ci.yml

name: CI

on:
  pull_request:
    branches: [develop, main]

# Least privilege: the token can only read; a job that needs more asks for it itself.
permissions:
  contents: read

jobs:
  unit-tests:
    name: Unit Tests - ${{ matrix.framework }}
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    strategy:
      fail-fast: false
      matrix:
        framework: [net8.0, net10.0]

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: |
            8.0.x
            10.0.x

      - name: Cache NuGet packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', 'Directory.Build.props') }}
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore
        run: dotnet restore

      # One project at a time, only the projects that target this runtime (the samples and their tests are net10.0 only).
      # Coverage is collected on the net8.0 leg only; the net10.0 leg exists to catch a runtime behaviour change.
      - name: Test
        env:
          FRAMEWORK: ${{ matrix.framework }}
          FILTER: Category!=Integration&Category!=Reliability&Category!=Stress&FullyQualifiedName!~Reliability&FullyQualifiedName!~Integration&FullyQualifiedName!~Stress
        run: |
          COLLECT=()
          if [ "$FRAMEWORK" = "net8.0" ]; then COLLECT=(--collect:"XPlat Code Coverage" --results-directory ./coverage/); fi
          STATUS=0
          for dir in tests/*/; do
            name=$(basename "$dir")
            [ -f "${dir}${name}.csproj" ] || continue
            # The filter excludes these projects entirely: do not build them.
            case "$name" in *IntegrationTests|*ReliabilityTests|*StressTests) continue ;; esac
            # Only the projects that target this runtime (the samples and their tests are net10.0 only).
            [ "$FRAMEWORK" = "net8.0" ] && [ "$name" = "NexJob.Samples.Tests" ] && continue
            # By project, not by dll: the coverage collector is resolved from the project's restored packages.
            # Builds only this project and its references, for this framework only.
            dotnet test "${dir}${name}.csproj" --no-restore --configuration Release --framework "$FRAMEWORK" --filter "$FILTER" "${COLLECT[@]}" --blame-hang --blame-hang-timeout 10m || STATUS=1
          done
          exit $STATUS

      - name: Debug Coverage Files
        if: matrix.framework == 'net8.0'
        run: |
          echo "Listing all XML files in ./coverage:"
          find ./coverage -name "*.xml"

      - name: Install ReportGenerator
        if: matrix.framework == 'net8.0'
        run: dotnet tool install --global dotnet-reportgenerator-globaltool

      - name: Generate Coverage Report
        if: matrix.framework == 'net8.0'
        run: |
          reportgenerator \
            -reports:"./coverage/**/*.xml" \
            -targetdir:"./coverage-report" \
            -reporttypes:TextSummary \
            -title:NexJob-Coverage \
            -assemblyfilters:"+NexJob;+NexJob.Dashboard;+NexJob.Dashboard.Standalone;+NexJob.Kafka;+NexJob.RabbitMQ;+NexJob.Trigger.*" \
            -classfilters:"-Eventbus.V1.*"

      - name: Check Coverage Threshold
        if: matrix.framework == 'net8.0'
        run: |
          COVERAGE=$(grep "Line coverage" ./coverage-report/Summary.txt | awk '{print $3}' | sed 's/%//')
          echo "Current Line Coverage: $COVERAGE%"
          if (( $(echo "$COVERAGE < 80.0" | bc -l) )); then
            echo "Error: Line coverage ($COVERAGE%) is below 80%"
            exit 1
          fi

      - name: Upload unit test artifacts
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: unit-test-artifacts-${{ matrix.framework }}
          path: |
            **/TestResults/**/*.trx
            ./coverage-report/**

  integration-tests:
    name: Integration Tests - ${{ matrix.name }} - ${{ matrix.framework }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        framework: [net8.0, net10.0]
        name: [InMemory-EndToEnd, Reliability-InMemory, Redis, Postgres, Mongo, SqlServer, RabbitMQ, Kafka, Sqs, Salesforce, GooglePubSub]
        include:
          - name: InMemory-EndToEnd
            project: tests/NexJob.IntegrationTests
            filter: '(FullyQualifiedName~InMemoryStorageProviderTests)|(FullyQualifiedName~JobExecutionEndToEndTests)|(FullyQualifiedName~InMemoryShutdownRequeueEndToEndTests)|(FullyQualifiedName~InMemoryFilterOutcomeEndToEndTests)'
          - name: Reliability-InMemory
            project: tests/NexJob.ReliabilityTests
            filter: 'Category=Reliability.InMemory'
          - name: Redis
            project: tests/NexJob.IntegrationTests
            filter: 'FullyQualifiedName~Redis'
          - name: Postgres
            project: tests/NexJob.IntegrationTests
            filter: 'FullyQualifiedName~Postgres'
          - name: Mongo
            project: tests/NexJob.IntegrationTests
            filter: 'FullyQualifiedName~Mongo'
          - name: SqlServer
            project: tests/NexJob.IntegrationTests
            filter: 'FullyQualifiedName~SqlServer'
          - name: RabbitMQ
            project: tests/NexJob.RabbitMQ.IntegrationTests
            filter: ''
          - name: Kafka
            project: tests/NexJob.Kafka.IntegrationTests
            filter: ''
          - name: Sqs
            project: tests/NexJob.Trigger.AwsSqs.IntegrationTests
            filter: ''
          - name: Salesforce
            project: tests/NexJob.Trigger.Salesforce.IntegrationTests
            filter: ''
          - name: GooglePubSub
            project: tests/NexJob.Trigger.GooglePubSub.IntegrationTests
            filter: ''

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: |
            8.0.x
            10.0.x

      - name: Cache NuGet packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', 'Directory.Build.props') }}
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore
        run: dotnet restore ${{ matrix.project }}

      - name: Run integration tests
        run: |
          if [ -n "${{ matrix.filter }}" ]; then
            dotnet test ${{ matrix.project }} \
              --no-restore \
              --configuration Release \
              --framework ${{ matrix.framework }} \
              --verbosity normal \
              --filter "${{ matrix.filter }}" \
              --logger "trx;LogFileName=${{ matrix.name }}-${{ matrix.framework }}.trx" \
              --blame-hang \
              --blame-hang-timeout 5m
          else
            dotnet test ${{ matrix.project }} \
              --no-restore \
              --configuration Release \
              --framework ${{ matrix.framework }} \
              --verbosity normal \
              --logger "trx;LogFileName=${{ matrix.name }}-${{ matrix.framework }}.trx" \
              --blame-hang \
              --blame-hang-timeout 5m
          fi

      - name: Upload integration test artifacts
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: integration-${{ matrix.name }}-${{ matrix.framework }}-artifacts
          path: |
            ${{ matrix.project }}/TestResults/**/*.trx
            ${{ matrix.project }}/TestResults/**/*

  format-check:
    name: Format Check
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: |
            8.0.x
            10.0.x

      - name: Cache NuGet packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', 'Directory.Build.props') }}
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore
        run: dotnet restore

      - name: Check formatting
        run: dotnet format --verify-no-changes --severity warn --no-restore

  docs-truth:
    name: Docs Truth
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    # Reports the drift between the code and the wiki. It does not block the pull request yet: it becomes
    # blocking (--strict, no continue-on-error) when the baseline stays at zero.
    continue-on-error: true

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: |
            8.0.x
            10.0.x

      - name: Compare the code with the wiki
        run: |
          dotnet run --project tools/DocsTruth -c Release -- --report docs-truth-report.md --strict || STATUS=$?
          cat docs-truth-report.md >> "$GITHUB_STEP_SUMMARY"
          exit "${STATUS:-0}"

  security-scan:
    name: Security Scan
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: |
            8.0.x
            10.0.x

      - name: Cache NuGet packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', 'Directory.Build.props') }}
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore
        run: dotnet restore

      - name: Check for vulnerabilities
        run: |
          dotnet list package --vulnerable --include-transitive 2>&1 | tee vulnerable.txt
          if grep -q "has the following vulnerable packages" vulnerable.txt; then
            echo "Vulnerable packages found!"
            cat vulnerable.txt
            exit 1
          fi
          echo "No vulnerable packages found"

      - name: Upload security scan output
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: security-scan-output
          path: vulnerable.txt