name: SonarCloud + Jest Coverage

on:
  merge_group:
  workflow_dispatch:
  # Trigger analysis when pushing in master or pull requests, and when creating
  # a pull request.
  # Note: paths filter removed — the workflow always triggers so that the
  # required status check (coverage-result) always completes. Path filtering
  # is handled inside the workflow via dorny/paths-filter, which lets PRs
  # without UI changes skip the expensive jobs while still reporting a
  # passing status.
  pull_request_target:
    types: [opened, synchronize, reopened, labeled, ready_for_review]

permissions:
  contents: read
  pull-requests: write # Required for Providing Jest Coverage Comment

env:
  UI_WORKING_DIRECTORY: openmetadata-ui/src/main/resources/ui
  UI_COVERAGE_DIRECTORY: openmetadata-ui/src/main/resources/ui/src/test/unit/coverage
concurrency:
  group: yarn-coverage-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
jobs:
  check-changes:
    runs-on: ubuntu-latest
    outputs:
      ui-changed: ${{ steps.filter.outputs.ui }}
    steps:
      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            ui:
              - 'openmetadata-ui/src/main/resources/ui/src/**'
              - 'openmetadata-ui/src/main/resources/ui/jest.config.js'
              - 'openmetadata-ui/src/main/resources/ui/package.json'
              - 'openmetadata-ui/src/main/resources/ui/yarn.lock'
              - 'openmetadata-ui/src/main/resources/ui/tsconfig.json'
              - 'openmetadata-ui/src/main/resources/ui/babel.config.json'
              - 'openmetadata-ui/src/main/resources/ui/.nvmrc'
              - 'openmetadata-ui/src/main/resources/ui/sonar-project.properties'

  ui-coverage-tests:
    needs: check-changes
    runs-on: ubuntu-latest
    if: |
      !github.event.pull_request.draft &&
      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || needs.check-changes.outputs.ui-changed == 'true') &&
      (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test')
    steps:
      - name: Wait for the labeler
        uses: lewagon/wait-on-check-action@v1.7.0
        if: ${{ github.event_name == 'pull_request_target' }}
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          check-name: Team Label
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 90

      - name: Verify PR labels
        uses: jesusvasquez333/verify-pr-label-action@v1.4.0
        if: ${{ github.event_name == 'pull_request_target' }}
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
          valid-labels: "safe to test"
          pull-request-number: "${{ github.event.pull_request.number }}"
          disable-reviews: true # To not auto approve changes

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
          # Disabling shallow clone is recommended for improving relevancy of reporting.
          # Use partial clone (blob:none) to avoid downloading every blob in history —
          # commits/trees still available for Sonar blame; blobs fetched lazily as needed.
          fetch-depth: 0
          filter: blob:none

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: "openmetadata-ui/src/main/resources/ui/.nvmrc"

      - name: Get yarn cache directory path
        id: yarn-cache-dir-path
        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT

      - name: Caching NPM dependencies
        uses: actions/cache@v4
        id: yarn-cache
        with:
          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
          key: ${{ runner.os }}-node-yarn-${{ hashFiles('**/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-node-yarn-

      - name: Get npm cache directory
        id: npm-cache-dir
        shell: bash
        run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}

      - name: Caching NPM dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: ${{ steps.npm-cache-dir.outputs.dir }}
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install Antlr4 CLI
        run: |
          sudo make install_antlr_cli
      - name: Install Yarn Packages
        working-directory: ${{ env.UI_WORKING_DIRECTORY }}
        run: yarn install
      - name: Run Coverage
        working-directory: ${{ env.UI_WORKING_DIRECTORY }}
        run: yarn test:cov-summary
        id: yarn_coverage
      - name: Jest coverage comment
        uses: MishaKav/jest-coverage-comment@v1.0.22
        with:
          coverage-summary-path: ${{env.UI_COVERAGE_DIRECTORY}}/coverage-summary.json
          title: Jest test Coverage
          summary-title: UI tests summary
          badge-title: Coverage
      - name: yarn add sonarqube-scanner
        working-directory: ${{ env.UI_WORKING_DIRECTORY }}
        run: npm install -g sonarqube-scanner
        id: npm_install_sonar_scanner
      - name: SonarCloud Scan On PR
        if: github.event_name == 'pull_request_target' && steps.npm_install_sonar_scanner.outcome == 'success'
        working-directory: ${{ env.UI_WORKING_DIRECTORY }}
        run: |
          sonar-scanner -Dsonar.host.url=${SONARCLOUD_URL} \
          -Dproject.settings=sonar-project.properties \
          -Dsonar.pullrequest.key=${{ github.event.pull_request.number }} \
          -Dsonar.pullrequest.branch=$PR_HEAD_REF \
          -Dsonar.pullrequest.base=main \
          -Dsonar.pullrequest.github.repository=OpenMetadata \
          -Dsonar.scm.revision=${{ github.event.pull_request.head.sha }} \
          -Dsonar.pullrequest.provider=github \
          -Dsonar.scm.disabled=true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.UI_SONAR_TOKEN }}
          SONARCLOUD_URL: https://sonarcloud.io
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
      - name: SonarCloud Scan
        if: github.event_name == 'push' && steps.npm_install_sonar_scanner.outcome == 'success'
        working-directory: ${{ env.UI_WORKING_DIRECTORY }}
        run: |
          sonar-scanner -Dsonar.host.url=${SONARCLOUD_URL} \
          -Dproject.settings=sonar-project.properties
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.UI_SONAR_TOKEN }}
          SONARCLOUD_URL: https://sonarcloud.io

  # This job is the one to set as the required status check in branch protection.
  # It always runs and passes when ui-coverage-tests succeeded OR was skipped
  # (i.e. no relevant UI paths changed), so PRs without UI changes are never blocked.
  ui-coverage:
    if: always()
    needs: [ui-coverage-tests]
    runs-on: ubuntu-latest
    steps:
      - name: Check coverage result
        run: |
          result="${{ needs.ui-coverage-tests.result }}"
          if [[ "$result" == "success" || "$result" == "skipped" ]]; then
            echo "Coverage check passed or was not required for this PR"
          else
            echo "Coverage check failed with status: $result"
            exit 1
          fi