ci.yml

name: CI Build

on:
  push:
  pull_request:

permissions:
  contents: read

env:
  PDFBOX_PARITY_GATE_MODE: ${{ vars.PDFBOX_PARITY_GATE_MODE || 'ratchet' }}
  PDFBOX_PARITY_PDFBOX_REF: ${{ vars.PDFBOX_PARITY_PDFBOX_REF || ((github.base_ref == 'release/3.0' || github.ref_name == 'release/3.0' || startsWith(github.ref_name, 'codex/3-0-') || contains(github.ref_name, '-3-0-')) && '2902dd4e5fcca22bda75327a5570c0ea9936a904' || '2589dc979982b11e3ba92e107aed9f309362d517') }}
  PDFBOX_PARITY_RATCHET_BASELINE: ${{ vars.PDFBOX_PARITY_RATCHET_BASELINE || ((github.base_ref == 'release/3.0' || github.ref_name == 'release/3.0' || startsWith(github.ref_name, 'codex/3-0-') || contains(github.ref_name, '-3-0-')) && 'tools/parity/runtime/ratchet-baseline-3.0.json' || 'tools/parity/runtime/ratchet-baseline.json') }}
  PDFBOX_API_SURFACE_PDFBOX_REF: ${{ vars.PDFBOX_API_SURFACE_PDFBOX_REF || ((github.base_ref == 'release/3.0' || github.ref_name == 'release/3.0' || startsWith(github.ref_name, 'codex/3-0-') || contains(github.ref_name, '-3-0-')) && '2902dd4e5fcca22bda75327a5570c0ea9936a904' || '833ed8f378f00838fd8df8c01bfc4b915b4c350b') }}
  PDFBOX_API_SURFACE_ENFORCE: ${{ vars.PDFBOX_API_SURFACE_ENFORCE || 'true' }}

jobs:
  build-and-test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore PdfBoxNet.slnx

      - name: Build
        run: dotnet build PdfBoxNet.slnx --configuration Release --no-restore

      - name: Test
        run: dotnet test PdfBoxNet.slnx --configuration Release --no-build --nologo

      - name: Pack
        run: |
          rm -rf artifacts/packages
          dotnet pack PdfBoxNet.slnx --configuration Release --no-build --output artifacts/packages -p:ContinuousIntegrationBuild=true
          find artifacts/packages -maxdepth 1 -type f -name '*.nupkg' -print | sort

      - name: Checkout Apache PDFBox for API surface gate
        uses: actions/checkout@v5
        with:
          repository: apache/pdfbox
          ref: ${{ env.PDFBOX_API_SURFACE_PDFBOX_REF }}
          path: apache-pdfbox-api

      - name: API surface review gate
        run: |
          args=(
            tools/parity/generate_api_surface_report.py
            --upstream-root apache-pdfbox-api
            --no-build
          )
          if [ "${PDFBOX_API_SURFACE_ENFORCE}" = "true" ]; then
            args+=(--ratchet-baseline reports/api-surface-ratchet-baseline.json --fail-on-unreviewed)
          else
            echo "API surface gate is report-only for this branch until the branch-specific API review baseline exists."
          fi
          python3 "${args[@]}"

      - name: Runtime parity harness smoke
        run: |
          python3 -m py_compile tools/parity/runtime/run_runtime_parity.py
          python3 tools/parity/runtime/run_runtime_parity.py --help

  runtime-parity:
    if: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release/3.0' }}
    runs-on: ubuntu-latest
    needs: build-and-test
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Checkout Apache PDFBox
        uses: actions/checkout@v5
        with:
          repository: apache/pdfbox
          ref: ${{ env.PDFBOX_PARITY_PDFBOX_REF }}
          path: apache-pdfbox

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'
          cache: maven

      - name: Build Apache PDFBox app jar
        working-directory: apache-pdfbox
        run: mvn -B -pl app -am -DskipTests package

      - name: Resolve Apache PDFBox app jar
        id: pdfbox_app
        shell: bash
        run: |
          jar="$(find apache-pdfbox/app/target -maxdepth 1 -type f -name 'pdfbox-app-*.jar' ! -name '*sources*' ! -name '*javadoc*' | sort | head -n 1)"
          if [ -z "$jar" ]; then
            echo "No pdfbox-app jar found under apache-pdfbox/app/target" >&2
            exit 1
          fi
          echo "jar=$jar" >> "$GITHUB_OUTPUT"

      - name: Restore runtime probe
        run: dotnet restore tools/parity/runtime/DotnetPdfProbe/DotnetPdfProbe.csproj

      - name: Runtime parity suite
        run: >
          python3 tools/parity/runtime/run_runtime_parity.py
          --manifest tools/parity/runtime/corpus-manifest.txt
          --pdfbox-root apache-pdfbox
          --java-classpath "${{ steps.pdfbox_app.outputs.jar }}"
          --out-dir artifacts/runtime-parity
          --ratchet-baseline "${PDFBOX_PARITY_RATCHET_BASELINE}"
          --gate-mode "${PDFBOX_PARITY_GATE_MODE:-ratchet}"
          --fail-on-unexpected

      - name: Runtime parity summary
        if: ${{ always() }}
        run: |
          if [ -f artifacts/runtime-parity/summary.md ]; then
            cat artifacts/runtime-parity/summary.md
            cat artifacts/runtime-parity/summary.md >> "$GITHUB_STEP_SUMMARY"
          else
            echo "Runtime parity summary was not generated."
          fi

      - name: Upload runtime parity artifacts
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: runtime-parity-${{ github.run_id }}-${{ github.run_attempt }}
          path: artifacts/runtime-parity