compliance.yml

name: Compliance

on: pull_request

permissions:
  contents: read

env:
  WEST_PATH_CACHE: ${{ github.workspace }}/west-path-cache

jobs:
  compliance_job:
    runs-on: ubuntu-24.04
    name: Run compliance checks on patch series (PR)
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          path: ncs-matter
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Rebase PR
        working-directory: ncs-matter
        run: |
          git config user.email "pylon@nordicsemi.no"
          git config user.name "Nordic Builder"
          git fetch origin "${{ github.base_ref }}"
          git rebase "origin/${{ github.base_ref }}"

      - name: Restore west module path cache
        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
        with:
          path: west-path-cache
          key: west-path-cache-${{ hashFiles('ncs-matter/west.yml') }}
          restore-keys: |
            west-path-cache-

      - name: Prepare west workspace
        run: |
          pip3 install west
          rm -rf .west
          west init -l ncs-matter --mf west.yml
          west update -n -o=--depth=1 --path-cache "${WEST_PATH_CACHE}"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.12
          cache: pip
          cache-dependency-path: zephyr/scripts/requirements-compliance.txt
          pip-install: |
            -r zephyr/scripts/requirements-compliance.txt

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          cache: npm
          cache-dependency-path: ./zephyr/scripts/ci/package-lock.json

      - name: Install Node dependencies
        run: npm --prefix ./zephyr/scripts/ci ci

      - name: Run merge commits test
        env:
          BASE_REF: ${{ github.base_ref }}
        working-directory: ncs-matter
        run: |
          # Ensure there's no merge commits in the PR
          [[ "$(git rev-list --merges --count origin/${BASE_REF}..)" == "0" ]] || \
            (echo "::error ::Merge commits not allowed, rebase instead";false)

      - name: Run Compliance Tests
        continue-on-error: true
        id: compliance
        env:
          BASE_REF: ${{ github.base_ref }}
        working-directory: ncs-matter
        if: contains(github.event.pull_request.user.login, 'dependabot[bot]') != true
        run: |
          export ZEPHYR_BASE="${GITHUB_WORKSPACE}/zephyr"
          # debug
          ls -la
          git log --pretty=oneline | head -n 10

          # Exclusions aligned with sdk-nrf compliance.yml, plus add-on-specific
          # skips for checks that need the full NCS tree or nrf-only allowlists.
          export UNDEF_KCONFIG_OUTSIDE_ALLOWLIST_FILE="${GITHUB_WORKSPACE}/nrf/scripts/ci/nrf_undef_kconfig_allowlist.txt"

          $ZEPHYR_BASE/scripts/ci/check_compliance.py \
            -c origin/${BASE_REF}.. \
            --annotate \
            -e ClangFormat \
            -e Kconfig \
            -e KconfigBasic \
            -e KconfigBasicNoModules \
            -e KconfigHWMv2 \
            -e SysbuildKconfig \
            -e SysbuildKconfigBasic \
            -e SysbuildKconfigBasicNoModules \
            -e LicenseAndCopyrightCheck \
            -e BinaryFiles \
            -e GitLint \
            -e PyLint \
            -e Ruff \
            -e YAMLLint \
            -e SphinxLint

      - name: upload-results
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
        continue-on-error: true
        if: contains(github.event.pull_request.user.login, 'dependabot[bot]') != true
        with:
          name: compliance.xml
          path: ncs-matter/compliance.xml
          overwrite: true

      - name: check-warns
        working-directory: ncs-matter
        if: contains(github.event.pull_request.user.login, 'dependabot[bot]') != true
        run: |
          export ZEPHYR_BASE="${GITHUB_WORKSPACE}/zephyr"
          if [[ ! -s "compliance.xml" ]]; then
            exit 1;
          fi

          files=($($ZEPHYR_BASE/scripts/ci/check_compliance.py -l))
          for file in "${files[@]}"; do
            f="${file}.txt"
            if [[ -s $f ]]; then
              errors=$(cat $f)
              errors="${errors//'%'/'%25'}"
              errors="${errors//$'\n'/'%0A'}"
              errors="${errors//$'\r'/'%0D'}"
              echo "::error file=${f}::$errors"
              exit=1
            fi
          done

          if [ "${exit}" == "1" ]; then
            exit 1;
          fi

      - name: Check added or updated links
        working-directory: ncs-matter
        run: |
          RE='.. _`(.*)`: (.*)'
          LINKS=$(git diff --unified=0 "${{ github.event.pull_request.base.sha }}..HEAD" -- "doc/links.txt" | \
                  grep "^+" | grep -Ev "^(---|\+\+\+)" || true)

          NCS_VERSION=$(python3 -c "
          import sys
          import west.manifest
          try:
              projects = west.manifest.Manifest.from_topdir().get_projects(['nrf'])
              if not projects or not projects[0].revision:
                  raise RuntimeError('nrf project missing or has no revision')
              rev = projects[0].revision
              print(rev[1:] if rev.startswith('v') else rev)
          except Exception as e:
              print(f'::error ::Could not determine NCS version from west manifest: {e}', file=sys.stderr)
              sys.exit(1)
          ")

          echo "Resolved NCS version from manifest: ${NCS_VERSION}"

          while IFS= read -r link; do
            if [[ $link =~ $RE ]]; then
              NAME=${BASH_REMATCH[1]}
              URL=${BASH_REMATCH[2]}
              URL="${URL//|ncs_version|/${NCS_VERSION}}"

              echo -n "Checking URL for '$NAME' ($URL)... "
              if [[ "$URL" == *"files.nordicsemi.com"* ]] || \
                 [[ "$URL" == *"docs.nordicsemi.com"* ]] || \
                 [[ "$URL" == *"nrfconnectdocs.nordicsemi.com"* ]]; then
                # Nordic CDN often blocks HEAD and CI/datacenter clients; use browser-like GET
                status=$(curl --write-out "%{http_code}" --output /dev/null --silent -L \
                  -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" \
                  -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" \
                  "$URL" || true)
              else
                status=$(curl --write-out "%{http_code}" --output /dev/null --silent --head "$URL" || true)
              fi

              if [[ "$status" -eq 200 ]]; then
                echo "OK"
              elif [[ "$status" -eq 403 ]] && \
                   { [[ "$URL" == *"files.nordicsemi.com"* ]] || \
                     [[ "$URL" == *"docs.nordicsemi.com"* ]] || \
                     [[ "$URL" == *"nrfconnectdocs.nordicsemi.com"* ]]; }; then
                echo "SKIP (HTTP 403 from Nordic CDN for CI runner)"
              else
                echo "FAIL (HTTP code: ${status})"
                exit=1
              fi
            fi
          done <<< "$LINKS"

          if [ "${exit}" == "1" ]; then
            exit 1;
          fi