itsmechlark/http-auth0

name: Dev

on:
  pull_request:
    types: [opened, reopened, synchronize]

permissions:
  contents: read

jobs:
  setup_pr:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
      pull-requests: write
    # Dependabot no longer have access to secrets unless we move to pull_request_target.
    # Read more: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions
    if: ${{ github.actor != 'dependabot[bot]' }}
    steps:
      # Remove review_ready label when new commit push to PR
      - name: Remove review_ready label
        if: ${{ contains(github.event.pull_request.labels.*.name, 'review_ready') }}
        uses: actions/github-script@v6
        with:
          # Fallback to github action token with limited access
          # when DevOps token isn't available this happens on dependabot.
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.removeLabel({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'review_ready'
            })
      # Add wip label when new commit push to PR
      - name: Add wip label
        if: ${{ !contains(github.event.pull_request.labels.*.name, 'wip') }}
        uses: actions/github-script@v6
        with:
          # Fallback to github action token with limited access
          # when DevOps token isn't available this happens on dependabot.
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ['wip']
            })

  rubocop:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - uses: actions/cache@v3
      with:
        path: vendor/bundle
        key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
        restore-keys: |
          ${{ runner.os }}-gems-
    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: '3.0'
        bundler-cache: false
    - name: Install dependencies
      run: bundle install --jobs 4 --retry 3  

    - name: Run RuboCop
      run: bundle exec rubocop --parallel

  codespell:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: 3.8
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install codespell
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
    - name: Check spelling with codespell
      run: codespell --ignore-words=codespell.txt || exit 1

  unit_test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        ruby: ['2.7', '3.0', '3.1', '3.2']
    steps:
    - uses: actions/checkout@v4

    - uses: actions/cache@v3
      with:
        path: vendor/bundle
        key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
        restore-keys: |
          ${{ runner.os }}-gems-
    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: ${{ matrix.ruby }}
        bundler-cache: false
    - name: Install dependencies
      run: bundle install --jobs 4 --retry 3

    - name: Suppress git warnings
      run: git config --global init.defaultBranch main
    - name: Run RSpec
      run: bundle exec rspec

    - name: Coveralls Parallel
      uses: coverallsapp/github-action@v2
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        flag-name: unit-ruby-${{matrix.ruby }}
        parallel: true
        path-to-lcov: ./coverage/lcov/http-auth0.lcov

  finish:
    needs: unit_test
    runs-on: ubuntu-latest
    steps:
    - name: Upload coverage to Coveralls
      uses: coverallsapp/github-action@v2
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        parallel-finished: true
        file: ./coverage/lcov/http-auth0.lcov