dotnet.yml

name: Build and Test

on:
  push:
    branches:
      - main
    paths-ignore:
      - '**.md'
      - 'LICENSE'
      - 'LICENSES/**'
  pull_request:
    branches:
      - main
    paths-ignore:
      - '**.md'
      - 'LICENSE'
      - 'LICENSES/**'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  build:
    name: build (${{ matrix.os }}, ${{ matrix.test-framework }}, ${{ matrix.sdk-label }}, ${{ matrix.primary_lane }}, ${{ matrix.test-shard }})
    strategy:
      matrix:
        include:
          - os: ubuntu-24.04
            test-framework: net8.0
            sdk-versions: |
              8.0.413
              9.0.301
            sdk-label: 8.0.413 9.0.301
            primary_lane: true
            collect_coverage: true
            test-shard: index-command
            test-filter: FullyQualifiedName~CodeIndex.Tests.IndexCommandRunnerTests
          - os: ubuntu-24.04
            test-framework: net8.0
            sdk-versions: |
              8.0.413
              9.0.301
            sdk-label: 8.0.413 9.0.301
            primary_lane: false
            collect_coverage: true
            test-shard: remaining
            test-filter: FullyQualifiedName!~CodeIndex.Tests.IndexCommandRunnerTests
          - os: ubuntu-24.04
            test-framework: net9.0
            sdk-versions: 9.0.301
            sdk-label: 9.0.301
            primary_lane: false
            collect_coverage: false
            test-shard: full
            test-filter: ''
          - os: windows-2022
            test-framework: net8.0
            sdk-versions: |
              8.0.413
              9.0.301
            sdk-label: 8.0.413 9.0.301
            primary_lane: false
            collect_coverage: false
            test-shard: index-command
            test-filter: FullyQualifiedName~CodeIndex.Tests.IndexCommandRunnerTests
          - os: windows-2022
            test-framework: net8.0
            sdk-versions: |
              8.0.413
              9.0.301
            sdk-label: 8.0.413 9.0.301
            primary_lane: false
            collect_coverage: false
            test-shard: remaining
            test-filter: FullyQualifiedName!~CodeIndex.Tests.IndexCommandRunnerTests
          - os: macos-14
            test-framework: net8.0
            sdk-versions: |
              8.0.413
              9.0.301
            sdk-label: 8.0.413 9.0.301
            primary_lane: false
            collect_coverage: false
            test-shard: index-command
            test-filter: FullyQualifiedName~CodeIndex.Tests.IndexCommandRunnerTests
          - os: macos-14
            test-framework: net8.0
            sdk-versions: |
              8.0.413
              9.0.301
            sdk-label: 8.0.413 9.0.301
            primary_lane: false
            collect_coverage: false
            test-shard: remaining
            test-filter: FullyQualifiedName!~CodeIndex.Tests.IndexCommandRunnerTests
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Configure Windows test host
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./.github/scripts/configure-windows-test-host.ps1 -Workspace "${{ github.workspace }}"

      - name: Set up .NET SDK
        id: setup-dotnet
        continue-on-error: true
        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
        with:
          dotnet-version: ${{ matrix.sdk-versions }}

      - name: Retry .NET SDK setup
        if: steps.setup-dotnet.outcome == 'failure'
        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
        with:
          dotnet-version: ${{ matrix.sdk-versions }}

      - name: Cache NuGet packages
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.nuget/packages
            ~\AppData\Local\NuGet\packages
          # Locked restore keeps package inputs honest; avoid evicting the cache for project-only test edits.
          # locked restore がパッケージ入力を検証するため、テスト用 project だけの変更ではキャッシュを失効させない。
          key: ${{ runner.os }}-dotnet-nuget-${{ hashFiles('src/CodeIndex/packages.lock.json', 'tests/CodeIndex.HookIsolationFixture/packages.lock.json', 'tests/CodeIndex.Tests/packages.lock.json', 'tools/CodeIndex.Changelog/packages.lock.json', 'tools/CodeIndex.PackageNormalize/packages.lock.json', 'tools/CodeIndex.TestTelemetry/packages.lock.json') }}

      # --locked-mode requires every resolved package to match the committed
      # packages.lock.json so an unexpected transitive bump (including silent
      # native swaps under SQLitePCLRaw.bundle_e_sqlite3) fails the build
      # instead of slipping into CI/release artifacts. See issue #1556.
      # --locked-mode は packages.lock.json と完全一致する解決を強制するため、
      # SQLitePCLRaw.bundle_e_sqlite3 の native を含む推移依存の予期せぬ
      # bump が CI / release アーティファクトに紛れ込まずビルド失敗で気付ける。
      # 詳細は issue #1556 参照。
      - name: Restore dependencies
        if: matrix.primary_lane
        run: dotnet restore CodeIndex.sln --locked-mode

      - name: Restore test dependencies
        if: ${{ !matrix.primary_lane }}
        run: dotnet restore tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:RestoreTargetFrameworks=${{ matrix.test-framework }} --locked-mode

      - name: Audit NuGet package vulnerabilities
        if: matrix.primary_lane
        shell: pwsh
        run: |
          $auditOutput = dotnet list src/CodeIndex/CodeIndex.csproj package --vulnerable --include-transitive 2>&1
          $auditExitCode = $LASTEXITCODE

          $auditOutput | ForEach-Object { Write-Host $_ }

          if ($auditExitCode -ne 0) {
            exit $auditExitCode
          }

          if ($auditOutput -match '\b(High|Critical)\b') {
            throw "High or critical NuGet vulnerability detected."
          }

      - name: Verify Release test build
        if: matrix.primary_lane
        run: dotnet build tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework ${{ matrix.test-framework }} --no-restore -p:UseSharedCompilation=false

      - name: Verify developer task wrapper
        if: matrix.primary_lane
        run: make lint

      - name: Build
        if: ${{ !matrix.primary_lane }}
        run: dotnet build tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework ${{ matrix.test-framework }} --no-restore

      - name: Test
        id: test
        shell: pwsh
        run: |
          ./.github/scripts/run-dotnet-tests.ps1 `
            -Framework "${{ matrix.test-framework }}" `
            -CollectCoverage "${{ matrix.collect_coverage }}" `
            -BaseFilter "${{ matrix.test-filter }}"

      - name: Summarize TRX telemetry
        if: always() && steps.test.outputs.summarize == 'true'
        run: dotnet tools/CodeIndex.TestTelemetry/bin/Release/net8.0/CodeIndex.TestTelemetry.dll summarize --results-directory ./TestResults --top 10

      - name: Upload test results
        if: always() && steps.test.outcome != 'skipped' && (steps.test.outputs.summarize == 'true' || failure())
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: TestResults-${{ matrix.os }}-${{ matrix.test-framework }}-${{ matrix.test-shard }}
          if-no-files-found: warn
          overwrite: true
          retention-days: 14
          path: |
            TestResults/**/*.trx
            TestResults/**/*.txt
            TestResults/**/*.xml
            !TestResults/**/coverage.cobertura.xml

      - name: Upload diagnostic dumps
        if: failure() && steps.test.outcome != 'skipped'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        continue-on-error: true
        with:
          name: DiagnosticDumps-${{ matrix.os }}-${{ matrix.test-framework }}-${{ matrix.test-shard }}
          if-no-files-found: ignore
          overwrite: true
          retention-days: 7
          path: |
            TestResults/**/*.dmp
            TestResults/**/*.dump
            TestResults/**/*.hangdump

      - name: Upload coverage reports
        if: always() && matrix.collect_coverage && steps.test.outcome != 'skipped' && hashFiles('TestResults/**/coverage.cobertura.xml') != ''
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Coverage-${{ matrix.os }}-${{ matrix.test-framework }}-${{ matrix.test-shard }}
          if-no-files-found: warn
          overwrite: true
          retention-days: 14
          path: TestResults/**/coverage.cobertura.xml

      - name: Publish
        if: matrix.primary_lane && github.event_name != 'pull_request'
        run: dotnet publish src/CodeIndex/CodeIndex.csproj --configuration Release --no-build --no-restore --output publish

      - name: Upload build artifact
        if: matrix.primary_lane && github.event_name != 'pull_request'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: CodeIndex
          overwrite: true
          retention-days: 14
          path: publish/**