name: CI

on:
  push:
    branches:
      - main
      - renovate/**

  pull_request:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: macos-26
    steps:
    - name: Setup build environment
      uses: msfjarvis/compose-lobsters/.github/reusable-workflows/setup-gradle@main
      with:
        fetch-depth: 0
        cache-read-only: ${{ github.ref != 'refs/heads/main' }}
        dependency-graph: generate-and-submit

    - name: Check changelog format
      uses: mindsers/changelog-reader-action@1faaf50aa09d5793d9a100819973df801febfb31 # v2.4.0
      with:
        path: ./CHANGELOG.md
        validation_level: error

    - name: Run unit tests
      run: ./gradlew --no-configuration-cache --stacktrace :build-logic:check check -PslimTests
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: (Fail-only) Upload test report
      if: failure()
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
          name: Test report
          path: '**/build/reports/tests/**'

  dependency-review:
    runs-on: macos-26
    if: "github.event_name == 'push' && github.event.ref != 'refs/heads/main'"
    needs:
      - check
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          base-ref: refs/heads/main
          head-ref: ${{ github.ref }}

  release-app:
    runs-on: macos-26
    needs:
      - check
    steps:
      - name: Setup build environment
        uses: msfjarvis/compose-lobsters/.github/reusable-workflows/setup-gradle@main
        with:
          cache-read-only: true

      - name: Build release app
        run: |
          ./scripts/setup-age.sh
          ./scripts/signing-setup.sh "$AGE_SECRET_KEY"
          ./gradlew --no-configuration-cache --stacktrace assembleRelease collectReleaseBundle
          ./scripts/signing-cleanup.sh
        env:
          AGE_SECRET_KEY: ${{ secrets.AGE_SECRET_KEY }}
