build.yml

name: Build
on:
  push:
    branches: [master, branch-*, dogfood-*]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: "Build"
    runs-on: github-ubuntu-latest-s
    outputs:
      build-number: ${{ steps.build-poetry.outputs.BUILD_NUMBER }}
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Install mise and tools
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
      - name: Build the scanner
        uses: SonarSource/ci-github-actions/build-poetry@v1
        id: build-poetry
        with:
          sonar-platform: none
          artifactory-reader-role: private-reader
          artifactory-deployer-role: qa-deployer
          deploy-pull-request: true

  install_deps:
    name: "Install and Cache Poetry Dependencies"
    runs-on: github-ubuntu-latest-s
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Configure poetry
        uses: ./.github/actions/config-poetry # We use this job to cache the poetry depend
      - run: |
          poetry install

  formatting:
    name: "Formatting and Licenses headers"
    needs: [install_deps]
    runs-on: github-ubuntu-latest-s
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Configure poetry
        uses: ./.github/actions/config-poetry
      - run: |
          poetry run black src/ tests/ --check
          poetry run licenseheaders -t license_header.tmpl -o "SonarSource Sàrl" -y 2011-2026 -n "Sonar Scanner Python" -E .py -d src/
          poetry run licenseheaders -t license_header.tmpl -o "SonarSource Sàrl" -y 2011-2026 -n "Sonar Scanner Python" -E .py -d tests/
          git diff --name-only --exit-code ./src ./tests

  documentation:
    name: "CLI Documentation"
    runs-on: github-ubuntu-latest-s
    needs: [install_deps]
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Install mise and tools
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
      - name: Check for incorrect documentation
        run: |
          poetry run python tools/generate_cli_documentation.py
          git diff --exit-code CLI_ARGS.md

  coverage:
    name: "Coverage report generation"
    runs-on: github-ubuntu-latest-s
    needs: [install_deps]
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Configure poetry
        uses: ./.github/actions/config-poetry
      - run: |
          poetry run pytest --cov-report=xml:coverage.xml --cov-config=pyproject.toml --cov=src --cov-branch tests
          poetry run mypy src/ > mypy-report.txt || true
      - name: Upload coverage artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: coverage-reports
          path: |
            coverage.xml
            mypy-report.txt

  analysis:
    name: "NEXT Analysis"
    runs-on: github-ubuntu-latest-s
    needs: [coverage]
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Download coverage artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: coverage-reports
      - name: Install mise and tools
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
      - name: Analysis the project on next
        uses: SonarSource/ci-github-actions/build-poetry@v1
        with:
          sonar-platform: next
          artifactory-reader-role: private-reader
          artifactory-deployer-role: qa-deployer

  qa:
    name: "Test Python ${{ matrix.python-version }}"
    runs-on: github-ubuntu-latest-s
    needs: [install_deps]
    permissions:
      id-token: write
      contents: write
    strategy:
      fail-fast: false
      matrix:
        python-version:
          ["3.9.18", "3.9.6", "3.10.13", "3.11.7", "3.12.1", "3.13.2", "3.14.0"]
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Configure poetry
        uses: ./.github/actions/config-poetry
        with:
          python-version: ${{ matrix.python-version }}
      - name: Execute the test suite
        run: |
          poetry run pytest tests/

  qa-windows:
    name: "Test Windows"
    runs-on: github-windows-latest-s
    needs: [install_deps]
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Configure poetry for Windows
        uses: ./.github/actions/config-poetry
      - name: Execute the test suite
        run: |
          poetry run pytest tests/

  its:
    name: "Integration Tests"
    runs-on: github-ubuntu-latest-s
    permissions:
      id-token: write
      contents: write
    env:
      SONARQUBE_VERSION: 25.3.0.104237
      SKIP_DOCKER: true
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Cache SonarQube
        uses: SonarSource/gh-action_cache@v1
        id: sonarqube-cache
        with:
          path: sonarqube_cache/
          key: sonarqube-${{ env.SONARQUBE_VERSION }}
          restore-keys: sonarqube-
      - name: Download SonarQube
        if: ${{ !steps.sonarqube-cache.outputs.cache-hit }}
        run: |
          mkdir -p sonarqube_cache
          if [ ! -f sonarqube_cache/sonarqube.zip ]; then
            wget -q https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-$SONARQUBE_VERSION.zip -O sonarqube_cache/sonarqube.zip
          fi
      - name: Configure poetry
        uses: ./.github/actions/config-poetry
      - name: Execute the integration tests
        run: ./.github/scripts/run_its.sh

  promote:
    name: "Promote"
    needs:
      [
        build,
        formatting,
        documentation,
        coverage,
        analysis,
        qa,
        qa-windows,
        its,
      ]
    runs-on: github-ubuntu-latest-s
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Promote
        uses: SonarSource/ci-github-actions/promote@v1
        with:
          promote-pull-request: true
          build-name: sonar-scanner-python
        env:
          BUILD_NUMBER: ${{ needs.build.outputs.build-number }}