pr.yml

name: PR Validation

on:
  pull_request:
    branches: [develop]
  workflow_dispatch: # checkov:skip=CKV_GHA_7:Input only used to select PR for validation, does not affect build output
    inputs:
      pull_request_number:
        description: "Pull Request Number"
        required: true
        type: number

permissions: {}

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      checks: write
      contents: write
      pull-requests: write

    steps:
      - name: Get PR details
        id: pr-details
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            echo "Fetching details for PR #$PR_NUMBER"

            PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName,headRepository,author)
            HEAD_REF=$(echo "$PR_DATA" | jq -r '.headRefName')
            AUTHOR_LOGIN=$(echo "$PR_DATA" | jq -r '.author.login')
            HEAD_REPO=$(echo "$PR_DATA" | jq -r '.headRepository.nameWithOwner')

            {
              echo "head_ref=$HEAD_REF"
              echo "author_login=$AUTHOR_LOGIN"
              echo "head_repo=$HEAD_REPO"
            } >> "$GITHUB_OUTPUT"
          else
            {
              echo "head_ref=$PR_HEAD_REF"
              echo "author_login=$PR_AUTHOR_LOGIN"
              echo "head_repo=$PR_HEAD_REPO"
            } >> "$GITHUB_OUTPUT"
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          EVENT_NAME: ${{ github.event_name }}
          PR_NUMBER: ${{ inputs.pull_request_number }}
          REPO: ${{ github.repository }}
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
          PR_AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Check out repository
        uses: actions/checkout@v6
        with:
          ref: ${{ steps.pr-details.outputs.head_ref }}
          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
          fetch-depth: 0

      - name: Run MegaLinter
        id: ml
        uses: oxsecurity/megalinter/flavors/dotnetweb@v9
        env:
          VALIDATE_ALL_CODEBASE: false
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LLM_ADVISOR_ENABLED: >-
            ${{
              steps.pr-details.outputs.author_login != 'dependabot[bot]' &&
              steps.pr-details.outputs.author_login != 'github-actions[bot]' &&
              !startsWith(steps.pr-details.outputs.author_login, 'dependabot')
            }}

      - name: Upload lint reports
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: Lint Report
          path: |
            megalinter-reports
            mega-linter.log

      - name: Prepare git directory
        if: >-
          steps.ml.outputs.has_updated_sources == 1 &&
          steps.pr-details.outputs.head_repo == github.repository
        run: sudo chown -Rc $UID .git/

      - name: Commit and push MegaLinter fixes
        if: >-
          steps.ml.outputs.has_updated_sources == 1 &&
          steps.pr-details.outputs.head_repo == github.repository
        run: |
          git config user.name "megalinter-bot"
          git config user.email "129584137+megalinter-bot@users.noreply.github.com"

          if [[ -n $(git status -s) ]]; then
            git add .
            git commit -m "Apply lint fixes"

            for i in {1..4}; do
              if git push; then
                echo "✅ MegaLinter fixes pushed successfully"
                break
              else
                if [[ "$i" -lt 4 ]]; then
                  WAIT_TIME=$((2 ** i))
                  echo "⚠️ Push failed, retrying in ${WAIT_TIME}s..."
                  sleep "$WAIT_TIME"
                else
                  echo "❌ Push failed after 4 attempts"
                  exit 1
                fi
              fi
            done
          else
            echo "ℹ️ No MegaLinter changes to commit"
          fi

  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      checks: write
      contents: write
      pull-requests: write

    steps:
      - name: Get PR details
        id: pr-details
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            echo "Fetching details for PR #$PR_NUMBER"

            PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName)
            HEAD_REF=$(echo "$PR_DATA" | jq -r '.headRefName')

            echo "head_ref=$HEAD_REF" >> "$GITHUB_OUTPUT"
          else
            echo "head_ref=$PR_HEAD_REF" >> "$GITHUB_OUTPUT"
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          EVENT_NAME: ${{ github.event_name }}
          PR_NUMBER: ${{ inputs.pull_request_number }}
          REPO: ${{ github.repository }}
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}

      - name: Check out repository
        uses: actions/checkout@v6
        with:
          ref: ${{ steps.pr-details.outputs.head_ref }}

      - name: Set up .NET SDK
        uses: actions/setup-dotnet@v5

      - name: Run build
        run: dotnet run

      - name: Upload output
        uses: actions/upload-artifact@v5
        with:
          name: Generated Site
          path: output/
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}