ci.yml

name: Specs
on:  # yamllint disable-line rule:truthy
  pull_request:
  schedule:
    - cron: "0 0 * * *"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
permissions: {}

jobs:
  ci:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: github.event_name != 'schedule' || github.repository == 'dependabot/dependabot-core'
    strategy:
      fail-fast: false
      matrix:
        suite:
          - { path: bazel, name: bazel, ecosystem: bazel }
          - { path: bin, name: dry_run, ecosystem: common }
          - { path: bun, name: bun, ecosystem: bun }
          - { path: bundler, name: bundler, ecosystem: bundler }
          - { path: cargo, name: cargo, ecosystem: cargo }
          - { path: common, name: common, ecosystem: common}
          - { path: composer, name: composer, ecosystem: composer }
          - { path: conda, name: conda, ecosystem: conda }
          - { path: devcontainers, name: devcontainers, ecosystem: devcontainers }
          - { path: docker_compose, name: docker_compose, ecosystem: docker-compose }
          - { path: docker, name: docker, ecosystem: docker }
          - { path: dotnet_sdk, name: dotnet_sdk, ecosystem: dotnet-sdk }
          - { path: elm, name: elm, ecosystem: elm }
          - { path: git_submodules, name: git_submodules, ecosystem: gitsubmodule }
          - { path: github_actions, name: github_actions, ecosystem: github-actions }
          - { path: go_modules, name: go_module, ecosystem: gomod }
          - { path: gradle, name: gradle, ecosystem: gradle }
          - { path: helm, name: helm, ecosystem: helm }
          - { path: hex, name: hex, ecosystem: mix }
          - { path: julia, name: julia, ecosystem: julia }
          - { path: maven, name: maven, ecosystem: maven }
          - { path: mise, name: mise, ecosystem: mise }
          - { path: nix, name: nix, ecosystem: nix }
          - { path: npm_and_yarn, name: npm_and_yarn, ecosystem: npm }
          - { path: nuget, name: nuget, ecosystem: nuget }
          - { path: pre_commit, name: pre_commit, ecosystem: pre-commit }
          - { path: pub, name: pub, ecosystem: pub }
          - { path: python, name: python_slow, ecosystem: pip }
          - { path: python, name: python, ecosystem: pip }
          - { path: rust_toolchain, name: rust_toolchain, ecosystem: rust-toolchain }
          - { path: swift, name: swift, ecosystem: swift }
          - { path: terraform, name: terraform, ecosystem: terraform }
          - { path: opentofu, name: opentofu, ecosystem: opentofu }
          - { path: uv, name: uv, ecosystem: uv }
          - { path: vcpkg, name: vcpkg, ecosystem: vcpkg }

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          token: '' # use git commands to avoid excessive rate limit usage
          filters: .github/ci-filters.yml

      - name: Build ecosystem image
        if: steps.changes.outputs[matrix.suite.path] == 'true'
        run: script/build ${{ matrix.suite.path }}

      - name: Run ${{ matrix.suite.name }} tests
        if: steps.changes.outputs[matrix.suite.path] == 'true'
        run: |
          docker run \
            --pull never \
            --env "CI=true" \
            --env "RAISE_ON_WARNINGS=true" \
            --env "DEPENDABOT_TEST_ACCESS_TOKEN=${{ secrets.GITHUB_TOKEN }}" \
            --env "SUITE_NAME=${{ matrix.suite.name }}" \
            --rm ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }} bash -c \
            "cd /home/dependabot/${{ matrix.suite.path }} && ./script/ci-test"

  updater:
    env:
      DOCKER_BUILDKIT: 1
    name: Updater
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false
      # using bundler as the test updater
      - name: Build ecosystem image
        run: script/build bundler
      - name: Run updater tests
        env:
          DEPENDABOT_TEST_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: script/ci-test-updater

  lint:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      BUNDLE_GEMFILE: updater/Gemfile
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: ruby/setup-ruby@6ca151fd1bfcfd6fe0c4eb6837eb0584d0134a0c # v1.290.0
        with:
          bundler-cache: true
      - run: ./bin/lint
      # yamllint is installed in GitHub Actions base runner image: https://github.com/adrienverge/yamllint/pull/588
      - run: yamllint .

  rakefile_tests:
    name: Rakefile Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      BUNDLE_GEMFILE: updater/Gemfile
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          token: '' # use git commands to avoid excessive rate limit usage
          filters: .github/ci-filters.yml

      - name: Setup Ruby
        if: steps.changes.outputs.rakefile_tests == 'true'
        uses: ruby/setup-ruby@6ca151fd1bfcfd6fe0c4eb6837eb0584d0134a0c # v1.290.0
        with:
          bundler-cache: true

      - name: Run rakefile tests
        if: steps.changes.outputs.rakefile_tests == 'true'
        run: script/test-rakefile

  integration:
    env:
      DOCKER_BUILDKIT: 1
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Build ecosystem image
        run: script/build silent

      - name: Setup Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: 'silent/tests/go.mod'

      - name: Install Dependabot CLI
        run: go install github.com/dependabot/cli/cmd/dependabot@latest

      - name: Run integration tests
        run: |
          cd silent/tests
          go test ./...