name: ci

on:
  push:
    tags:
    branches:
      - main
  pull_request:
  merge_group:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  GOPROXY: "https://proxy.golang.org"

# Lock down default permissions to no permissions.
permissions:
  # none-all, which doesn't exist, but
  # https://docs.github.com/en/actions/reference/authentication-in-a-workflow#using-the-github_token-in-a-workflow
  # implies that the token still gets created.  Elsewhere we learn that any
  # permission not mentioned here gets turned to `none`.
  actions: none

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      # publish-unit-test-result-action writes a comment to the PR
      pull-requests: write
      # and writes to the checks API
      checks: write
    steps:
      - uses: actions/checkout@v5
      - uses: bazel-contrib/setup-bazel@0.15.0
        with:
          # Avoid downloading Bazel each time
          bazelisk-cache: true
          # Store build cache per workflow
          disk-cache: ${{ github.workflow }}
          # Share repository cache between workflows
          repository-cache: true
      - run: bazel build //...
      - name: bazel test
        run: bazel coverage --test_output=all --combined_report=lcov --instrument_test_targets --nocache_test_results --instrumentation_filter="^//" //...
      - name: output bazel paths for test and coverage
        if: always()
        id: bazel_info
        run: |
          bazel info bazel-testlogs output_path | sed -e 's/: /=/' >> $GITHUB_OUTPUT
      - uses: EnricoMi/publish-unit-test-result-action/linux@v2
        if: (!cancelled())
        with:
          files: ${{ steps.bazel_info.outputs.bazel-testlogs }}/**/test.xml
      - uses: codecov/codecov-action@v5
        if: (!cancelled())
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
          files: ${{ steps.bazel_info.outputs.output_path }}/_coverage/_coverage_report.dat
