pre-merge.yml

---
# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
# SPDX-License-Identifier: Apache-2.0

name: Pre-Merge CI Pipeline

on:
  pull_request:
    branches:
      - main
      - release-*
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  MARKDOWNLINT_CLI_VER: 0.44.0

permissions:
  contents: read

jobs:
  pre-checks:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    outputs:
      filtered_projects: ${{ steps.filter-changes.outputs.filtered_projects }}
      other_changed_projects: ${{ steps.filter-changes.outputs.other_changed_projects }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: "Verify Branch Name"
        uses: open-edge-platform/orch-ci/verify-branch-name@467367d6f859a4654f2645ca78efd60035cf390c  # 2026.0.8
      - name: "Discover Changed Subfolders"
        id: discover-changes
        uses: open-edge-platform/orch-ci/discover-changed-subfolders@467367d6f859a4654f2645ca78efd60035cf390c  # 2026.0.8
      - name: "Filter Out Unwanted Changed Subfolders"
        id: filter-changes
        env:
          changed_projects: ${{ steps.discover-changes.outputs.changed_projects }}
        run: |
          folders_to_remove='[".github",".reuse","LICENSES",""]'

          filtered_projects=$(echo "$changed_projects" | jq -cr --argjson folders_to_remove "$folders_to_remove" 'map(select(. as $item | $folders_to_remove | index($item) | not))')
          other_changed_projects=$(echo "$changed_projects" | jq -cr --argjson filtered_projects "$filtered_projects" 'map(select(. as $item | $filtered_projects | index($item) | not))')

          echo "filtered_projects=$filtered_projects" >> $GITHUB_OUTPUT
          echo "other_changed_projects=$other_changed_projects" >> $GITHUB_OUTPUT
  pre-merge-root:
    permissions:
      contents: read
    needs: pre-checks
    if: ${{ contains(needs.pre-checks.outputs.other_changed_projects, '.github') || contains(needs.pre-checks.outputs.other_changed_projects, '.reuse') || contains(needs.pre-checks.outputs.other_changed_projects, 'LICENSES') || contains(needs.pre-checks.outputs.other_changed_projects, '""')}}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238  # v6.2.0
        with:
          node-version: '18'
      - run: |
          npm install -g \
          "markdownlint-cli@${{ env.MARKDOWNLINT_CLI_VER }}"
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        id: setup_python
        with:
          python-version: '3.13'
      - name: Restore cached virtualenv
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306  # v5.0.3
        with:
          key: venv-${{ runner.os }}-${{ steps.setup_python.outputs.python-version }}-${{ hashFiles('requirements.txt') }}
          path: venv_infra

      - name: Run mdlint
        run: make mdlint
      - name: Run license check
        run: make license
  pre-merge-pipeline:
    permissions:
      contents: read
    needs: pre-checks
    if: ${{ needs.pre-checks.outputs.filtered_projects != '[]' }}
    strategy:
      fail-fast: false
      matrix:
        project_folder: ${{ fromJson(needs.pre-checks.outputs.filtered_projects) }}
    uses: open-edge-platform/orch-ci/.github/workflows/pre-merge.yml@70798ccece8a5856e220f1a6c250337628fc658e  # 2026.0.8
    with:
      bootstrap_tools: "all,golangci-lint2"
      run_security_scans: true
      run_version_check: true
      run_dep_version_check: true
      run_build: true
      run_lint: true
      run_test: true
      run_validate_clean_folder: true
      run_docker_build: true
      run_artifact: false
      prefix_tag_separator: "/"
      project_folder: ${{ matrix.project_folder }}
      trivy_image_skip: "postgres:16.4"
      trivy_config_path: '${{ matrix.project_folder }}/trivy.yaml'
    secrets:
      NO_AUTH_ECR_PUSH_USERNAME: ${{ secrets.NO_AUTH_ECR_PUSH_USERNAME }}
      NO_AUTH_ECR_PUSH_PASSWD: ${{ secrets.NO_AUTH_ECR_PUSH_PASSWD }}
  final-check:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    if: ${{ always() }}
    needs: [pre-merge-root, pre-merge-pipeline]
    steps:
      - name: Final Status Check
        env:
          pre_merge_root_pipeline: ${{ needs.pre-merge-root.result }}
          pre_merge_pipeline: ${{ needs.pre-merge-pipeline.result }}
        run: |
          results=("pre_merge_root_pipeline" "pre_merge_pipeline")
          status="OK"

          for result in "${results[@]}"; do
            pipeline_result=$(eval echo \$$result)
            echo "${result} result: $pipeline_result"
            if [[ "$pipeline_result" != "success" && "$pipeline_result" != "skipped" ]]; then
              status="KO"
            fi
          done

          if [[ "$status" == "OK" ]]; then
            echo "Pre-merge check passed successfully."
          else
            echo "All pre-merge checks failed or were skipped. PR can't get merged"
            exit 1
          fi