validate_new_changes.yml

name: "New changes validation"

on:
    pull_request:  # yamllint disable-line rule:empty-values

permissions:
    contents: "read"
    packages: "read"

env:
    REGISTRY: "ghcr.io"
    IMAGE_NAME: "articola-tools/pr-name-validator"

jobs:
    find-changed-files:
        runs-on: "ubuntu-latest"
        outputs:
            is_yaml_changed: "${{ steps.filter.outputs.yaml }}"
            is_dockerfile_changed: "${{ steps.filter.outputs.dockerfile }}"
            is_validator_image_changed: "${{ steps.filter.outputs.validator-image }}"
            is_go_changed: "${{ steps.filter.outputs.go }}"
            is_markdown_changed: "${{ steps.filter.outputs.markdown }}"
            changed_or_added_files: "${{ steps.filter.outputs.changed-or-added-files }}"
            changed_or_added_files_list: "${{ steps.filter.outputs.changed-or-added-files_files }}"
        permissions:
            pull-requests: "read"
        steps:
            - name: "Checkout ${{ github.event.repository.name }}"
              uses: "actions/checkout@v4"
              with:
                  fetch-depth: 1

            - name: "Find changed files"
              uses: "dorny/paths-filter@v3"
              id: "filter"
              with:
                  list-files: "shell"

                  filters: |
                      yaml:
                      - "**/*.yaml"
                      - "**/*.yml"
                      dockerfile:
                      - "**/Dockerfile"
                      validator-image:
                      - "**/Dockerfile"
                      - "**/.dockerignore"
                      - "**/*.go"
                      go:
                      - "**/*.go"
                      markdown:
                      - "**/*.md"
                      changed-or-added-files:
                      - added|modified: '**'

    validate-pr-name-validator-image:
        runs-on: "ubuntu-latest"
        needs: "find-changed-files"
        if: "${{ needs.find-changed-files.outputs.is_validator_image_changed == 'true' }}"

        # NOTE: building and running Docker image of PR name validator take around 1 minute.
        # If this job takes more than 5 minutes, it means that something is wrong.
        timeout-minutes: 5
        steps:
            - name: "Checkout ${{ github.event.repository.name }}"
              uses: "actions/checkout@v4"

            - name: "Set up Docker Buildx"
              uses: "docker/setup-buildx-action@v3"

            - name: "Login to Docker registry"
              uses: "docker/login-action@v3"
              with:
                  registry: "${{ env.REGISTRY }}"
                  username: "${{ github.actor }}"
                  password: "${{ secrets.GITHUB_TOKEN }}"

            - name: "Build PR name validator Docker image"
              uses: "docker/build-push-action@v6"
              with:
                  push: false
                  load: true

                  # NOTE: using another name to don't allow docker to download image from the internet in the next step.
                  tags: "local/pr-name-validator-pr:latest"
                  cache-from: "type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
                  cache-to: "type=inline"

            - name: "Check correct PR names"
              run: |
                  while IFS= read -r pr_name; do
                  docker run --rm local/pr-name-validator-pr:latest "$pr_name";
                  done < ${{ github.workspace }}/tests/correct_pr_names.txt

            - name: "Check incorrect PR names"
              run: |
                  while IFS= read -r pr_name; do
                  if docker run --rm local/pr-name-validator-pr:latest "$pr_name"; then
                  echo "Validation unexpectedly succeeded for PR name '$pr_name'!" >&2
                  exit 1
                  fi
                  done < ${{ github.workspace }}/tests/incorrect_pr_names.txt

            - name: "Run Dockerfile security scanner"
              run: "docker run --rm --group-add $(getent group docker | cut -d: -f3)
                    -v /var/run/docker.sock:/var/run/docker.sock
                    ghcr.io/articola-tools/dockerfile-security-scanner local/pr-name-validator-pr:latest"

    validate-dockerfile-changes:
        runs-on: "ubuntu-latest"
        needs: "find-changed-files"
        if: "${{ needs.find-changed-files.outputs.is_dockerfile_changed == 'true' }}"

        # NOTE: validating Dockerfile changes takes around 1 minute.
        # If this job takes more than 5 minutes, it means that something is wrong.
        timeout-minutes: 5
        steps:
            - name: "Checkout ${{ github.event.repository.name }}"
              uses: "actions/checkout@v4"

            - name: "Login to Docker registry"
              uses: "docker/login-action@v3"
              with:
                  registry: "${{ env.REGISTRY }}"
                  username: "${{ github.actor }}"
                  password: "${{ secrets.GITHUB_TOKEN }}"

            - name: "Run Dockerfile linter"
              run: "docker run --rm -v ${{ github.workspace }}:/linter_workdir/repo
                    ${{ env.REGISTRY }}/articola-tools/dockerfile-linter:latest"

    validate-yaml-changes:
        runs-on: "ubuntu-latest"
        needs: "find-changed-files"

        if: "${{ needs.find-changed-files.outputs.is_yaml_changed == 'true' }}"

        # NOTE: validating YAML changes takes around 1 minute.
        # If this job takes more than 5 minutes, it means that something is wrong.
        timeout-minutes: 5
        steps:
            - name: "Checkout ${{ github.event.repository.name }}"
              uses: "actions/checkout@v4"

            - name: "Login to Docker registry"
              uses: "docker/login-action@v3"
              with:
                  registry: "${{ env.REGISTRY }}"
                  username: "${{ github.actor }}"
                  password: "${{ secrets.GITHUB_TOKEN }}"

            - name: "Run YAML linter"
              run: "docker run --rm -v ${{ github.workspace }}:/linter_workdir/repo
                    ${{ env.REGISTRY }}/articola-tools/yaml-linter:latest"

    validate-markdown-changes:
        runs-on: "ubuntu-latest"
        needs: "find-changed-files"
        if: "${{ needs.find-changed-files.outputs.is_markdown_changed == 'true' }}"

        # NOTE: validating Markdown changes takes around 1 minute.
        # If this job takes more than 5 minutes, it means that something is wrong.
        timeout-minutes: 5
        steps:
            - name: "Checkout ${{ github.event.repository.name }}"
              uses: "actions/checkout@v4"

            - name: "Login to Docker registry"
              uses: "docker/login-action@v3"
              with:
                  registry: "${{ env.REGISTRY }}"
                  username: "${{ github.actor }}"
                  password: "${{ secrets.GITHUB_TOKEN }}"

            - name: "Run Dockerfile linter"
              run: "docker run --rm -v ${{ github.workspace }}:/linter_workdir/repo
                    ${{ env.REGISTRY }}/articola-tools/markdown-linter:latest"

    validate-go-changes:
        runs-on: "ubuntu-latest"
        needs: "find-changed-files"
        if: "${{ needs.find-changed-files.outputs.is_go_changed == 'true' }}"

        # NOTE: validating Go changes takes around 1 minute.
        # If this job takes more than 5 minutes, it means that something is wrong.
        timeout-minutes: 5
        steps:
            - name: "Checkout ${{ github.event.repository.name }}"
              uses: "actions/checkout@v4"

            - name: "Build code"
              run: "go build -ldflags \"-s -w\" -o pr_name_validator ./cmd/pr_name_validator/"

            - name: "Run unit tests"
              run: "go test ./..."

            - name: "Login to Docker registry"
              uses: "docker/login-action@v3"
              with:
                  registry: "${{ env.REGISTRY }}"
                  username: "${{ github.actor }}"
                  password: "${{ secrets.GITHUB_TOKEN }}"

            - name: "Run linter"
              run: "docker run --rm -v ./:/linter_workdir ghcr.io/articola-tools/go-linter:latest"

    validate-file-paths:
        runs-on: "ubuntu-latest"
        needs: "find-changed-files"
        if: "${{ needs.find-changed-files.outputs.changed_or_added_files == 'true' }}"

        # NOTE: validating file paths takes around 1 minute.
        # If this job takes more than 5 minutes, it means that something is wrong.
        timeout-minutes: 5
        steps:
            - name: "Validate file paths"
              run: |
                  for path in ${{ needs.find-changed-files.outputs.changed_or_added_files_list }}; do

                  # NOTE: ignore `.idea` folder because it's generated. Ignore files with special names.

                  if [[ "$path" != .idea* && "$path" != *Dockerfile && "$path" != *README.md && "$path" != *LICENSE ]]; then
                  docker run --rm ${{ env.REGISTRY }}/articola-tools/file-path-validator \
                  --naming-convention snake_case --path-to-validate "$path";
                  fi
                  done