name: CI

# Runs the full `make check` on every PR and push to main, and on version tags
# (`vX.Y.Z`) additionally builds the `.plasmoid` and publishes a GitHub Release.
#
# Checks and smoke tests use the full Plasma toolchain inside the supported KDE neon image.

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:

# Only superseded PR runs are cancelled. Each main push and release keeps its run.
concurrency:
  group: ci-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  DEBIAN_FRONTEND: noninteractive
  LANG: C.UTF-8
  # Explicit import warnings prevent the local missing-module fallback.
  QMLLINT_FLAGS: --import warning --unqualified disable
  QML_TEST_REQUIRE_NO_SKIPS: '1'

jobs:
  scope:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      run_smoke: ${{ steps.scope.outputs.run_smoke }}
    steps:
      - name: Checkout comparison history
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Select smoke coverage
        id: scope
        run: python3 scripts/ci_scope.py

  check:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    container:
      # KDE neon User Edition, Ubuntu 24.04; resolved on 2026-09-06.
      image: invent-registry.kde.org/neon/docker-images/plasma@sha256:03fb67c59921f1985d94f8172a75c42ddc3f9a6a0f13e44a623e73aa7e527448
      options: --user 0
    permissions:
      contents: read
    steps:
      - name: Install checkout prerequisites
        run: |
          apt-get update
          apt-get install -y --no-install-recommends ca-certificates git

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Plasma and test tooling
        run: bash scripts/install-ci-dependencies.sh

      - name: make check
        run: make check

      - name: make package
        run: make package

  smoke-runtime:
    needs: scope
    if: needs.scope.outputs.run_smoke == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    container:
      image: invent-registry.kde.org/neon/docker-images/plasma@sha256:03fb67c59921f1985d94f8172a75c42ddc3f9a6a0f13e44a623e73aa7e527448
      options: --user 0
    steps:
      - name: Install checkout prerequisites
        run: |
          apt-get update
          apt-get install -y --no-install-recommends ca-certificates git

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Plasma and test tooling
        run: bash scripts/install-ci-dependencies.sh

      - name: Exercise the popup on a virtual display
        run: xvfb-run -a -s '-screen 0 1280x1024x24' make smoke SMOKE_ARGS='--output dist/smoke/ci'

      - name: Upload popup screenshots and logs
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: popup-smoke
          path: dist/smoke/ci
          if-no-files-found: warn
          retention-days: 7

  smoke:
    if: always()
    needs: [scope, smoke-runtime]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout smoke result validator
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Report required smoke result
        env:
          SCOPE_RESULT: ${{ needs.scope.result }}
          RUN_SMOKE: ${{ needs.scope.outputs.run_smoke }}
          RUNTIME_RESULT: ${{ needs.smoke-runtime.result }}
        run: python3 scripts/ci_scope.py --gate

  release:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    needs: [check, smoke]
    runs-on: ubuntu-latest
    container:
      # KDE neon User Edition, Ubuntu 24.04; resolved on 2026-09-06.
      image: invent-registry.kde.org/neon/docker-images/plasma@sha256:03fb67c59921f1985d94f8172a75c42ddc3f9a6a0f13e44a623e73aa7e527448
      options: --user 0
    permissions:
      contents: write
    steps:
      - name: Install build-only tooling
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            make cmake git ca-certificates jq gettext python3

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Verify release tag matches metadata
        shell: bash
        run: |
          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "release tag must use vX.Y.Z: $GITHUB_REF_NAME" >&2
            exit 1
          fi
          metadata_version="$(jq -r '.KPlugin.Version // empty' metadata.json)"
          if [[ -z "$metadata_version" || "v${metadata_version}" != "$GITHUB_REF_NAME" ]]; then
            echo "release tag $GITHUB_REF_NAME does not match metadata version $metadata_version" >&2
            exit 1
          fi

      - name: Prepare release notes from changelog
        shell: bash
        run: |
          mkdir -p dist
          python3 scripts/changelog.py --tag "$GITHUB_REF_NAME" > dist/release-notes.md

      - name: make package
        run: make package

      - name: Publish release
        # v3.0.2 creates a draft, uploads every asset, and only then publishes.
        # Keep repository release immutability enabled so the updater can trust
        # the published tag and asset digests.
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          files: |
            dist/codexbar-plasma.plasmoid
            dist/codexbar-plasma.plasmoid.sha256
          body_path: dist/release-notes.md
          generate_release_notes: false