test.yaml

---
name: test
permissions: {}
on: pull_request

jobs:
  path-filter:
    # Get changed files to filter jobs
    timeout-minutes: 30
    outputs:
      update-aqua-checksums: ${{steps.changes.outputs.update-aqua-checksums}}
      renovate-config-validator: ${{steps.changes.outputs.renovate-config-validator}}
      ghalint: ${{steps.changes.outputs.ghalint}}
      go-mod-tidy: ${{steps.changes.outputs.go-mod-tidy}}
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: |
            update-aqua-checksums:
              - aqua/aqua.yaml
              - aqua/imports/*.yaml
              - aqua/aqua-checksums.json
              - .github/workflows/test.yaml
            renovate-config-validator:
              - renovate.json5
            ghalint:
              - .github/workflows/*.yaml
              - aqua/imports/ghalint.yaml
            go-mod-tidy:
              - go.mod
              - go.sum
              - "**.go"

  update-aqua-checksums:
    # Update aqua-checksums.json and push a commit
    needs: path-filter
    if: needs.path-filter.outputs.update-aqua-checksums == 'true'
    uses: aquaproj/update-checksum-workflow/.github/workflows/update-checksum.yaml@8bce60cc4475128360bc32f00707abb874ca4a91 # v1.0.3
    permissions:
      contents: read
    with:
      aqua_version: v2.37.2
      prune: true
    secrets:
      gh_app_id: ${{secrets.APP_ID}}
      gh_app_private_key: ${{secrets.APP_PRIVATE_KEY}}

  test:
    uses: suzuki-shunsuke/go-test-workflow/.github/workflows/test.yaml@6861ea245ad10752afcba66cb71f28cf5c46ce49 # v1.1.0
    with:
      aqua_version: v2.37.2
      go-version-file: go.mod
      golangci-lint-timeout: 120s
    permissions:
      pull-requests: write
      contents: read

  go-mod-tidy:
    uses: suzuki-shunsuke/go-mod-tidy-workflow/.github/workflows/go-mod-tidy.yaml@79af8ebcd2dea45c27303b09192be80f7a35a37a # v1.1.0
    needs: path-filter
    if: needs.path-filter.outputs.go-mod-tidy == 'true'
    with:
      go-version-file: go.mod
      aqua_version: v2.37.2
    secrets:
      gh_app_id: ${{secrets.APP_ID}}
      gh_app_private_key: ${{secrets.APP_PRIVATE_KEY}}
    permissions:
      contents: read

  build:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version-file: go.mod

      - uses: aquaproj/aqua-installer@e6160e5a751bbcbd337a834eb75c15ba9ca206ae # v3.0.2
        with:
          aqua_version: v2.37.2

      - name: dry run
        run: bash scripts/test-dry-run.sh

  renovate-config-validator:
    # Validate Renovate Configuration by renovate-config-validator.
    uses: suzuki-shunsuke/renovate-config-validator-workflow/.github/workflows/validate.yaml@4a378742d05b4e67aae34039d7c779ac913cd79d # v0.2.3
    needs: path-filter
    if: needs.path-filter.outputs.renovate-config-validator == 'true'
    permissions:
      contents: read

  ghalint:
    # Validate GitHub Actions Workflows by ghalint.
    timeout-minutes: 30
    needs: path-filter
    if: needs.path-filter.outputs.ghalint == 'true'
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: aquaproj/aqua-installer@e6160e5a751bbcbd337a834eb75c15ba9ca206ae # v3.0.2
        with:
          aqua_version: v2.37.2
        env:
          AQUA_GITHUB_TOKEN: ${{github.token}}
      - run: ghalint run
        env:
          GHALINT_LOG_COLOR: always

  enable-auto-merge:
    uses: ./.github/workflows/wc-enable-auto-merge.yaml
    needs:
      - status-check
    secrets:
      gh_app_id: ${{secrets.APP_ID}}
      gh_app_private_key: ${{secrets.APP_PRIVATE_KEY}}
    # "! failure() && ! cancelled()" is required. success() returns false if dependent jobs are skipped. https://github.com/community/community/discussions/45058
    # By default success() is used so we have to override success() by "! failure() && ! cancelled()"
    if: |
      ! failure() && ! cancelled() && github.event.pull_request.user.login == 'renovate[bot]' && contains(github.event.pull_request.body, ' **Automerge**: Enabled.')

  status-check:
    # This job is used for main branch's branch protection rule's status check.
    # If all dependent jobs succeed or are skipped this job succeeds.
    timeout-minutes: 30
    runs-on: ubuntu-latest
    needs:
      - update-aqua-checksums
      - test
      - build
      - renovate-config-validator
      - ghalint
      - go-mod-tidy
    permissions: {}
    if: failure()
    steps:
      - run: exit 1