# contains non-functional tests, like checks on docs
# and code style
name: Static Analysis

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
      - master

# automatically cancel in-progress builds if another commit is pushed
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# default to 0 permissions
# (job-level overrides add the minimal permissions needed)
permissions:
  contents: none

env:
  COMPILER: 'gcc'
  MAKEFLAGS: '-j4'
  OS_NAME: 'linux'

jobs:
  lint:
    name: lint
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          fetch-depth: 5
          persist-credentials: false
          submodules: false
      - name: Setup and run tests
        shell: bash
        run: |
          export TASK=lint
          export CONDA=${HOME}/miniforge
          export PATH=${CONDA}/bin:$HOME/.local/bin:${PATH}
          $GITHUB_WORKSPACE/.ci/setup.sh || exit 1
          $GITHUB_WORKSPACE/.ci/lint-all.sh || exit 1
  check-docs:
    name: check-docs
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          fetch-depth: 5
          persist-credentials: false
          submodules: true
      - name: Setup and run tests
        shell: bash
        run: |
          export TASK=check-docs
          export CONDA=${HOME}/miniforge
          export PATH=${CONDA}/bin:$HOME/.local/bin:${PATH}
          $GITHUB_WORKSPACE/.ci/setup.sh || exit 1
          $GITHUB_WORKSPACE/.ci/build-docs.sh || exit 1
  r-check-docs:
    name: r-package-check-docs
    timeout-minutes: 60
    runs-on: ubuntu-latest
    container: rocker/verse  # zizmor: ignore[unpinned-images]
    permissions:
      contents: read
    steps:
      - name: Trust git cloning LightGBM
        run: |
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          fetch-depth: 5
          persist-credentials: false
          submodules: true
      - name: Install packages
        shell: bash
        run: |
          Rscript ./.ci/install-r-deps.R --build --include=roxygen2
          sh build-cran-package.sh || exit 1
          R CMD INSTALL --with-keep.source lightgbm_*.tar.gz || exit 1
      - name: Test documentation
        shell: bash --noprofile --norc {0}
        run: |
          Rscript .ci/build-docs.R || exit 1
          num_doc_files_changed=$(
              git diff --name-only | grep --count -E "\.Rd|NAMESPACE"
          )
          if [[ ${num_doc_files_changed} -gt 0 ]]; then
              echo "Some R documentation files have changed. Please re-generate them and commit those changes."
              echo ""
              echo "    sh build-cran-package.sh"
              echo "    R CMD INSTALL --with-keep.source lightgbm_*.tar.gz"
              echo "    Rscript -e \"roxygen2::roxygenize('R-package/', load = 'installed')\""
              echo ""
              exit 1
          fi
  all-static-analysis-jobs-successful:
    if: always()
    runs-on: ubuntu-latest
    needs:
      - lint
      - check-docs
      - r-check-docs
    permissions:
      statuses: read
    steps:
      - name: Note that all tests succeeded
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}