test.yaml

---
name: test

on: pull_request

permissions: {}

jobs:
  path-filter:
    # Get changed files to filter jobs
    outputs:
      update-aqua-checksums: ${{steps.changes.outputs.update-aqua-checksums}}
      renovate-config-validator: ${{steps.changes.outputs.renovate-config-validator}}
      ghalint: ${{steps.changes.outputs.ghalint}}
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: dorny/paths-filter@v2
        id: changes
        with:
          filters: |
            update-aqua-checksums:
              - aqua.yaml
              - aqua/*.yaml
              - aqua-checksums.json
              - .github/workflows/test.yaml
            renovate-config-validator:
              - renovate.json5
            validate:
              - "*.json"
            ghalint:
              - .github/workflows/*.yaml
              - aqua/ghalint.yaml

  update-aqua-checksums:
    # Update aqua-checksums.json and push a commit
    needs: path-filter
    if: needs.path-filter.outputs.update-aqua-checksums == 'true'
    uses: aquaproj/update-checksum-workflow/.github/workflows/update-checksum.yaml@9ccbd9ade4e8b92b0dd5757cacf6cd3ebcf7d876 # v0.1.8
    permissions:
      contents: read
    with:
      aqua_version: v2.6.0
      prune: true
    secrets:
      gh_app_id: ${{secrets.APP_ID}}
      gh_app_private_key: ${{secrets.APP_PRIVATE_KEY}}

  renovate-config-validator:
    # Validate Renovate Configuration by renovate-config-validator.
    uses: suzuki-shunsuke/renovate-config-validator-workflow/.github/workflows/validate.yaml@4a378742d05b4e67aae34039d7c779ac913cd79d # v0.2.3
    needs: path-filter
    if: needs.path-filter.outputs.renovate-config-validator == 'true'
    permissions:
      contents: read

  enable-automerge:
    # Enable automerge to merge pull requests from Renovate automatically.
    runs-on: ubuntu-latest
    needs:
      - status-check
    permissions:
      contents: write # For enable automerge
      pull-requests: write # For enable automerge
    if: |
      ! failure() && ! cancelled() && github.event.pull_request.user.login == 'renovate[bot]' && contains(github.event.pull_request.body, ' **Automerge**: Enabled.')
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
        with:
          app_id: ${{secrets.APP_ID}}
          private_key: ${{secrets.APP_PRIVATE_KEY}}
      - run: gh -R "$GITHUB_REPOSITORY" pr merge --squash --auto --delete-branch "$PR_NUMBER"
        env:
          GITHUB_TOKEN: ${{steps.generate_token.outputs.token}} # Use GitHub App to trigger GitHub Actions Workflow by merge commit.
          PR_NUMBER: ${{github.event.pull_request.number}}

  validate-presets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
      - uses: aquaproj/aqua-installer@928a2ee4243a9ee8312d80dc8cbaca88fb602a91 # v2.2.0
        with:
          aqua_version: v2.6.0
      - run: ci-info run | sed "s/^export //" >> "$GITHUB_ENV"
        env:
          GITHUB_TOKEN: ${{ github.token }}
      - run: |
          grep -E "^[^/]+\.json$" "$CI_INFO_TEMP_DIR/pr_all_filenames.txt" | grep -v aqua-checksums.json | while read -r file; do
            if [ -f "$file" ]; then
              RENOVATE_CONFIG_FILE="$file" npx --package renovate -c renovate-config-validator
            fi
          done

  status-check:
    # This job is used for main branch's branch protection rule's status check.
    # If all dependent jobs succeed or are skipped this job succeeds.
    runs-on: ubuntu-latest
    needs:
      - update-aqua-checksums
      - validate-presets
      - renovate-config-validator
      - ghalint
      - jsonnet
    permissions: {}
    if: failure()
    steps:
      - run: exit 1

  ghalint:
    # Validate GitHub Actions Workflows by ghalint.
    needs: path-filter
    if: needs.path-filter.outputs.ghalint == 'true'
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
      - uses: aquaproj/aqua-installer@928a2ee4243a9ee8312d80dc8cbaca88fb602a91 # v2.2.0
        with:
          aqua_version: v2.6.0
        env:
          AQUA_GITHUB_TOKEN: ${{github.token}}
      - run: ghalint run
        env:
          GHALINT_LOG_COLOR: always

  jsonnet:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
      - uses: aquaproj/aqua-installer@928a2ee4243a9ee8312d80dc8cbaca88fb602a91 # v2.2.0
        with:
          aqua_version: v2.6.0
      - run: jsonnet --version
      - run: |
          bash scripts/generate.sh
          git add .
          if ! git diff --cached --exit-code; then
            echo "Please run 'bash scripts/generate.sh'" >&2
            echo "::error title=Please run 'bash scripts/generate.sh'::"
            exit 1
          fi