dotnet.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-test:
    name: Build and test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore --locked-mode

      - name: Build
        run: dotnet build --no-restore --configuration Release -warnaserror

      - name: Test
        shell: bash
        run: |
          dotnet test --project Tests/Tests.fsproj \
            --configuration Release \
            --no-build \
            --report-trx \
            --report-trx-filename "tests-${{ matrix.os }}.trx" \
            --results-directory TestResults

      - name: Report test counts
        if: always()
        shell: bash
        run: |
          tTrx="TestResults/tests-${{ matrix.os }}.trx"
          tCounters=$(grep -oE '<Counters [^>]*' "$tTrx" 2>/dev/null | head -1)
          if [ -z "$tCounters" ]; then
            echo "::error::Could not find test counters in $tTrx."
            exit 1
          fi

          counter() { echo "$tCounters" | grep -oE " $1=\"[0-9]+\"" | grep -oE '[0-9]+'; }
          tTotal=$(counter total)
          tPassed=$(counter passed)
          tFailed=$(counter failed)
          tSkipped=$(counter notExecuted)

          {
            echo "### Tests (${{ matrix.os }})"
            echo
            echo "| Total | Passed | Failed | Skipped |"
            echo "| ---: | ---: | ---: | ---: |"
            echo "| $tTotal | $tPassed | $tFailed | $tSkipped |"
          } >> "$GITHUB_STEP_SUMMARY"

          if [ "$tSkipped" -ne 0 ]; then
            echo "::error::$tSkipped test(s) skipped. The bar is 0 failed and 0 skipped."
            exit 1
          fi

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: test-results-${{ matrix.os }}
          path: TestResults/*.trx
          retention-days: 14

  coverage:
    name: Code coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore --locked-mode

      - name: Build
        run: dotnet build --no-restore --configuration Release -warnaserror

      - name: Test with coverage
        run: >
          dotnet test --project Tests/Tests.fsproj
          --configuration Release
          --no-build
          --coverlet
          --coverlet-output-format cobertura
          --coverlet-include "[FSharp.Interop.Dynamic]*"
          --coverlet-exclude "[Tests]*"
          --results-directory TestResults

      - name: Install ReportGenerator
        run: dotnet tool install --tool-path ./tools --version 5.5.11 dotnet-reportgenerator-globaltool

      - name: Generate report
        run: >
          ./tools/reportgenerator
          -reports:TestResults/**/coverage.cobertura*.xml
          -targetdir:CoverageReport
          -reporttypes:"MarkdownSummaryGithub;HtmlInline;Cobertura"

      - name: Publish coverage to the job summary
        shell: bash
        run: cat CoverageReport/SummaryGithub.md >> "$GITHUB_STEP_SUMMARY"

      - name: Enforce coverage floors
        shell: bash
        env:
          MIN_LINE: '77'
          MIN_BRANCH: '100'
        run: |
          tReport=$(find TestResults -name 'coverage.cobertura*.xml' | head -1)
          if [ -z "$tReport" ]; then
            echo "::error::No cobertura report was produced."
            exit 1
          fi

          tHeader=$(grep -oE '^<coverage[^>]*' "$tReport")
          tLineRate=$(echo "$tHeader"   | grep -oE 'line-rate="[0-9.]+"'   | grep -oE '[0-9.]+')
          tBranchRate=$(echo "$tHeader" | grep -oE 'branch-rate="[0-9.]+"' | grep -oE '[0-9.]+')

          tLinePct=$(awk -v r="$tLineRate"   'BEGIN { printf "%.1f", r * 100 }')
          tBranchPct=$(awk -v r="$tBranchRate" 'BEGIN { printf "%.1f", r * 100 }')

          tLinesCovered=$(echo "$tHeader"    | grep -oE 'lines-covered="[0-9]+"'    | grep -oE '[0-9]+')
          tLinesValid=$(echo "$tHeader"      | grep -oE 'lines-valid="[0-9]+"'      | grep -oE '[0-9]+')
          tBranchesCovered=$(echo "$tHeader" | grep -oE 'branches-covered="[0-9]+"' | grep -oE '[0-9]+')
          tBranchesValid=$(echo "$tHeader"   | grep -oE 'branches-valid="[0-9]+"'   | grep -oE '[0-9]+')

          {
            echo "### Coverage floors"
            echo
            echo "| Metric | Covered | Total | Percent | Floor |"
            echo "| --- | ---: | ---: | ---: | ---: |"
            echo "| Lines | $tLinesCovered | $tLinesValid | ${tLinePct}% | ${MIN_LINE}% |"
            echo "| Branches | $tBranchesCovered | $tBranchesValid | ${tBranchPct}% | ${MIN_BRANCH}% |"
          } >> "$GITHUB_STEP_SUMMARY"

          tFailed=0
          if awk -v p="$tLinePct" -v m="$MIN_LINE" 'BEGIN { exit !(p < m) }'; then
            echo "::error::Line coverage ${tLinePct}% is below the ${MIN_LINE}% floor."
            tFailed=1
          fi
          if awk -v p="$tBranchPct" -v m="$MIN_BRANCH" 'BEGIN { exit !(p < m) }'; then
            echo "::error::Branch coverage ${tBranchPct}% is below the ${MIN_BRANCH}% floor."
            tFailed=1
          fi
          exit $tFailed

      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage-report
          path: CoverageReport
          retention-days: 14

  analyzers:
    name: F# analyzers
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: |
          dotnet restore --locked-mode
          dotnet tool restore

      - name: Run Ionide analyzers
        run: |
          analyzer_version=$(sed -n 's/.*Include="Ionide.Analyzers" Version="\([^"]*\)".*/\1/p' Directory.Packages.props)
          analyzer_path="${NUGET_PACKAGES:-$HOME/.nuget/packages}/ionide.analyzers/${analyzer_version}/analyzers/dotnet/fs"
          if [ ! -d "$analyzer_path" ]; then
            echo "::error::Ionide analyzer binaries not found at $analyzer_path"
            exit 1
          fi
          dotnet fsharp-analyzers \
            --project FSharp.Interop.Dynamic/FSharp.Interop.Dynamic.fsproj \
            --analyzers-path "$analyzer_path" \
            --configuration Release \
            --verbosity n \
            --output-format github \
            --report ionide.sarif

      - name: Upload analyzer SARIF
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ionide-sarif
          path: ionide.sarif
          retention-days: 14