ci.yml

name: CI

on:
  pull_request:
    branches:
      - main
      - release/v*

jobs:
  security_hardening:
    name: Check security hardening
    runs-on: ubuntu-latest
    steps:
    - name: Clone the repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
    - name: Ensure SHA pinned actions
      uses: zgosalvez/github-actions-ensure-sha-pinned-actions@4830be28ce81da52ec70d65c552a7403821d98d4

  testing:
    name: Run ${{ matrix.category }} testing
    needs: security_hardening
    runs-on: ubuntu-latest
    strategy:
      matrix:
        category: [static, unit, widget]
      fail-fast: false
    steps:
    - name: Clone the repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      with:
        path: code
    - name: Get Flutter version
      id: get-flutter-version
      uses: zgosalvez/github-actions-get-flutter-version-env@22ab458dabc3aa2dce4dd9f1632a6800869d00de
      with:
        pubspec-file-path: code/pubspec.yaml
    - name: Cache Flutter
      id: flutter-cache
      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684
      with:
        path: flutter
        key: ${{ env.cache-name }}-ubuntu-latest-${{ steps.get-flutter-version.outputs.version }}-${{ hashFiles('code/pubspec.lock') }}
        restore-keys: |
          ${{ env.cache-name }}-ubuntu-latest-${{ steps.get-flutter-version.outputs.version }}-
          ${{ env.cache-name }}-ubuntu-latest-
          ${{ env.cache-name }}-
      env:
        cache-name: flutter-cache
    - name: Clone the Flutter repository
      if: steps.flutter-cache.outputs.cache-hit != 'true'
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      with:
        repository: flutter/flutter
        ref: ${{ steps.get-flutter-version.outputs.version }}
        path: flutter
    - name: Add the flutter tool to the path
      run: |
        echo "$GITHUB_WORKSPACE/flutter/bin" >> $GITHUB_PATH
        echo "$GITHUB_WORKSPACE/flutter/bin/cache/dart-sdk/bin" >> $GITHUB_PATH
    - name: Populate the Flutter tool's cache of binary artifacts
      if: steps.flutter-cache.outputs.cache-hit != 'true'
      run: |
        flutter config --no-analytics
        flutter precache
    - name: Get Flutter packages
      run: flutter pub get
      working-directory: code
    - name: Analyze Flutter
      if: matrix.category == 'static'
      uses: zgosalvez/github-actions-analyze-dart@92375956021937d35938504eefb62b18bfebb154
      with:
        fail-on-warnings: true
        working-directory: code
    - name: Run Flutter ${{ matrix.category }} tests
      if: matrix.category != 'static'
      run: flutter test --no-pub --coverage --coverage-path=./coverage/lcov.${{ matrix.category }}.info test/${{ matrix.category }}s
      working-directory: code
    - name: Upload code coverage to GitHub
      if: matrix.category != 'static'
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
      with:
        name: code-coverage-${{ matrix.category }}
        path: code/coverage/lcov.${{ matrix.category }}.info

  coverage_report:
    name: Generate coverage report
    needs: testing
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
    - name: Clone the repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
    - name: Setup LCOV
      uses: hrishikesh-kadam/setup-lcov@6c1aa0cc9e1c02f9f58f01ac599f1064ccc83470
    - name: Download code coverage from GitHub
      uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
      with:
        path: coverage
        pattern: code-coverage-*
        merge-multiple: true
    - name: Report code coverage
      uses: zgosalvez/github-actions-report-lcov@55c5634f4f1085c376473dfd5971662ced3b9dc1
      with:
        coverage-files: coverage/lcov.*.info
        minimum-coverage: 90
        artifact-name: code-coverage-report
        github-token: ${{ secrets.GITHUB_TOKEN }}