ci.yml

name: CI
on:
  push:

concurrency:
  group: ${{ format('{0}-{1}-{2}', github.workflow, github.ref, github.ref == 'refs/heads/main' && github.sha || 'HEAD') }}
  cancel-in-progress: true

env:
  # -Xallow-any-scripts-in-source-roots: https://youtrack.jetbrains.com/issue/KT-62575
  # -Werror: be strict
  # -progressive: use latest features
  # TODEL https://youtrack.jetbrains.com/issue/KT-68681
  # -language-version=1.9: workaround to keep working on GHA without installation of specific Kotlin version.
  # TODO turn progressive back on, it was disabled due to to the below workaround.
  # warning: '-progressive' is meaningful only for the latest language version (2.0), while this build uses 1.9
  # Compiler behavior in such mode is undefined; please, consider moving to the latest stable version or turning off progressive mode.
  KOTLINC: kotlinc -Xallow-any-scripts-in-source-roots -Werror -language-version=1.9

jobs:

  validate:
    name: "🦺 Validation"
    uses: TWiStErRob/github-workflows/.github/workflows/validate.yml@1e06403c5d561d70e40109c2701ea3092ca6ded7 # v3
    permissions:
      contents: read
      security-events: write
      actions: read


  git-merged-branches:
    name: "🔨 Build / GIT / Merged Branches"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/git/merged-branches
        shell: bash
        run: $KOTLINC find-merged-branches.main.kts


  github-draft-issues:
    name: "🔨 Build / GitHub / Draft Issues"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/github/project-manage-draft-issues
        shell: bash
        run: $KOTLINC manage-draft-issues.main.kts


  github-repository-convention:
    name: "🔨 Build / GitHub / Repository Convention"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/github/repository-convention
        shell: bash
        run: $KOTLINC validate.main.kts


  github-user-contribs:
    name: "🔨 Build / GitHub / User Contributions"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/github/user-contribs
        shell: bash
        run: >
          $KOTLINC
          get.main.kts
          summarize.main.kts


  google-play-reviews:
    name: "🔨 Build / Google / GMail / Google Play Store reviews"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/google/gmail-play-reviews
        shell: bash
        run: $KOTLINC reviews.main.kts


  notion-import-data:
    name: "🔨 Build / Notion / Import Data"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/notion/import-data
        shell: bash
        run: >
          $KOTLINC
          notion-import-csv.main.kts
          notion-import-dev-summit.main.kts
          notion-import-droidcon.main.kts
          siliconmilkroundabout/companies-attending.main.kts


  notion-filter-content:
    name: "🔨 Build / Notion / Filter Content"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/notion/database-filter-page-content
        shell: bash
        run: $KOTLINC filter-content.main.kts


  notion-move-to-property:
    name: "🔨 Build / Notion / Move to Property"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/notion/page-section-move-to-property
        shell: bash
        run: $KOTLINC notion-move-to-property.main.kts


  lastpass2google:
    name: "🔨 Build / Special / LastPass 2 Google migration"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Compile .main.kts."
        working-directory: scripts/special/lastpass2google-migration
        shell: bash
        run: $KOTLINC pass.main.kts


  pst-maildir:
    name: "🔨 Build & Check / PST to Maildir migration"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read

    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash

    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Prepare test data."
        working-directory: scripts/special/pst-maildir-imap
        run: unzip test.zip -d test/

      - name: "Build pst2maildir image."
        working-directory: scripts/special/pst-maildir-imap
        run: docker build --tag pst2maildir .

      - name: "Find user."
        id: id
        run: |
          echo "uid=$(id --user)" >> "${GITHUB_OUTPUT}"
          echo "gid=$(id --group)" >> "${GITHUB_OUTPUT}"

      - name: "Run test migration in container."
        uses: addnab/docker-run-action@v3
        with:
          image: pst2maildir
          options: |
            --rm
            --volume ${{ github.workspace }}/scripts/special/pst-maildir-imap:/workdir
          run: |
            set -e
            cd /workdir
            readpst -o test/ test/test.pst
            mkdir -p test/Inbox/
            perl ./mbox2maildir.pl test/Inbox.mbox test/Inbox/ ${{ steps.id.outputs.uid }} ${{ steps.id.outputs.gid }}
            find test/Inbox/ -type f -exec python3 fix_maildir_mail_mtime.py "{}" \;
            find test/ -type f -exec chmod +r "{}" \;

      - name: "Validate migrated maildir output."
        working-directory: scripts/special/pst-maildir-imap/test
        run: |
          head Inbox.mbox
          ls -la Inbox/cur/*.mbox*
          find Inbox/cur/ -type f -exec head "{}" \;

      - name: "Prepare 'pst2maildir test' artifact."
        if: ${{ success() || failure() }}
        working-directory: scripts/special/pst-maildir-imap/test
        run: |
          # Compress Inbox/ because it contains strange characters in the filenames.
          # > Error: Artifact path is not valid: /Inbox/cur/1677516690.12.mbox:2,S. Contains the following character:  Colon :
          # > Invalid characters include:  Double quote ", Colon :, Less than <, Greater than >, Vertical bar |, Asterisk *, Question mark ?, Carriage return \r, Line feed \n
          # > The following characters are not allowed in files that are uploaded due to limitations with certain file systems such as NTFS.
          # > To maintain file system agnostic behavior, these characters are intentionally not allowed to prevent potential problems with downloads on different file systems.
          tar -f pst2maildir-inbox.tar -c Inbox/ --remove-files

      - name: "Upload 'pst2maildir test' artifact."
        if: ${{ success() || failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: 'pst2maildir test'
          if-no-files-found: error
          path: scripts/special/pst-maildir-imap/test/


  svn2git-migration:
    name: "🔨 Build & Check / SVN to GIT migration"
    timeout-minutes: 5

    permissions:
      # actions/checkout
      contents: read

    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash

    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Create test repository."
        working-directory: scripts/special/svn2git-migration
        run: |
          mkdir workdir
          cd workdir
          
          svnadmin create test-repository
          echo "SVN_REPO=$(pwd)/test-repository" >> "${GITHUB_ENV}"
          
          svn co file://$(pwd)/test-repository test-checkout
          cd test-checkout
          
          echo "test" > test.txt
          svn add test.txt
          echo -e "Test Project\n[IMP] Initial import" > commit.message
          svn commit --file commit.message test.txt
          svn update
          svn info
          svn log

      - name: "Set up migration configuration."
        working-directory: scripts/special/svn2git-migration
        run: |
          echo "$(whoami) = Test User <test@test.test>" > conf/migrate.authors
          cat conf/migrate.authors

      - name: "Build svn2git image."
        working-directory: scripts/special/svn2git-migration
        run: |
          # TODO use clone with tag and remove checkout when there's a release.
          #git clone https://github.com/svn-all-fast-export/svn2git.git -b 1.0.19
          git clone https://github.com/svn-all-fast-export/svn2git.git
          cd svn2git
          git checkout 068dd31d601d81bca5bb4bc44357cda549db3150
          docker build --tag svn2git .

      - name: "Run test migration in container."
        uses: addnab/docker-run-action@v3
        with:
          image: svn2git
          options: |
            --rm
            --volume ${{ github.workspace }}/scripts/special/svn2git-migration/conf:/tmp/conf
            --volume ${{ github.workspace }}/scripts/special/svn2git-migration/workdir:/workdir
            --volume ${{ env.SVN_REPO }}:/tmp/svn
          run: |
            set -e
            
            svn relocate file:///tmp/svn test-checkout
            
            /usr/local/svn2git/svn-all-fast-export \
            --identity-map /tmp/conf/migrate.authors \
            --rules /tmp/conf/monorepo-all.rules \
            --debug-rules \
            --stats \
            --svn-ignore \
            --propcheck \
            --empty-dirs \
            --add-metadata \
            --add-metadata-notes \
            --msg-filter 'sed --zero-terminated --regexp-extended --file=/tmp/conf/svn-msg-filter.sed' \
            /tmp/svn \
            >svn2git.log 2>&1

      - name: "Validate migrated git output."
        working-directory: scripts/special/svn2git-migration/workdir
        run: |
          git clone svn.git
          cd svn
          git log --no-decorate | grep -v -E 'Date:|commit' > actual-git-log.txt
          cat > expected-git-log.txt <<- EOF
          	Author: Test User <test@test.test>
          	
          	    [SVN] r1 Test Project in /
          	    [IMP] Initial import
          EOF
          diff expected-git-log.txt actual-git-log.txt

      - name: "Upload 'svn2git test' artifact."
        if: ${{ success() || failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: 'svn2git test'
          if-no-files-found: error
          path: scripts/special/svn2git-migration/workdir/


  gradle-init:
    name: "🔨 Build / Gradle init scripts"
    timeout-minutes: 5
    permissions:
      # actions/checkout
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Setup Gradle."
        uses: gradle/actions/setup-gradle@v4
        with:
          gradle-version: ${{ matrix.gradle }}
          cache-disabled: true
          add-job-summary: on-failure

      - name: "Run Gradle build."
        env:
          GRADLE_USER_HOME: ${{ github.workspace }}/config/gradle
        working-directory: config/gradle/init.d/test
        shell: bash
        # Explicitly not using the wrapper, want to test different versions.
        run: gradle
    strategy:
      fail-fast: false
      matrix:
        gradle:
          - '5.6.4'
          - '6.0.1'
          - '6.1.1'
          - '6.2.2'
          - '7.6.4'
          - '8.0.2'
          - '8.7'
          - '8.8'


  detekt:
    name: "🔍 Static Checks / Detekt"
    timeout-minutes: 5
    permissions:
      # actions/checkout, gh release download
      contents: read
      # github/codeql-action/upload-sarif
      security-events: write
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Run detekt."
        env:
          # Use https://github.com/detekt/detekt
          DETEKT_VERSION: '1.23.7'
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          gh release download "v${DETEKT_VERSION?}" --repo detekt/detekt --pattern "detekt-cli-*.zip" --output detekt-cli.zip
          unzip "detekt-cli.zip"
          detekt="./detekt-cli-${DETEKT_VERSION?}/bin/detekt-cli"
          "${detekt}" --version
          "${detekt}" \
              --all-rules \
              --max-issues 0 \
              --base-path "${GITHUB_WORKSPACE}" \
              --report sarif:detekt.sarif \
              --report txt:detekt.txt \
              --report html:detekt.html \
              --report xml:detekt.xml \
              --report md:detekt.md \

      - name: "Upload 'Detekt Results' artifact."
        if: ${{ success() || failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: 'Detekt Results'
          if-no-files-found: error
          path: detekt.*

      - name: "Publish 'Code scanning results / detekt'."
        uses: github/codeql-action/upload-sarif@v3
        if: ${{ success() || failure() }}
        with:
          sarif_file: ${{ github.workspace }}/detekt.sarif


  shellcheck:
    name: "🔍 Static Checks / ShellCheck"
    timeout-minutes: 5

    permissions:
      # actions/checkout, gh release download
      contents: read
      # github/codeql-action/upload-sarif
      security-events: write

    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash

    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Run shellcheck."
        env:
          # Use https://github.com/koalaman/shellcheck
          SHELLCHECK_VERSION: '0.10.0'
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download "v${SHELLCHECK_VERSION?}" --repo koalaman/shellcheck --pattern "shellcheck-v*.linux.x86_64.tar.xz"
          tar --extract --xz --verbose --file shellcheck-v*.linux.x86_64.tar.xz
          shellcheck="./shellcheck-v${SHELLCHECK_VERSION?}/shellcheck"
          "${shellcheck}" --version
          
          # `shellcheck **.{sh}`, but without globbing.
          find "${GITHUB_WORKSPACE}" -type f \( -name '*.sh' \) \
              -exec "${shellcheck}" --enable=all --severity=style --shell=sh --check-sourced --external-sources --format=json {} + \
              > shellcheck.json
          
          # The previous command will fail if violations are found, careful putting more commands here.

      - name: "Convert shellcheck JSON output to SARIF."
        if: ${{ success() || failure() }}
        env:
          # Use https://github.com/psastras/sarif-rs
          SHELLCHECK_SARIF_VERSION: '0.6.6'
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download "shellcheck-sarif-v${SHELLCHECK_SARIF_VERSION?}" --repo psastras/sarif-rs --pattern "shellcheck-sarif-x86_64-unknown-linux-gnu" --output shellcheck-sarif
          chmod +x shellcheck-sarif
          
          # Relativize paths in the shellcheck JSON output, so in turn the SARIF output is relative too.
          sed --in-place --expression="s#\"file\":\"${GITHUB_WORKSPACE}/#\"file\":\"#g" shellcheck.json
          
          ./shellcheck-sarif < shellcheck.json > shellcheck.sarif

      - name: "Pretty-print SARIF output."
        if: ${{ success() || failure() }}
        env:
          # Use https://github.com/psastras/sarif-rs
          SARIF_FMT_VERSION: '0.6.6'
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download "sarif-fmt-v${SARIF_FMT_VERSION?}" --repo psastras/sarif-rs --pattern "sarif-fmt-x86_64-unknown-linux-gnu" --output sarif-fmt
          chmod +x sarif-fmt
          
          ./sarif-fmt < shellcheck.sarif | tee shellcheck.sarif.txt

      - name: "Upload 'ShellCheck Results' artifact."
        if: ${{ success() || failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: 'ShellCheck Results'
          if-no-files-found: error
          path: shellcheck.*

      - name: "Publish 'Code scanning results / shellcheck'."
        if: ${{ success() || failure() }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ github.workspace }}/shellcheck.sarif


  psscriptanalyzer:
    name: "🔍 Static Checks / PSScriptAnalyzer"
    timeout-minutes: 5

    permissions:
      # actions/checkout
      contents: read
      # github/codeql-action/upload-sarif
      security-events: write

    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} branch in ${{ github.repository }} repository."
        uses: actions/checkout@v4

      - name: "Run PSScriptAnalyzer."
        uses: microsoft/psscriptanalyzer-action@v1.1
        with:
          path: ${{ github.workspace }}\
          recurse: true
          output: PSScriptAnalyzer.sarif
          # Not a yaml array, used directly inside a PowerShell array @(...) when invoking analyzer.
          excludeRule: '"PSAvoidUsingWriteHost"'

      - name: "Upload 'PSScriptAnalyzer Results' artifact."
        if: ${{ success() || failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: 'PSScriptAnalyzer Results'
          if-no-files-found: error
          path: PSScriptAnalyzer.*

      - name: "Publish 'Code scanning results / PSScriptAnalyzer'."
        if: ${{ success() || failure() }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ github.workspace }}/PSScriptAnalyzer.sarif