ci.yml

on: [push, pull_request, workflow_dispatch]

jobs:
  codeql-sast:
    name: CodeQL SAST scan
    uses: alphagov/govuk-infrastructure/.github/workflows/codeql-analysis.yml@main
    permissions:
      security-events: write

  dependency-review:
    name: Dependency Review scan
    uses: alphagov/govuk-infrastructure/.github/workflows/dependency-review.yml@main

  # This matrix job runs the test suite against multiple Ruby versions
  test_matrix:
    strategy:
      fail-fast: false
      matrix:
        ruby: [3.1, 3.2, 3.3]
    runs-on: ubuntu-latest
    env:
      GOVUK_CONTENT_SCHEMAS_PATH: vendor/publishing-api/content_schemas
    steps:
      - uses: actions/checkout@v4
      - name: Checkout Publishing API for content schemas
        uses: actions/checkout@v4
        with:
           repository: alphagov/publishing-api
           ref: main
           path: vendor/publishing-api
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: ${{ matrix.ruby }}
          bundler-cache: true
      - run: bundle exec rake

  # This job is needed to work around the fact that matrix jobs spawn multiple status checks – i.e. one job per variant.
  # The branch protection rules depend on this as a composite job to ensure that all preceding test_matrix checks passed.
  # Solution taken from: https://github.521000.bestmunity/t/status-check-for-a-matrix-jobs/127354/3
  test:
    needs: test_matrix
    runs-on: ubuntu-latest
    steps:
      - run: echo "All matrix tests have passed 🚀"

  generate_pacts:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true
      - run: bundle exec rake pact_test
      - uses: actions/upload-artifact@v4
        with:
          name: pacts
          path: spec/pacts/*.json

  account_api_pact:
    needs: generate_pacts
    uses: alphagov/account-api/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  asset_manager_pact:
    needs: generate_pacts
    uses: alphagov/asset-manager/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  collections_pact:
    needs: generate_pacts
    uses: alphagov/collections/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  email_alert_api_pact:
    needs: generate_pacts
    uses: alphagov/email-alert-api/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  frontend_pact:
    needs: generate_pacts
    uses: alphagov/frontend/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  places_manager_pact:
    needs: generate_pacts
    uses: alphagov/places-manager/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  link_checker_api_pact:
    needs: generate_pacts
    uses: alphagov/link-checker-api/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  locations_api_pact:
    needs: generate_pacts
    uses: alphagov/locations-api/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  publishing_api_pact:
    needs: generate_pacts
    uses: alphagov/publishing-api/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  support_api_pact:
    needs: generate_pacts
    uses: alphagov/support-api/.github/workflows/pact-verify.yml@main
    with:
      pact_artifact: pacts

  publish_pacts:
    if: ${{ github.actor != 'dependabot[bot]' }}
    needs:
      - account_api_pact
      - asset_manager_pact
      - collections_pact
      - email_alert_api_pact
      - frontend_pact
      - places_manager_pact
      - link_checker_api_pact
      - locations_api_pact
      - publishing_api_pact
      - support_api_pact
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true
      - uses: actions/download-artifact@v4
        with:
          name: pacts
          path: tmp/pacts
      - run: bundle exec rake pact:publish
        env:
          PACT_CONSUMER_VERSION: branch-${{ github.ref_name }}
          PACT_BROKER_BASE_URL: https://govuk-pact-broker-6991351eca05.herokuapp.com
          PACT_BROKER_USERNAME: ${{ secrets.GOVUK_PACT_BROKER_USERNAME }}
          PACT_BROKER_PASSWORD: ${{ secrets.GOVUK_PACT_BROKER_PASSWORD }}
          PACT_PATTERN: tmp/pacts/*.json

  publish_gem:
    needs: publish_pacts
    if: ${{ github.ref == 'refs/heads/main' }}
    permissions:
      contents: write
    uses: alphagov/govuk-infrastructure/.github/workflows/publish-rubygem.yml@main
    secrets:
      GEM_HOST_API_KEY: ${{ secrets.ALPHAGOV_RUBYGEMS_API_KEY }}