ci-pr-only.yml

name: CI PR Only
# Jobs that run on PRs, but no other pipelines

on:
  pull_request:
    types: [opened, synchronize, reopened]
permissions: read-all
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
  cancel-in-progress: true
env:
  CI_MERGE_REQUEST_TITLE: ${{ github.event.pull_request.title }}
  CI_PIPELINE_SOURCE: ${{ github.event_name }}
  CI_PROJECT_DIR: ${{ github.workspace }}
  DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
  DOCKER_HUB_PASSWORD_RO: ${{ secrets.DOCKER_HUB_PASSWORD_RO }}
  ORG: ${{ github.repository_owner }}
jobs:
  bazel-build-fuzzers-archives:
    name: Bazel Build Fuzzers Archives
    runs-on:
      labels: dind-large
    container:
      image: ghcr.io/dfinity/ic-build@sha256:26cc347efa50935342742acddfb5d710fae1982d401911013ad8750f0603c590
    timeout-minutes: 90
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Before script
        id: before-script
        shell: bash
        run: ./gitlab-ci/src/ci-scripts/before-script.sh
      - name: Filter Relevant Files
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: filter
        with:
          filters: |
            fuzzers:
              - '.github/workflows/pr-only.yml'
              - 'bin/build-all-fuzzers.sh'
              - 'bazel/fuzz_testing.bzl'
      - name: Run Bazel Build Fuzzers Archives
        id: bazel-build-fuzzers-archives
        if: steps.filter.outputs.fuzzers == 'true'
        shell: bash
        run: |
          set -euo pipefail
          cd "${GITHUB_WORKSPACE}"/bin
          ./build-all-fuzzers.sh --zip
  lock-generate:
    name: Lock Generate
    runs-on:
      labels: dind-small
    container:
      image: ghcr.io/dfinity/ic-build@sha256:26cc347efa50935342742acddfb5d710fae1982d401911013ad8750f0603c590
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Before script
        id: before-script
        shell: bash
        run: ./gitlab-ci/src/ci-scripts/before-script.sh
      - name: Filter Relevant Files
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: filter
        with:
          filters: |
            lock-generate:
              - '.github/workflows/pr-only.yml'
              - '.bazelrc'
              - '.bazelversion'
              - '**/*.bazel'
              - '**/*.bzl'
              - '**/*.lock'
              - '**/*.rs'
              - '**/*.toml'
      - name: Run Lock Generate
        id: lock-generate
        if: steps.filter.outputs.lock-generate == 'true'
        run: ./gitlab-ci/src/ci-scripts/lock-generate.sh
  pre-commit:
    name: Pre Commit Test
    runs-on:
      labels: dind-small
    container:
      image: ghcr.io/dfinity/ic-build@sha256:26cc347efa50935342742acddfb5d710fae1982d401911013ad8750f0603c590
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 256
      - name: Pre-Commit
        id: pre-commit
        shell: bash
        run: ./gitlab-ci/src/ci-scripts/pre-commit.sh
  # TODO: remove when migration complete
  change-base-branch:
    name: Change Base Branch
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Run script
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          python $CI_PROJECT_DIR/.github/scripts/change-base-branch.py
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_TOKEN: ${{ secrets.IDX_PUSH_TO_PR }}