-sha }}
          filters: |
            depcheck:
              - '.github/workflows/ci-pr-only.yml'
              - 'bazel/rust.MODULE.bazel'
              - '**/*.lock'
              - '**/*.toml'
      - name: Set up Python
        uses: actions/setup-python@v5
        if: steps.filter.outputs.depcheck == 'true'
        with:
          python-version: "3.12"
      - name: Setup environment deps
        id: setup-environment-deps
        if: steps.filter.outputs.depcheck == 'true'
        shell: bash
        run: |
          # Ignore externally-managed-environment pip error, install packages system-wide.
          PIP_BREAK_SYSTEM_PACKAGES=1 pip3 install --ignore-installed -r requirements.txt
          cargo install cargo-audit --version "${CARGO_AUDIT_VERSION}"
      - name: Dependency Scan for Pull Request
        id: dependencies-check
        if: steps.filter.outputs.depcheck == 'true'
        shell: bash
        run: |
          set -euo pipefail
          export PYTHONPATH=$PWD/ci/src:$PWD/ci/src/dependencies
          cd ci/src/dependencies/
          $SHELL_WRAPPER python3 job/bazel_rust_ic_scanner_merge_job.py

  # CI job is also executed in Schedule Hourly
  bazel-test-coverage:
    name: Bazel Test Coverage
    runs-on: *dind-large-setup
    container: *container-setup
    timeout-minutes: 90
    if: contains(github.event.pull_request.labels.*.name, 'CI_COVERAGE')
    permissions:
      contents: read
      pull-requests: read
    steps:
      - *checkout
      - name: Run Bazel Test Coverage
        shell: bash
        run: |
          ./ci/scripts/bazel-coverage.sh
      - name: Upload bazel-coverage
        uses: actions/upload-artifact@v4
        with:
          name: bazel-coverage
          retention-days: 1
          if-no-files-found: ignore
          compression-level: 9
          path: |
            cov_html.zip