pull-request.yml

# Validation for pull requests.
#
# Deliberately does no signing and publishes nothing: anything touching the code-signing
# certificate runs in Azure Pipelines, because this repository is public and so are these
# logs. See docs/decisions.md, decision 3.
#
# Azure Pipelines only builds after a merge, so this is what stops a broken installer or a
# failing build reaching main - where every merge publishes a pre-release.
name: Pull request

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

# A new push to the same pull request supersedes the run already in flight.
concurrency:
  group: pull-request-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # The jobs below always run so that they always report a status - required checks that are
  # skipped entirely can leave a pull request waiting forever. When nothing they cover has
  # changed they finish in seconds instead.
  changes:
    name: Detect what changed
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.filter.outputs.code }}
      vscode: ${{ steps.filter.outputs.vscode }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - id: filter
        shell: bash
        run: |
          files=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD")
          echo "Changed files:"
          echo "$files" | sed 's/^/  /'
          if echo "$files" | grep -qE '^vscode/'; then
            echo "vscode=true" >> "$GITHUB_OUTPUT"
            echo "-> vscode extension changed"
          else
            echo "vscode=false" >> "$GITHUB_OUTPUT"
          fi
          if echo "$files" | grep -qvE '^(site/|docs/|vscode/|[^/]*\.md$)'; then
            echo "code=true" >> "$GITHUB_OUTPUT"
            echo "-> building: something outside site/, docs/, vscode/ and top-level markdown changed"
          else
            echo "code=false" >> "$GITHUB_OUTPUT"
            echo "-> nothing to build: only the site, docs, vscode extension or markdown changed"
          fi

  # Release notes are written while the change is fresh, in the pull request that bumps the
  # version, rather than remembered under pressure once the release is already public. The
  # release itself is checked again in publish-site.yml.
  notes:
    name: Release notes
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Check the version bump brings its notes
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Set-StrictMode -Version Latest

          $base = "origin/$env:BASE_REF"
          function Get-VersionPrefix([string]$text) {
              if ($text -match '<VersionPrefix>(.*?)</VersionPrefix>') { return $Matches[1].Trim() }
              return ''
          }

          $before = Get-VersionPrefix (git show "${base}:Directory.Build.props" | Out-String)
          $after = Get-VersionPrefix (Get-Content Directory.Build.props -Raw)

          if ($before -eq $after) {
              Write-Host "VersionPrefix is unchanged at $after, so no new notes are due."
              return
          }

          Write-Host "VersionPrefix goes $before -> $after."
          ./scripts/release-notes.ps1 -Mode Verify -Version $after
        env:
          BASE_REF: ${{ github.base_ref }}

  build:
    name: Build and test
    needs: changes
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
        if: needs.changes.outputs.code == 'true'

      - uses: actions/setup-dotnet@v5
        if: needs.changes.outputs.code == 'true'
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        if: needs.changes.outputs.code == 'true'
        run: dotnet restore Whiteboard.sln

      # TreatWarningsAsErrors is on for every project, so a warning fails here.
      - name: Build
        if: needs.changes.outputs.code == 'true'
        run: dotnet build Whiteboard.sln --configuration Release --no-restore

      - name: Core smoke tests
        if: needs.changes.outputs.code == 'true'
        run: >-
          dotnet run
          --project tests/SQLBI.Whiteboard.Core.SmokeTests/SQLBI.Whiteboard.Core.SmokeTests.csproj
          --configuration Release

      # The highlighting adapter runs on AvalonEdit, so its tests need WPF.
      - name: Application smoke tests
        if: needs.changes.outputs.code == 'true'
        run: >-
          dotnet run
          --project tests/SQLBI.Whiteboard.SmokeTests/SQLBI.Whiteboard.SmokeTests.csproj
          --configuration Release

  installer:
    name: Build installers
    needs: changes
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
        if: needs.changes.outputs.code == 'true'

      - uses: actions/setup-dotnet@v5
        if: needs.changes.outputs.code == 'true'
        with:
          dotnet-version: '10.0.x'

      # Catches WiX authoring errors here rather than after a merge, when Azure Pipelines
      # would sign and publish. Unsigned, and the output is discarded; the version is a
      # placeholder with no meaning.
      #
      # Deliberately smaller than what ships, because this job is almost entirely CAB
      # compression and none of that compression is what needs validating:
      #
      #   -SelfContained false  packages the framework-dependent build, a payload of roughly
      #                         15 MB rather than 252 MB. The same authoring and the same file
      #                         harvesting run over it.
      #   -Variants             builds a diagonal pair. The four variants are not repetition -
      #                         they are four paths through the <?if?> branches in
      #                         installer/wix/SQLBI.Whiteboard.wxs - but this pair still takes
      #                         both sides of every conditional, so a typo in the dev branch or
      #                         a broken per-user directory is still caught.
      #
      # Azure Pipelines builds all four variants self-contained on every merge to main, so
      # what is skipped here is still checked before anything is signed or published.
      - name: Build installers
        if: needs.changes.outputs.code == 'true'
        shell: pwsh
        run: >-
          ./scripts/build-installer.ps1
          -Version 0.0.0
          -SelfContained false
          -Variants stable/perMachine,dev/perUser

  vscode:
    name: VS Code extension
    needs: changes
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        if: needs.changes.outputs.vscode == 'true'

      - uses: actions/setup-node@v5
        if: needs.changes.outputs.vscode == 'true'
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: vscode/sqlbi-whiteboard/package-lock.json

      - name: Compile and test
        if: needs.changes.outputs.vscode == 'true'
        working-directory: vscode/sqlbi-whiteboard
        run: |
          npm ci
          npm test