ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  # Allow manual re-triggers from the GitHub UI or `gh workflow run` —
  # useful when master squash-merges arrive back-to-back and concurrency
  # cancellations leave the latest master HEAD without a CI run.
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# CI only reads the repo. Pin the token to least privilege so a compromised
# step can't escalate. pull-requests:read lets dorny/paths-filter enumerate a
# PR's changed files on pull_request events.
permissions:
  contents: read
  pull-requests: read

jobs:
  changes:
    name: Detect changed paths
    runs-on: ubuntu-latest
    outputs:
      # Run policy folded in: true on push/dispatch (run everything) or when a
      # suite's paths changed on a PR. The per-suite jobs gate on these.
      rust: ${{ steps.decide.outputs.rust }}
      python: ${{ steps.decide.outputs.python }}
      node: ${{ steps.decide.outputs.node }}
      java: ${{ steps.decide.outputs.java }}
      go: ${{ steps.decide.outputs.go }}
      go_e2e: ${{ steps.decide.outputs.go_e2e }}
      polyglot: ${{ steps.decide.outputs.polyglot }}
      server: ${{ steps.decide.outputs.server }}
      chart: ${{ steps.decide.outputs.chart }}
      proto: ${{ steps.decide.outputs.proto }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v7.0.1

      - name: Filter paths
        id: filter
        uses: dorny/paths-filter@v4
        with:
          # Each suite reruns when its own sources, the shared Rust core, the
          # composite actions it actually uses, or its workflow change. Only
          # setup-rust is shared by every suite; the other actions map to a
          # single suite, so they no longer rerun all four.
          filters: |
            shared: &shared
              - 'crates/**'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - '.github/actions/setup-rust/**'
              - '.github/workflows/ci.yml'
            rust:
              - *shared
              - '.github/actions/setup-python/**'
              - 'rust-toolchain.toml'
              # flexiq-server's build.rs generates the flexiq.v1 types from the
              # committed descriptor, so the wire contract is now Rust input.
              - 'contracts/descriptor.binpb'
              - '.github/workflows/ci-rust.yml'
            python:
              - *shared
              - '.github/actions/setup-python/**'
              - 'sdks/python/**'
              - '.github/workflows/ci-python.yml'
            node:
              - *shared
              - '.github/actions/setup-node/**'
              - 'sdks/node/**'
              - 'dashboard/**'
              - '.github/workflows/ci-node.yml'
            java:
              - *shared
              - '.github/actions/setup-java/**'
              # Every Java job provisions Gradle through it, so a change here
              # reaches all three. The polyglot filter has watched it since it
              # was written; this one had not, which left the action's own
              # callers unable to test a change to it.
              - '.github/actions/provision-gradle/**'
              - 'sdks/java/**'
              - '.github/workflows/ci-java.yml'
            # Deliberately not `*shared`: the Go client links no native
            # binding and compiles nothing from crates/. What it does depend on
            # is the wire contract — the committed stubs are generated from
            # contracts/proto, and the conformance test reads the vectors
            # straight out of the tree.
            go:
              - 'sdks/go/**'
              - 'contracts/proto/**'
              - 'contracts/wire-vectors.json'
              - 'contracts/BUF_VERSION'
              - '.github/workflows/ci-go.yml'
            # The pair: this client against a real flexiq-server. It watches
            # both halves, which is why it is a filter of its own rather than
            # more entries on `go` — that suite's whole cost argument is that it
            # needs no Rust, and this one builds the server.
            #
            # Deliberately not `*shared`: an engine-crate change that breaks the
            # door already turns the Rust suite red, which runs
            # `cargo test -p flexiq-server --features grpc`. What only this
            # suite covers is the two halves meeting.
            go_e2e:
              - 'sdks/go/**'
              - 'crates/flexiq-server/**'
              - 'contracts/proto/**'
              - 'contracts/descriptor.binpb'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - '.github/actions/setup-rust/**'
              - '.github/workflows/ci-go-e2e.yml'
              # The dispatcher, which `*shared` would have brought in. A suite
              # wired into ci.yml and nowhere else has already gone silently
              # dead here once, and the PR that does it is the one PR this
              # filter would otherwise skip.
              - '.github/workflows/ci.yml'
            # The cross-SDK suite: any embedded SDK, the example itself, or its
            # driver can break interop, so it watches all three shells at once.
            # Named one by one rather than `sdks/**`, because the Go client is
            # not part of the polyglot example and a change to it has no
            # three-runtime build to justify.
            polyglot:
              - *shared
              - 'rust-toolchain.toml'
              - '.github/actions/setup-python/**'
              - '.github/actions/setup-node/**'
              - '.github/actions/setup-java/**'
              - '.github/actions/provision-gradle/**'
              - 'sdks/python/**'
              - 'sdks/node/**'
              - 'sdks/java/**'
              - 'examples/polyglot/**'
              - 'scripts/polyglot_e2e.py'
              - '.github/workflows/ci-polyglot.yml'
            # Deliberately not `*shared`: the image build is two from-scratch
            # Rust compiles, and an engine-crate change that breaks the server
            # already turns the Rust suite red. What only this suite covers is
            # the Dockerfile and the SPA it embeds.
            server:
              - 'crates/flexiq-server/**'
              # The image carries `fq` beside the server, from one cargo build.
              - 'crates/flexiq-cli/**'
              - 'dashboard/**'
              - 'docker/**'
              - '!docker/**.md'
              # Embedded into the binary for gRPC reflection, so a regenerated
              # descriptor changes what the image serves.
              - 'contracts/descriptor.binpb'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - '.github/workflows/ci-server-image.yml'
              # The dispatcher, for the same reason `go_e2e` watches it:
              # ci-server-image.yml has no trigger of its own, so a PR that
              # touches only this file would skip the suite it just edited.
              - '.github/workflows/ci.yml'
            # Template rendering only — seconds, and independent of the image.
            chart:
              - 'deploy/helm/**'
              - '.github/workflows/ci-chart.yml'
            # Deliberately not `*shared`: buf checks the contract against its
            # own committed descriptor, which is a different question from
            # whether the Rust generated off that descriptor still compiles —
            # the `rust` filter above watches the descriptor for that.
            proto:
              - 'contracts/**'
              - 'scripts/proto-check.sh'
              - 'scripts/proto-guard.sh'
              # contracts/openapi.json is generated by this crate, so a change
              # to the generator restales the committed document exactly as a
              # change to a .proto does — and only this job would notice.
              - 'crates/flexiq-openapi/**'
              - 'Cargo.toml'
              - 'Cargo.lock'
              - '.github/actions/setup-rust/**'
              - '.github/workflows/ci-proto.yml'

      - name: Decide which suites run
        id: decide
        # FORCE is true on push and workflow_dispatch — run every suite there.
        # On PRs honor the path filter.
        env:
          FORCE: ${{ github.event_name != 'pull_request' }}
          RUST: ${{ steps.filter.outputs.rust }}
          PYTHON: ${{ steps.filter.outputs.python }}
          NODE: ${{ steps.filter.outputs.node }}
          JAVA: ${{ steps.filter.outputs.java }}
          GO: ${{ steps.filter.outputs.go }}
          GO_E2E: ${{ steps.filter.outputs.go_e2e }}
          POLYGLOT: ${{ steps.filter.outputs.polyglot }}
          SERVER: ${{ steps.filter.outputs.server }}
          CHART: ${{ steps.filter.outputs.chart }}
          PROTO: ${{ steps.filter.outputs.proto }}
        run: |
          decide() {
            if [ "$FORCE" = "true" ] || [ "$2" = "true" ]; then
              echo "$1=true" >> "$GITHUB_OUTPUT"
            else
              echo "$1=false" >> "$GITHUB_OUTPUT"
            fi
          }
          decide rust "$RUST"
          decide python "$PYTHON"
          decide node "$NODE"
          decide java "$JAVA"
          decide go "$GO"
          decide go_e2e "$GO_E2E"
          decide polyglot "$POLYGLOT"
          decide server "$SERVER"
          decide chart "$CHART"
          decide proto "$PROTO"

  versions:
    name: Version consistency
    runs-on: ubuntu-latest
    # Unfiltered: the version spans every suite, and the check costs seconds.
    steps:
      - name: Check out repository
        uses: actions/checkout@v7.0.1

      - name: Every manifest agrees on one version
        run: node scripts/version.mjs --check

  rust:
    name: Rust
    needs: changes
    if: needs.changes.outputs.rust == 'true'
    uses: ./.github/workflows/ci-rust.yml

  python:
    name: Python
    needs: changes
    if: needs.changes.outputs.python == 'true'
    uses: ./.github/workflows/ci-python.yml

  node:
    name: Node
    needs: changes
    if: needs.changes.outputs.node == 'true'
    uses: ./.github/workflows/ci-node.yml

  java:
    name: Java
    needs: changes
    if: needs.changes.outputs.java == 'true'
    uses: ./.github/workflows/ci-java.yml

  go:
    name: Go
    needs: changes
    if: needs.changes.outputs.go == 'true'
    uses: ./.github/workflows/ci-go.yml

  go-e2e:
    name: Go e2e
    needs: changes
    if: needs.changes.outputs.go_e2e == 'true'
    uses: ./.github/workflows/ci-go-e2e.yml

  polyglot:
    name: Polyglot
    needs: changes
    if: needs.changes.outputs.polyglot == 'true'
    uses: ./.github/workflows/ci-polyglot.yml

  server-image:
    name: Server image
    needs: changes
    if: needs.changes.outputs.server == 'true'
    uses: ./.github/workflows/ci-server-image.yml

  chart:
    name: Chart
    needs: changes
    if: needs.changes.outputs.chart == 'true'
    uses: ./.github/workflows/ci-chart.yml

  proto:
    name: Proto
    needs: changes
    if: needs.changes.outputs.proto == 'true'
    uses: ./.github/workflows/ci-proto.yml

  ci-status:
    name: CI status
    if: always()
    needs: [changes, versions, rust, python, node, java, go, go-e2e, polyglot, server-image, chart, proto]
    runs-on: ubuntu-latest
    steps:
      - name: Check that no required job failed
        run: |
          results='${{ toJson(needs) }}'
          echo "$results"
          fail=$(echo "$results" | python3 -c "
          import json, sys
          data = json.load(sys.stdin)
          bad = [k for k, v in data.items() if v['result'] not in ('success', 'skipped')]
          print(','.join(bad))
          ")
          if [ -n "$fail" ]; then
            echo "::error::Failing or cancelled jobs: $fail"
            exit 1
          fi