ci.yml

name: CI

on:
  pull_request:
    paths-ignore:
      - 'website/**'
  push:
    branches: [ main ]
    paths-ignore:
      - 'website/**'

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  test:
    name: Pester (${{ matrix.os }})
    runs-on: ${{ matrix.os }}

    permissions:
      contents: read
      actions: write
      checks: write
      pull-requests: write

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]

    steps:
      - uses: actions/checkout@v6

      - name: Run Pester
        shell: pwsh
        run: pwsh -NoProfile -File ./tools/Invoke-IdlePesterTests.ps1 -CI

      - name: Upload Pester artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: pester-artifacts-${{ matrix.os }}
          if-no-files-found: warn
          path: |
            artifacts/test-results.xml
            artifacts/coverage.xml

      - name: Publish test results
        if: always() && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository)
        uses: dorny/test-reporter@v3
        with:
          name: Pester Tests (${{ matrix.os }})
          path: artifacts/test-results.xml
          reporter: java-junit
          fail-on-error: false

      - name: Publish coverage report
        if: always() && matrix.os == 'ubuntu-latest' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository)
        uses: madrapps/jacoco-report@v1.7.2
        with:
          paths: artifacts/coverage.xml
          token: ${{ secrets.GITHUB_TOKEN }}
          min-coverage-overall: 0
          min-coverage-changed-files: 0
          title: Code Coverage Report
          update-comment: true
          skip-if-no-changes: false

      - name: Add coverage to job summary
        if: always() && matrix.os == 'ubuntu-latest'
        shell: pwsh
        run: |
          Set-StrictMode -Version Latest
          $ErrorActionPreference = 'Stop'
          
          $coverageXml = 'artifacts/coverage.xml'
          if (Test-Path $coverageXml) {
            try {
              [xml]$coverage = Get-Content $coverageXml
              
              # Get the report element (root) and its direct counter children (JaCoCo XML format)
              $reportElement = $coverage.DocumentElement
              if ($reportElement -and $reportElement.LocalName -eq 'report') {
                $counters = $reportElement.ChildNodes | Where-Object { $_.LocalName -eq 'counter' }
                $lineCounter = $counters | Where-Object { $_.type -eq 'LINE' } | Select-Object -First 1
                
                if ($lineCounter -and
                    $lineCounter.PSObject.Properties['covered'] -and
                    $lineCounter.PSObject.Properties['missed']) {
                  try {
                    $covered = [int]$lineCounter.covered
                    $missed = [int]$lineCounter.missed
                    $total = $covered + $missed
                    
                    if ($total -gt 0) {
                      $percentage = [math]::Round(($covered / $total) * 100, 2)
                      
                      # Build summary using array and join for better readability
                      $summaryLines = @(
                        '## Code Coverage Summary'
                        ''
                        "- **Coverage:** $percentage%"
                        "- **Lines Covered:** $covered / $total"
                      )
                      $summary = $summaryLines -join "`n"
                      $summary | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append
                    }
                  }
                  catch {
                    Write-Host 'Skipping coverage summary due to invalid or malformed coverage data.'
                  }
                }
              }
            }
            catch {
              Write-Host 'Skipping coverage summary due to error reading coverage file.'
            }
          }

  lint:
    name: PSScriptAnalyzer
    runs-on: ubuntu-latest

    permissions:
      contents: read
      actions: read
      security-events: write

    steps:
      - uses: actions/checkout@v6

      - name: Run PSScriptAnalyzer
        shell: pwsh
        run: pwsh -NoProfile -File ./tools/Invoke-IdleScriptAnalyzer.ps1 -CI

      - name: Upload PSScriptAnalyzer artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: psscriptanalyzer-artifacts
          if-no-files-found: warn
          path: |
            artifacts/pssa-results.json
            artifacts/pssa-results.sarif

      - name: Upload SARIF to GitHub Code Scanning
        if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: artifacts/pssa-results.sarif

  docs-cmdlet-reference:
    name: Verify cmdlet reference is up to date
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Install platyPS
        shell: pwsh
        run: |
          Set-StrictMode -Version Latest
          $ErrorActionPreference = 'Stop'

          # Ensure PSGallery does not prompt (non-interactive CI)
          if (Get-Command -Name Set-PSRepository -ErrorAction SilentlyContinue) {
            try {
              Set-PSRepository -Name PSGallery -InstallationPolicy Trusted -ErrorAction Stop
            } catch {
              # Ignore if not supported in this environment
            }
          }

          # platyPS is pinned for deterministic Markdown output.
          # See CONTRIBUTING.md for upgrade procedure.
          Install-Module -Name platyPS -RequiredVersion 0.14.2 -Scope CurrentUser -Force -AllowClobber -ErrorAction Stop

      - name: Debug platyPS version
        shell: pwsh
        run: |
          Get-Module -ListAvailable platyPS | Sort-Object Version -Descending | Select-Object -First 1 | Format-List Name,Version,Path

      - name: Generate cmdlet reference
        shell: pwsh
        run: |
          Set-StrictMode -Version Latest
          $ErrorActionPreference = 'Stop'
          pwsh -NoProfile -File ./tools/Generate-IdleCmdletReference.ps1

      - name: Verify working tree clean
        shell: bash
        run: |
          set -euo pipefail
          echo "== git status =="
          git status --porcelain || true

          echo "== git diff (first 200 lines) =="
          git diff | sed -n '1,200p' || true

          git diff --exit-code

  docs-step-reference:
    name: Verify step reference is up to date
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Generate step reference
        shell: pwsh
        run: |
          Set-StrictMode -Version Latest
          $ErrorActionPreference = 'Stop'
          pwsh -NoProfile -File ./tools/Generate-IdleStepReference.ps1

      - name: Verify working tree clean
        shell: bash
        run: |
          set -euo pipefail
          echo "== git status =="
          git status --porcelain || true

          echo "== git diff (first 200 lines) =="
          git diff | sed -n '1,200p' || true

          git diff --exit-code