checks.apicheck.yml

#
# Copyright (c) 2024 Elide Technologies, Inc.
#
# Licensed under the MIT license (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# https://opensource.org/license/mit/
#
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
# an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations under the License.
#

name: API Check

"on":
  workflow_dispatch:
    inputs:
      ## Input: Artifact Name
      artifact:
        description: "Artifact"
        required: false
        type: string
        default: "elide-framework"

      ## Input: Ignore Failures
      ignore_failures:
        description: "Ignore failures"
        required: false
        type: boolean
        default: false

  workflow_call:
    inputs:
      artifact:
        description: "Artifact"
        required: false
        type: string
        default: "elide-framework"
      ignore_failures:
        description: "Ignore failures"
        required: false
        type: boolean
        default: false

    secrets:
      BUILDLESS_APIKEY:
        description: "Buildless API key"
        required: false
      GRADLE_CONFIGURATION_KEY:
        description: "Gradle cache key"
        required: false

permissions:
  contents: "read"

jobs:
  api-check:
    name: "API Check"
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: "Setup: Harden Runner"
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            api.github.com:443
            objects.githubusercontent.com:443
            d3ob9fqp587by1.cloudfront.net:443
            download.oracle.com:443
            maven.elide.dev:443
            github.com:443
            dl.less.build:443
            gradle.less.build:443
            gradle.pkg.st:443
            jpms.pkg.st:443
            maven.pkg.jetbrains.space:443
            maven.pkg.st:443
            nodejs.org:443
            registry.npmjs.org:443
            dl.google.com:443
            repo.maven.apache.org:443
      - name: "Setup: Checkout"
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: "Setup: Node"
        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 23
      - name: "Setup: Bun"
        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.1
        with:
          bun-version-file: config/bun-version
      - name: "Setup: Elide"
        uses: elide-dev/setup-elide@990b915b2974a70e7654acb1303607b4cd1d3538 # v2
        with:
          version: "1.0.0-alpha15" # unlisted (interim)
      - name: "Setup: PNPM"
        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
        with:
          version: "10.6.2"
      - name: "Setup: GraalVM (Java 23)"
        uses: graalvm/setup-graalvm@01ed653ac833fe80569f1ef9f25585ba2811baab # v1.3.3
        with:
          distribution: "graalvm"
          java-version: 23
          check-for-updates: false
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: "Setup: Artifacts"
        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        continue-on-error: true
        with:
          merge-multiple: true
      - name: "Setup: Gradle"
        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4.3.0
        continue-on-error: ${{ inputs.ignore_failures }}
        env:
          CI: true
          BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          cache-read-only: false
          cache-encryption-key: ${{ secrets.GRADLE_CONFIGURATION_KEY }}
      - name: "Analysis: API Check"
        run: |
          ./gradlew -Pelide.abiValidate=true apiCheck \
            -x test \
            -x nativeCompile \
            -x nativeOptimizedCompile \
            -x :packages:graalvm:buildThirdPartyNatives \
            -x :packages:graalvm:buildRustNativesForHost \
            -x :packages:graalvm:natives \
            --no-configuration-cache