name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Actions are pinned to commit SHAs, not tags: a tag can be moved to point at new code,
# which would let a compromised action run with this workflow's permissions.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  CI: true

jobs:
  build:
    name: build and test
    runs-on: [linux]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json
          cache: true
          cache-dependency-path: '**/packages.lock.json'

      # Locked mode fails if packages.lock.json does not match the project files, so a
      # dependency cannot change without the lock file change being reviewed.
      - name: restore
        run: dotnet restore DodoSSH.slnx --locked-mode

      - name: verify formatting
        run: dotnet format DodoSSH.slnx --verify-no-changes --no-restore

      - name: build
        run: dotnet build DodoSSH.slnx --no-restore --configuration Release

      - name: test
        run: dotnet test DodoSSH.slnx --no-build --configuration Release

      # This includes the end-to-end suite, which starts PostgreSQL, Keycloak and an OpenSSH
      # server through Testcontainers and runs the API as a child process — so it needs a
      # Docker daemon and gets one here. That is why the tests run on ubuntu rather than
      # macOS, whose runners have no daemon at all. Expect the Keycloak image pull to
      # dominate a cold run.