ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# Runner image is pinned (ubuntu-latest moves to Ubuntu 26 on 2026-10-19); bump it deliberately.
env:
  GODOT_VERSION: 4.7.1-stable
  PROJECT: hoppys-adventure-arcade

jobs:
  godot-tests:
    name: godot-tests
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Cache Godot
        id: cache-godot
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/godot
          key: godot-${{ env.GODOT_VERSION }}-linux-x86_64

      - name: Download Godot
        if: steps.cache-godot.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/godot
          curl -fsSL -o /tmp/godot.zip \
            "https://github.com/godotengine/godot-builds/releases/download/${GODOT_VERSION}/Godot_v${GODOT_VERSION}_linux.x86_64.zip"
          unzip -q /tmp/godot.zip -d ~/godot
          mv ~/godot/Godot_v${GODOT_VERSION}_linux.x86_64 ~/godot/godot

      - name: Cache imported resources
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ env.PROJECT }}/.godot
          key: godot-import-${{ env.GODOT_VERSION }}-${{ hashFiles('hoppys-adventure-arcade/project.godot', 'hoppys-adventure-arcade/**/*.import') }}
          # A stale cache is safe: Godot reimports any source whose hash changed.
          restore-keys: godot-import-${{ env.GODOT_VERSION }}-

      # The runner imports first (failing on any engine error), then runs every tests/**/*.gd;
      # tools/tests/suites.toml lists the few skipped or serial suites and why.
      - name: Import and run headless suites
        run: python3 tools/tests/run_tests.py --godot ~/godot/godot --jobs 4

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: test-results
          path: build/test-results/
          retention-days: 7
          if-no-files-found: ignore

      # Quits from the hub, fights, the Code City celebration, the runner intro and mid-transition
      # with their audio playing. Godot prints its exit-leak lines only after the script is gone,
      # so the wrapper runs tests/exit_leak.gd once per scenario, fails on them and times the exit.
      - name: Exit leaks
        run: python3 tools/checks/exit_leak.py --godot ~/godot/godot

  lint:
    name: lint
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - run: pip install ruff gdtoolkit==4.*
      - name: Ruff (tools)
        run: ruff check tools hoppys-adventure-arcade/tools
      - name: Test runner unit tests
        run: python -m unittest discover -s tools/tests -v
      # Advisory until the existing code is formatted; make it blocking afterwards.
      - name: gdlint (advisory)
        continue-on-error: true
        run: gdlint hoppys-adventure-arcade
      # The same check runs locally in .githooks/pre-commit, so most problems never get pushed.
      - name: No local paths or internal links
        run: python tools/checks/repo_hygiene.py --all
      - name: Release packaging unit tests
        run: python -m unittest discover -s tools/build -v
      - name: Hygiene checker unit tests
        run: python -m unittest discover -s tools/checks -v
      # Vendored add-ons are exact copies of a tagged upstream release (tools/vendor/vendor.lock.json).
      - name: Vendored add-ons match their lock
        run: python tools/vendor/vendor_lock.py --check
      - name: Vendor lock unit tests
        run: python -m unittest discover -s tools/vendor -v
      - name: Booth tools unit tests
        run: python -m unittest discover -s tools/booth -v
      - name: Shellcheck booth scripts
        run: |
          command -v shellcheck >/dev/null || sudo apt-get install -y shellcheck
          shellcheck tools/booth/watchdog.sh tools/booth/macos/setup.sh
      # The credits screen shows tools/credits/build_credits.py's output; it must match the table.
      - name: Credits match ASSETS_LICENSES.md
        run: python tools/credits/build_credits.py --check
      - name: Credits unit tests
        run: python -m unittest discover -s tools/credits -v

  gitleaks:
    name: gitleaks
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Scan for secrets
        env:
          GITLEAKS_VERSION: 8.30.1
        run: |
          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | tar -xz -C /tmp gitleaks
          /tmp/gitleaks git --redact --verbose .