ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  DOTNET_NOLOGO: "true"
  DOTNET_CLI_TELEMETRY_OPTOUT: "true"
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "true"
  CONFIGURATION: Release
  SOLUTION: AndroidTreeView.sln

jobs:
  build-test:
    name: Build & Test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore ${{ env.SOLUTION }} -p:EnableWindowsTargeting=true

      - name: Build
        run: dotnet build ${{ env.SOLUTION }} -c ${{ env.CONFIGURATION }} --no-restore -p:EnableWindowsTargeting=true

      - name: Test
        run: >-
          dotnet test ${{ env.SOLUTION }}
          -c ${{ env.CONFIGURATION }}
          --no-build
          -p:EnableWindowsTargeting=true
          --logger trx
          --results-directory test-results

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: test-results-${{ matrix.os }}
          path: test-results/**/*.trx
          if-no-files-found: warn

  vulnerabilities:
    name: Vulnerability scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore ${{ env.SOLUTION }} -p:EnableWindowsTargeting=true

      - name: Check for vulnerable packages
        shell: bash
        run: |
          set -euo pipefail
          dotnet list ${{ env.SOLUTION }} package --vulnerable --include-transitive 2>&1 | tee vulnerable.log
          if grep -q "has the following vulnerable packages" vulnerable.log; then
            echo "::error::Vulnerable NuGet packages detected. See the log above."
            exit 1
          fi
          echo "No vulnerable packages detected."

  format:
    name: Format check (non-blocking)
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore ${{ env.SOLUTION }} -p:EnableWindowsTargeting=true

      - name: dotnet format --verify-no-changes
        run: dotnet format ${{ env.SOLUTION }} --verify-no-changes --verbosity diagnostic