ci.yml

name: CI

on:
  workflow_dispatch:
  push:
    branches: [main]
    tags-ignore:
      - 'v*'
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'specs/**'
      - '.specify/**'
      - 'CLAUDE.md'
      - 'CONTRIBUTING.md'
      - 'LICENSE'
      - '.gitignore'
  pull_request:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'specs/**'
      - '.specify/**'
      - 'CLAUDE.md'
      - 'CONTRIBUTING.md'
      - 'LICENSE'
      - '.gitignore'

permissions:
  contents: read

jobs:
  check-changes:
    name: Detect Code Changes
    runs-on: ubuntu-latest
    outputs:
      code-changed: ${{ steps.filter.outputs.code-files }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Check for code changes
        uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            code-files:
              - '**/*.go'
              - 'go.mod'
              - 'go.sum'
              - '.golangci.yml'

  lint:
    name: Lint
    runs-on: ubuntu-latest
    needs: check-changes

    steps:
      - name: Skip if no code changes
        if: needs.check-changes.outputs.code-changed != 'true'
        run: |
          echo "No code changes detected, skipping lint"
          exit 0

      - name: Checkout code
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/checkout@v6

      - name: Set up Go
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
          cache-dependency-path: go.sum

      - name: Cache golangci-lint
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/cache@v5
        with:
          path: ~/.cache/golangci-lint
          key: ${{ runner.os }}-golangci-lint-${{ hashFiles('.golangci.yml') }}
          restore-keys: |
            ${{ runner.os }}-golangci-lint-

      - name: Run golangci-lint
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.5
          args: --timeout=3m --build-tags integration

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest
    needs: check-changes

    steps:
      - name: Skip if no code changes
        if: needs.check-changes.outputs.code-changed != 'true'
        run: |
          echo "No code changes detected, skipping unit tests"
          exit 0

      - name: Checkout code
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/checkout@v6

      - name: Set up Go
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
          cache-dependency-path: go.sum

      - name: Set up Linux keychain (D-Bus + gnome-keyring)
        if: needs.check-changes.outputs.code-changed == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y gnome-keyring dbus-x11
        shell: bash

      - name: Run unit tests
        if: needs.check-changes.outputs.code-changed == 'true'
        run: |
          # Start D-Bus session
          eval $(dbus-launch --sh-syntax)
          # Start and unlock gnome-keyring for Secret Service API
          gnome-keyring-daemon --start --components=secrets &
          sleep 1
          echo "" | gnome-keyring-daemon --unlock
          # Run tests
          go test -v -coverprofile=coverage.txt -covermode=atomic ./...
        shell: bash

      - name: Upload coverage to Codecov
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: codecov/codecov-action@v5
        with:
          files: ./coverage.txt
          flags: unittests
          name: codecov-ubuntu
        continue-on-error: true

  integration-tests:
    name: Integration Tests (${{ matrix.os }})
    if: github.event_name == 'pull_request'
    runs-on: ${{ matrix.os }}
    needs: check-changes
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - name: Skip if no code changes
        if: needs.check-changes.outputs.code-changed != 'true'
        run: |
          echo "No code changes detected, skipping integration tests"
          exit 0

      - name: Checkout code
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/checkout@v6

      - name: Set up Go
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
          cache-dependency-path: go.sum

      - name: Run integration tests
        if: needs.check-changes.outputs.code-changed == 'true'
        run: go test -v -tags=integration -timeout 4m ./test/integration
        shell: bash

      - name: Check for TODO-skipped tests
        if: needs.check-changes.outputs.code-changed == 'true'
        run: |
          if grep -r 't.Skip("TODO:' test/integration; then
            echo "ERROR: Found TODO-skipped tests"
            exit 1
          fi
        shell: bash

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [check-changes, unit-tests, integration-tests]
    if: ${{ !failure() && !cancelled() }}

    steps:
      - name: Skip if no code changes
        if: needs.check-changes.outputs.code-changed != 'true'
        run: |
          echo "No code changes detected, skipping build"
          exit 0

      - name: Checkout code
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Go
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
          cache-dependency-path: go.sum

      - name: Run GoReleaser (snapshot)
        if: needs.check-changes.outputs.code-changed == 'true'
        uses: goreleaser/goreleaser-action@v6
        with:
          version: latest
          args: build --snapshot --clean