ci.yml

name: CI (c++) Build and Test

on:
  workflow_dispatch:
    inputs:
      protocol:
        description: 'RPC Protocol to test'
        required: true
        default: 'rpc_v2'
        type: choice
        options:
          - rpc_v2
          - legacy
  push:
    branches: [ main, develop,  next ]
  pull_request:
    branches: [ main, develop,  next ]

defaults:
  run:
    shell: bash

env:
  HUSKY: 0
  MOCK_PATH: ${{ github.workspace }}/mock-firebolt
  MOCK_BRANCH: topic/changes-for-bidirectional
  MOCK_SHA1SUM: 1fec7b75190e75ac8ea8ebf9f3e00c0a070b2566

jobs:
  build_docker:
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.meta.outputs.tags }}
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}/firebolt-client-ci
          tags: type=sha

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Get Transport Version for Build-Arg
        id: transport_version
        run: echo "version=$(cat ${{ github.workspace }}/.transport.version)" >> $GITHUB_OUTPUT

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: .github/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            DEPS_TRANSPORT_V=${{ steps.transport_version.outputs.version }}
            DEPS_TRANSPORT_PROTOCOL=${{ github.event.inputs.protocol || 'rpc_v2' }}
          cache-from: type=gha,scope=${{ github.workflow }}
          cache-to: type=gha,mode=max,scope=${{ github.workflow }}

  format_check:
    permissions:
      contents: read
      packages: read
    needs: [build_docker]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Run clang-format check
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && git ls-files -- '*.cpp' '*.h' | xargs clang-format --dry-run --Werror \
            "

  build_project:
    permissions:
      contents: read
      packages: read
    needs: [build_docker]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version
        run: |
          VERSION=$(git describe --tags --dirty --match "v[0-9]*")
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "version: $VERSION"

      - name: Configure Project
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cmake -B build -S . \
                    -DCMAKE_BUILD_TYPE=Debug \
                    -DENABLE_TESTS=ON \
              && cp docs/openrpc/the-spec/firebolt-open-rpc.json build/test/ \
            "

      - name: Build Project
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cmake --build build --parallel \
            "

      - name: Install Project to build/install
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cmake --install build --prefix build/install \
            "

      - name: Upload build directory
        uses: actions/upload-artifact@v4
        with:
          name: build-dir
          path: ${{ github.workspace }}/build

  unit_tests:
    permissions:
      contents: read
      packages: read
    needs: [build_docker, build_project]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download build directory
        uses: actions/download-artifact@v4
        with:
          name: build-dir
          path: ${{ github.workspace }}/build

      - name: Run Unit Tests
        run: |
          chmod +x ${{ github.workspace }}/build/test/utApp
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && ctest --test-dir build/test \
            "

      - name: Generate Coverage Report
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cd build \
              && mkdir -p coverage \
              && gcovr -r .. \
                    --exclude '.*/test/.*\.h' \
                    --exclude '.*/test/.*\.cpp' \
                    --decisions \
                    --medium-threshold 50 --high-threshold 75 \
                    --lcov coverage/filtered_coverage.info \
                    --html-details coverage/index.html \
                    --cobertura coverage.cobertura.xml \
            "

      - name: Upload Coverage Report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: ${{ github.workspace }}/build/coverage/

      - name: Upload unit test lcov coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage-unit
          path: ${{ github.workspace }}/build/coverage/filtered_coverage.info

      - name: Code Coverage Summary Report
        uses: irongut/CodeCoverageSummary@v1.3.0
        with:
          filename: build/coverage.cobertura.xml
          badge: true
          hide_complexity: true
          format: markdown
          output: both
          thresholds: "50 75"
          fail_below_min: false

      - name: Add coverage summary to job summary
        run: cat code-coverage-results.md >> $GITHUB_STEP_SUMMARY

  component_tests:
    permissions:
      contents: read
      packages: read
    needs: [build_docker, build_project]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download build directory
        uses: actions/download-artifact@v4
        with:
          name: build-dir
          path: ${{ github.workspace }}/build

      - name: Setup Mock-Firebolt
        id: setup-mock
        uses: ./.github/actions/setup-mock

      - name: Restore Mock-Firebolt Cache
        uses: actions/cache@v4
        with:
          path: ${{ env.MOCK_PATH }}
          key: ${{ runner.os }}-mock-${{ steps.setup-mock.outputs.deps_cache_key }}

      - name: Run Component Tests
        run: |
          chmod +x ${{ github.workspace }}/build/test/ctApp
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace -v ${{ env.MOCK_PATH }}:/mock ${{ needs.build_docker.outputs.image_tag }} \
            ./.github/scripts/run-component-tests.sh \
              --mock /mock \
              --protocol ${{ github.event.inputs.protocol || 'rpc_v2' }} \
              --config /workspace/.github/mock-firebolt/config.json \
              --openrpc /workspace/docs/openrpc/the-spec/firebolt-open-rpc.json \
              --app-openrpc /workspace/docs/openrpc/the-spec/firebolt-app-open-rpc.json \
              --test-exe /workspace/build/test/ctApp

      - name: Generate Coverage Report
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cd build \
              && mkdir -p coverage \
              && gcovr -r .. \
                    --exclude '.*/test/.*\.h' \
                    --exclude '.*/test/.*\.cpp' \
                    --lcov coverage/filtered_coverage.info \
            "

      - name: Upload component test lcov coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage-component
          path: ${{ github.workspace }}/build/coverage/filtered_coverage.info

  api_test_app:
    permissions:
      contents: read
      packages: read
    needs: [build_docker, build_project]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download build directory
        uses: actions/download-artifact@v4
        with:
          name: build-dir
          path: ${{ github.workspace }}/build

      - name: Build api-test-app standalone
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cd test/api_test_app \
              && cmake -B build -S . \
                    -DCMAKE_BUILD_TYPE=Debug \
                    -DCMAKE_PREFIX_PATH=/workspace/build/install \
              && cmake --build build --parallel \
            "

      - name: Setup Mock-Firebolt
        id: setup-mock
        uses: ./.github/actions/setup-mock

      - name: Restore Mock-Firebolt Cache
        uses: actions/cache@v4
        with:
          path: ${{ env.MOCK_PATH }}
          key: ${{ runner.os }}-mock-${{ steps.setup-mock.outputs.deps_cache_key }}

      - name: Run api-test-app with mock server
        run: |
          chmod +x ${{ github.workspace }}/test/api_test_app/build/api-test-app
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace -v ${{ env.MOCK_PATH }}:/mock ${{ needs.build_docker.outputs.image_tag }} \
            ./.github/scripts/run-api-test-app.sh \
              --mock /mock \
              --config /workspace/.github/mock-firebolt/config.json \
              --openrpc /workspace/docs/openrpc/the-spec/firebolt-open-rpc.json \
              --app-openrpc /workspace/docs/openrpc/the-spec/firebolt-app-open-rpc.json \
              --test-exe /workspace/test/api_test_app/build/api-test-app

  coverage_gate:
    name: Coverage Gate
    needs: [unit_tests, component_tests]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Run coverage script tests
        run: python3 .github/scripts/compare_coverage_test.py

      - name: Fetch baseline from build-metadata branch
        # Gracefully handle a missing build-metadata branch (first-time setup)
        continue-on-error: true
        run: |
          set -euo pipefail
          if git fetch origin build-metadata 2>/dev/null; then
            if git cat-file -e FETCH_HEAD:coverage-baseline.json 2>/dev/null; then
              git show FETCH_HEAD:coverage-baseline.json > coverage-baseline.json
              echo "Loaded coverage-baseline.json from build-metadata branch"
            else
              echo "build-metadata branch exists but coverage-baseline.json not found — skipping baseline comparison"
              echo "{}" > coverage-baseline.json
            fi
          else
            echo "build-metadata branch not found — absolute threshold check only (first-time setup)"
            echo "{}" > coverage-baseline.json
          fi

      - name: Download unit test coverage artifact
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: coverage-unit
          path: ./unit-coverage

      - name: Download component test coverage artifact
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: coverage-component
          path: ./component-coverage

      - name: Compare coverage to baseline
        run: |
          python3 .github/scripts/compare_coverage.py \
            --baseline coverage-baseline.json \
            --unit ./unit-coverage/filtered_coverage.info \
            --component ./component-coverage/filtered_coverage.info

  update_baseline:
    name: Update Coverage Baseline
    # Runs on push to develop when both test suites pass.
    # Independent of coverage_gate — the gate is informational and must never
    # block the baseline from reflecting the actual state of passing tests.
    if: >-
      github.event_name == 'push' &&
      github.ref == 'refs/heads/develop' &&
      needs.unit_tests.result == 'success' &&
      needs.component_tests.result == 'success'
    needs: [unit_tests, component_tests]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: read
    # Queue concurrent runs; do not cancel in-progress — each merge deserves
    # a baseline update and force-push is atomic so queuing is safe.
    concurrency:
      group: update-baseline-develop
      cancel-in-progress: false
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Fetch existing baseline for comparison report
        # Best-effort — if the branch or file is absent we compare against nothing.
        continue-on-error: true
        run: |
          set -euo pipefail
          if git fetch origin build-metadata 2>/dev/null; then
            if git cat-file -e FETCH_HEAD:coverage-baseline.json 2>/dev/null; then
              git show FETCH_HEAD:coverage-baseline.json > old-baseline.json
              echo "Loaded existing baseline for comparison"
            else
              echo '{}' > old-baseline.json
            fi
          else
            echo '{}' > old-baseline.json
          fi

      - name: Download unit test coverage artifact
        uses: actions/download-artifact@v4
        with:
          name: coverage-unit
          path: ./unit-coverage

      - name: Download component test coverage artifact
        uses: actions/download-artifact@v4
        with:
          name: coverage-component
          path: ./component-coverage

      - name: Extract coverage and write new baseline
        id: extract
        run: |
          set -euo pipefail
          BL_ARG="old-baseline.json"
          [ -f "$BL_ARG" ] || echo '{}' > "$BL_ARG"

          python3 .github/scripts/compare_coverage.py \
            --baseline "$BL_ARG" \
            --unit ./unit-coverage/filtered_coverage.info \
            --component ./component-coverage/filtered_coverage.info \
            --output-json new-baseline.json \
            --commit "$GITHUB_SHA" \
            --timestamp "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"

          if [ ! -s new-baseline.json ]; then
            echo "Coverage extraction produced no output — skipping baseline update"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "New baseline to commit:"
            cat new-baseline.json
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Commit and push updated baseline to build-metadata
        if: steps.extract.outputs.skip == 'false'
        run: |
          set -euo pipefail
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"

          # Check out the build-metadata branch, or create it as an orphan.
          if git fetch origin build-metadata 2>/dev/null; then
            git checkout -B build-metadata FETCH_HEAD
          else
            git checkout --orphan build-metadata
            git rm -rf . --quiet 2>/dev/null || true
          fi

          cp -f new-baseline.json coverage-baseline.json

          git add coverage-baseline.json

          # Only commit when there is an actual change.
          if git diff --cached --quiet; then
            echo "Coverage baseline unchanged — no commit needed"
          else
            MSG=$(printf \
              'chore: update coverage baseline after develop merge [skip ci]\n\nCommit : %s\nRun ID : %s' \
              "$GITHUB_SHA" "$GITHUB_RUN_ID")
            git commit -m "$MSG"
            git push --force-with-lease origin build-metadata
            echo "Pushed updated baseline to build-metadata"
          fi