checks.yml

# Copyright The OpenTelemetry Authors
# SPDX-License-Identifier: Apache-2.0
name: Checks

on:
  merge_group:
    types: [checks_requested]
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: false

jobs:
  build_images:
    name: Build images
    permissions:  # required by the reusable workflow
      contents: read  # required by the component-build-images reusable workflow
      packages: write  # required to push built images to GHCR
    uses: ./.github/workflows/component-build-images.yml
    with:
      push: ${{ github.event_name == 'push' }}
      force_build: ${{ github.event_name == 'push' }}
      # Use a non-release tag for PR builds; tags are not pushed when push=false.
      version: ${{ github.event_name == 'push' && 'main' || 'dev' }}
    secrets:
      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

  markdownlint:
    name: Markdown lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Install dependencies
        run: npm ci
      - name: Run markdownlint
        run: make markdownlint

  yamllint:
    name: YAML lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: '3.x'
      - name: Install yamllint
        run: make install-yamllint
      - name: Run yamllint
        run: yamllint . -f github --strict

  misspell:
    name: Misspell
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Run misspell
        run: make misspell

  checklinks:
    name: lychee
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Restore lychee cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        id: cache-restore
        with:
          path: .lycheecache
          key: ${{ runner.os }}-lychee-${{ hashFiles('.lychee.toml') }}
          restore-keys: |
            ${{ runner.os }}-lychee-
      - name: Run lychee
        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8  # v2.9.0
        with:
          args: --config .lychee.toml --cache --max-cache-age 3d --cache-exclude-status 300..=599 .
          fail: true
      - name: Save lychee cache
        if: always()
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: .lycheecache
          key: ${{ steps.cache-restore.outputs.cache-primary-key }}

  sanity:
    name: Sanity check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Run sanitycheck.py
        run: python3 ./internal/tools/sanitycheck.py

  checklicense:
    name: Check license
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Run checklicense
        run: make checklicense

  weaver-check:
    name: Weaver check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Run Weaver registry check
        env:
          GITHUB_WORKSPACE_PATH: ${{ github.workspace }}
        run: |
          # Reuse the Dependabot-tracked weaver pin from the telemetry-docs Dockerfile so this
          # check never drifts from the version used to actually generate the docs.
          WEAVER_IMAGE=$(grep -oP '(?<=^FROM )\S*otel/weaver\S*' src/telemetry-docs/Dockerfile)
          docker run --rm \
            --mount "type=bind,source=${GITHUB_WORKSPACE_PATH}/telemetry-schema,target=/home/weaver/source,readonly" \
            "${WEAVER_IMAGE}" \
            registry check -r source

  cart-unit-tests:
    name: Cart unit tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Start Valkey
        run: |
          VALKEY_IMAGE=$(grep -oP '(?<=^VALKEY_IMAGE=)\S*' .env)
          docker run -d --rm --name valkey -p 6379:6379 "${VALKEY_IMAGE}"
          for i in {1..30}; do
            if docker exec valkey valkey-cli ping 2>/dev/null | grep -q PONG; then
              break
            fi
            sleep 1
          done
      - name: Set up .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68  # v6.0.0
        with:
          dotnet-version: '10.0.x'
      - name: Run cart unit tests
        working-directory: src/cart
        env:
          VALKEY_ADDR: localhost:6379
        run: dotnet test tests/cart.tests.csproj

  check-react-native-changes:
    name: Check React Native changes
    runs-on: ubuntu-latest
    outputs:
      should_build: ${{ steps.filter.outputs.react_native }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Check React Native paths
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d  # v4.0.3
        id: filter
        with:
          filters: |
            react_native:
              - 'src/react-native-app/**'
              - 'Makefile'
              - '.github/workflows/checks.yml'
              - '.github/workflows/react-native-build.yml'

  react-native-build:
    needs: check-react-native-changes
    if: needs.check-react-native-changes.outputs.should_build == 'true'
    uses: ./.github/workflows/react-native-build.yml

  codeql-analysis:
    name: CodeQL analysis
    permissions:
      actions: read  # required to scan GitHub Actions workflows
      contents: read  # required to checkout the repository
      security-events: write  # required to upload CodeQL SARIF to code scanning
    uses: ./.github/workflows/codeql-analysis.yml

  build-test:
    name: build-test
    needs: [
      build_images,
      markdownlint,
      yamllint,
      misspell,
      checklinks,
      sanity,
      checklicense,
      weaver-check,
      cart-unit-tests,
      react-native-build,
      codeql-analysis
    ]
    if: always() && !cancelled()
    runs-on: ubuntu-latest
    steps:
      - name: Report CI status
        shell: bash
        env:
          CI_SUCCESS: ${{ !contains(needs.*.result, 'failure') }}
        run: |
          if [ "${CI_SUCCESS}" == "true" ]
          then
            echo 'Build complete ✓'
          else
            echo 'Build failed ✗'
            exit 1
          fi