common.yml

name: Common

on:
  pull_request:
    paths-ignore:
      - "docs/**"
      - "samples/**"
      - "**.md"
  push:
    branches:
      - master
      - main
      - release/v*
    tags:
      - v*
    paths-ignore:
      - "docs/**"
      - "samples/**"
      - "**.md"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: read

jobs:
  csharp-quality:
    runs-on: ubuntu-latest
    name: C# Quality
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Install net10.0
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x
      - name: Set up .NET NuGet authentication
        run: |
          dotnet nuget add source "https://nuget.pkg.github.com/TrogonStack/index.json" \
            --name "github" \
            --username "${{ github.actor }}" \
            --password ${{ secrets.GITHUB_TOKEN }} \
            --store-password-in-clear-text
      - name: Resolve comparison refs
        id: refs
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            echo "base=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT"
            echo "head=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
          else
            echo "base=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
            echo "head=${{ github.sha }}" >> "$GITHUB_OUTPUT"
          fi
      - name: Restore
        run: |
          dotnet restore src/EventStore.sln
      - name: Lint unused variables
        run: |
          dotnet build --no-restore --configuration Release -p:Platform=x64 -warnaserror:CS0168,CS0219,CS8321 src/EventStore.sln
      - name: Verify C# formatting
        run: |
          ./ci/csharp-format-changed.sh src/EventStore.sln "${{ steps.refs.outputs.base }}" "${{ steps.refs.outputs.head }}"

  vulnerability-scan:
    runs-on: ubuntu-latest
    name: Scan for Vulnerabilities
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Install net10.0
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x
      - name: Set up .NET NuGet authentication
        run: |
          dotnet nuget add source "https://nuget.pkg.github.com/TrogonStack/index.json" \
            --name "github" \
            --username ${{ github.actor }} \
            --password ${{ secrets.GITHUB_TOKEN }} \
            --store-password-in-clear-text
      - name: Scan for Vulnerabilities
        run: |
          cd src
          dotnet restore
          dotnet list package --vulnerable --include-transitive | tee vulnerabilities.txt
          ! cat vulnerabilities.txt | grep -q "has the following vulnerable packages"

  protolock:
    runs-on: ubuntu-latest
    name: Protolock Status
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Protolock Status
        shell: bash
        run: |
          ./protolock.sh status --uptodate
  docker-compose:
    runs-on: ubuntu-latest
    name: Docker Compose Smoke Test
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Github Registry Docker Login
        uses: docker/login-action@v4
        with:
          registry: docker.pkg.github.com
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Docker Compose Smoke Test
        env:
          DOCKER_BUILDKIT: 1
          NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          docker compose build
          docker compose up --detach
          printf 'Waiting for cluster'
          timeout 60 bash -c -- 'until curl --output /dev/null --silent --insecure --fail https://localhost:2113/-/readiness; do printf '.'; sleep 2; done'
          docker compose down