pr-gate.yml

# Required source-PR gate verifying that a conventional-commit declaration is consistent with its code and changelog entries.
# Mergify queue candidates skip these policy jobs because their generated metadata does not describe a source change.
name: PR Gate

on:
  # `edited` re-runs the source gate when the declaration changes; labels re-evaluate release readiness.
  pull_request:
    types: [opened, synchronize, reopened, edited, labeled, unlabeled]
    branches: [main]
  push:
    branches: [main]
  # Keeps this aggregator reporting if GitHub's native merge queue is ever enabled,
  # matching the sibling required-check workflows; jobs skip and the result skip-passes.
  merge_group:

# Cancel obsolete gate runs after new commits. Unrelated label events use a
# separate group so they cannot cancel the required PR Gate run.
concurrency:
  group: >-
    ${{ github.workflow }}-${{ github.head_ref || github.run_id }}-${{
      (github.event.action == 'labeled' || github.event.action == 'unlabeled') &&
      github.event.label.name != 'A-release' &&
      'ignored-label' ||
      'required'
    }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read # dorny/paths-filter reads the changed-file list

env:
  CLICOLOR: 1

jobs:
  changes:
    # Only the A-release label affects gate results; other label events are no-ops.
    if: >-
      (github.event.action != 'labeled' && github.event.action != 'unlabeled') ||
      github.event.label.name == 'A-release'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      queue_candidate: ${{ steps.classify.outputs.queue_candidate || 'false' }}
      semver: ${{ steps.filter.outputs.semver || 'true' }}
      breaking: ${{ steps.title.outputs.breaking }}
      type: ${{ steps.title.outputs.type }}
      conventional: ${{ steps.title.outputs.conventional }}
    steps:
      - name: Identify Mergify queue candidates
        id: classify
        if: github.event_name == 'pull_request'
        env:
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
          REPOSITORY: ${{ github.repository }}
        run: |
          queue_candidate=false
          if [[ "$PR_AUTHOR" == "mergify[bot]" ]] &&
             [[ "$HEAD_REPOSITORY" == "$REPOSITORY" ]] &&
             [[ "$HEAD_REF" == mergify/merge-queue/* ]]; then
            queue_candidate=true
          fi
          echo "queue_candidate=$queue_candidate" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true'
        with:
          persist-credentials: false
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true'
        with:
          filters: .github/path-filters.yml
      - name: Read the declaration from the PR title
        id: title
        if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true'
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          breaking_marker='^[a-z]+(\([^)]*\))?!:'
          conventional_marker='^([a-z]+)(\([^)]*\))?!?: .+'

          breaking=false
          type=
          conventional=false

          if [[ "$PR_TITLE" =~ $breaking_marker ]]; then
            breaking=true
          fi

          if [[ "$PR_TITLE" =~ $conventional_marker ]]; then
            conventional=true
            type="${BASH_REMATCH[1]}"
          elif [[ "$PR_TITLE" =~ ^([a-z]+) ]]; then
            type="${BASH_REMATCH[1]}"
          fi

          {
            echo "breaking=$breaking"
            echo "type=$type"
            echo "conventional=$conventional"
          } >> "$GITHUB_OUTPUT"

  semver-checks:
    needs: changes
    # Real work runs only on contributor pull requests that change Rust and do not already declare
    # a break with `!`. A declared break is allowed through; release-plz majors the version at release.
    if: >-
      github.event_name == 'pull_request' &&
      needs.changes.outputs.queue_candidate != 'true' &&
      needs.changes.outputs.semver == 'true' &&
      needs.changes.outputs.breaking == 'false'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Check out the PR head, not the merge commit, so the API delta is the PR's own.
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: false
      - name: Compute the baseline from the PR's fork point
        id: baseline
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          # `fetch-depth: 0` populates the base branch without persisting credentials.
          echo "rev=$(git merge-base "origin/$BASE_REF" HEAD)" >> "$GITHUB_OUTPUT"
      - uses: ./.github/actions/setup-zebra-build
      - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9
        with:
          # Gate the consumer-facing library crates only. zebrad is a binary whose build script
          # needs test-only protos absent from the baseline; zebra-test and zebra-utils are test
          # and tooling crates whose feature-gated APIs are not stability surfaces.
          exclude: zebrad, zebra-test, zebra-utils
          feature-group: default-features
          baseline-rev: ${{ steps.baseline.outputs.rev }}

  # This checks for changelog entries depending on the type of the PR (per title).
  # An entry is required for a crate if any file in the crate changed.
  # If the title indicates a breaking change, the changelog must also have a `### Breaking Changes` section.
  changelog-gate:
    needs: changes
    if: >-
      github.event_name == 'pull_request' &&
      needs.changes.outputs.queue_candidate != 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: false
      - name: Check declaration and package changelogs
        env:
          BASE_REF: ${{ github.base_ref }}
          BREAKING: ${{ needs.changes.outputs.breaking }}
          CONVENTIONAL: ${{ needs.changes.outputs.conventional }}
          DECLARED_TYPE: ${{ needs.changes.outputs.type }}
        run: |
          # `fetch-depth: 0` populates the base branch without persisting credentials.
          merge_base="$(git merge-base "origin/$BASE_REF" HEAD)"
          bash .github/scripts/validate-pr-changelogs.sh \
            "$merge_base" HEAD "$CONVENTIONAL" "$DECLARED_TYPE" "$BREAKING"

  # No branch rule or Mergify condition pins this worker's display name; Mergify consumes `pr-gate-result`.
  release-readiness:
    name: Release readiness
    if: >-
      github.event_name == 'pull_request' &&
      ((github.event.action != 'labeled' && github.event.action != 'unlabeled') ||
      github.event.label.name == 'A-release') &&
      startsWith(github.event.pull_request.head.ref, 'release-plz-') &&
      contains(github.event.pull_request.labels.*.name, 'A-release')
    runs-on: ubuntu-latest-xl
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Resolve release comparison
        id: release-target
        env:
          BASE_REF: ${{ github.base_ref }}
          TARGET_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          base_tip="$(git rev-parse "origin/${BASE_REF}")"
          base_sha="$(git merge-base "${base_tip}" "${TARGET_SHA}")"
          if [[ "${base_sha}" != "${base_tip}" ]]; then
            echo "::error title=Release PR is behind main::Wait for release-plz to update this PR before review."
            exit 1
          fi
          echo "base_sha=${base_sha}" >> "${GITHUB_OUTPUT}"
      # Checks if the changelogs have entries for the versions being released
      # (used in the in the release PR).
      - name: Validate release changelogs
        id: changelogs
        continue-on-error: true
        env:
          BASE_SHA: ${{ steps.release-target.outputs.base_sha }}
          TARGET_SHA: ${{ github.event.pull_request.head.sha }}
        run: .github/scripts/validate-release-changelogs.sh "${BASE_SHA}" "${TARGET_SHA}"
      - name: Install Cargo 1.91
        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        with:
          toolchain: 1.91.0
          cache-on-failure: true
      - name: Install libclang for librocksdb-sys bindgen
        run: |
          sudo timeout --kill-after=10s --foreground 180s apt-get \
            -o Acquire::Retries=3 \
            -o Acquire::http::Timeout=30 \
            -o Acquire::https::Timeout=30 \
            update
          sudo timeout --kill-after=10s --foreground 180s apt-get \
            -o Acquire::Retries=3 \
            -o Acquire::http::Timeout=30 \
            -o Acquire::https::Timeout=30 \
            install -y libclang-dev
      - name: Check desired release state
        id: cargo-release
        continue-on-error: true
        uses: ZcashFoundation/cargo-release@34a37595755444456ce0e2d2b1258d9a29c14fac
        with:
          phase: check
          base-sha: ${{ steps.release-target.outputs.base_sha }}
          target-sha: ${{ github.event.pull_request.head.sha }}
          github-token: ${{ github.token }}
      - name: Summarize release readiness
        if: always()
        env:
          CARGO_RELEASE_RESULT: ${{ steps.cargo-release.outcome }}
          CHANGELOG_RESULT: ${{ steps.changelogs.outcome }}
          PLAN: ${{ steps.cargo-release.outputs.plan }}
          REPORT: ${{ steps.cargo-release.outputs.report }}
        run: |
          {
            echo "## Release readiness"
            echo "| Validation | Result |"
            echo "| --- | --- |"
            echo "| Changelogs | \`${CHANGELOG_RESULT}\` |"
            echo "| Cargo release | \`${CARGO_RELEASE_RESULT}\` |"
            if [[ -n "${PLAN}" ]]; then
              echo '### Plan'
              echo '```json'
              jq . <<< "${PLAN}" || printf '%s\n' "${PLAN}"
              echo '```'
            fi
            if [[ -n "${REPORT}" ]]; then
              echo '### External state'
              echo '```json'
              jq . <<< "${REPORT}" || printf '%s\n' "${REPORT}"
              echo '```'
            fi
          } >> "${GITHUB_STEP_SUMMARY}"
      - name: Require successful release checks
        if: always()
        env:
          CARGO_RELEASE_RESULT: ${{ steps.cargo-release.outcome }}
          CHANGELOG_RESULT: ${{ steps.changelogs.outcome }}
        run: |
          if [[ "${CHANGELOG_RESULT}" != "success" || "${CARGO_RELEASE_RESULT}" != "success" ]]; then
            echo "::error title=Release readiness failed::Review each failed validation step and the job summary."
            exit 1
          fi

  pr-gate-result:
    # Keep skipped unrelated-label runs from replacing the required check.
    name: >-
      ${{
        (github.event.action == 'labeled' || github.event.action == 'unlabeled') &&
        github.event.label.name != 'A-release' &&
        'Label does not affect the PR gate' ||
        'pr-gate-result'
      }}
    runs-on: ubuntu-latest
    if: >-
      always() &&
      ((github.event.action != 'labeled' && github.event.action != 'unlabeled') ||
      github.event.label.name == 'A-release')
    needs: [changes, semver-checks, changelog-gate, release-readiness]
    timeout-minutes: 5
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}
          # Leave it for the PR author and reviewer to decide if the changelog
          # entries are good enough.
          allowed-failures: changelog-gate
          allowed-skips: semver-checks, changelog-gate, release-readiness