ci.yml

name: CI

on:
  pull_request:
    branches: [master]

jobs:
  readme-check:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Check README.md was not edited directly
        id: readme
        run: |
          TRUSTED="mre jakubsacha"
          AUTHOR="${{ github.event.pull_request.user.login }}"
          for u in $TRUSTED; do
            if [ "$AUTHOR" = "$u" ]; then
              echo "trusted=true" >> "$GITHUB_OUTPUT"
              exit 0
            fi
          done
          if git diff --name-only origin/master...HEAD | grep -q "^README.md$"; then
            echo "modified=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Comment and fail on direct README edit
        if: steps.readme.outputs.modified == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
        run: |
          gh api "repos/$REPO/issues/$PR/comments" \
            -f body="README.md was edited directly. Please edit tool entries in \`data/tools/\`, related collections in \`data/collections/\`, or text and structure in \`ci/crates/render/templates/README.md\` instead. Leave the generated README.md out of your pull request." \
            --silent
          echo "README.md must not be edited directly." >&2
          exit 1

  render:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: 1.98.1
          components: clippy, rustfmt

      - name: Check formatting
        run: make fmt-check

      - name: Run Clippy
        run: make clippy

      - name: Run tests
        run: make test

      - name: Render list
        id: render
        run: |
          make render-skip-deprecated 2>&1 | tee /tmp/render-output.txt
          exit ${PIPESTATUS[0]}

      - name: Comment render error on failure
        if: failure() && steps.render.outcome == 'failure'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
        run: |
          OUTPUT=$(grep -E "^Error" /tmp/render-output.txt | head -20)
          {
            echo "The render step failed with the following error:"
            echo ""
            echo '```'
            echo "$OUTPUT"
            echo '```'
            echo ""
            echo "Please check your YAML file in \`data/tools/\` against the format used by other tools in that directory."
          } > /tmp/render-comment.txt
          gh api "repos/$REPO/issues/$PR/comments" \
            -f body=@/tmp/render-comment.txt \
            --silent

  dependabot-merge:
    needs: [readme-check, render]
    if: >-
      github.actor == 'dependabot[bot]' &&
      github.event.pull_request.user.login == 'dependabot[bot]' &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: read
    steps:
      # Keep the merge credential isolated from the jobs that execute PR code.
      - name: Verify Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0

      - name: Merge minor and patch updates after CI passes
        if: >-
          (steps.metadata.outputs.package-ecosystem == 'cargo' ||
           steps.metadata.outputs.package-ecosystem == 'github_actions') &&
          (steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
           steps.metadata.outputs.update-type == 'version-update:semver-patch')
        env:
          # Use the existing Dependabot secret so the merge triggers the
          # list-generation workflow and its website rebuild event.
          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
          PR_URL: ${{ github.event.pull_request.html_url }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          if [ -z "$GH_TOKEN" ]; then
            echo "::error::Set the AUTOMERGE_TOKEN Dependabot secret."
            exit 1
          fi

          gh pr merge "$PR_URL" --squash --match-head-commit "$HEAD_SHA"