# Main CI pipeline for push and pull request builds.
# Delegates to the reusable build.yml workflow, which:
# 1. Compiles sources, runs standalone tests, and builds docs (initial build)
# 2. Runs static checks in parallel (checkstyle, jqassistant, enforcer, etc.)
# 3. Runs the test matrix (Validation TCK - in-container, sig test, Windows)
# 4. Prepares a Sonar coverage bundle from all test results

name: CI

on:
  push:
    branches:
      # Pattern order matters: the last matching inclusion/exclusion wins
      - '**'
      - '!4.*'
      - '!5.*'
      - '!6.*'
      - '!7.*'
      - '!8.*'
      - '!dependabot/**'
    tags:
      - '**'
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    branches:
      # Pattern order matters: the last matching inclusion/exclusion wins
      - '**'
      - '!4.*'
      - '!5.*'
      - '!6.*'
      - '!7.*'
      - '!8.*'
      # Ignore dependabot PRs that are not just about build dependencies;
      # we'll reject such dependabot PRs and send a PR ourselves.
      - '!dependabot/**'
      - 'dependabot/maven/build-dependencies-**'
      - 'dependabot/github_actions/workflow-actions-**'

concurrency:
  group: "workflow = ${{ github.workflow }}, ref = ${{ github.event.ref }}, pr = ${{ github.event.pull_request.id }}"
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'hibernate/hibernate-validator' }}

permissions: { }

jobs:
  build:
    uses: ./.github/workflows/build.yml
    permissions:
      contents: read
    with:
      initial-build-runs-on: "runs-on/fleet=linux-standard/env=ibm"
      run-sonar: true
      # See the matrix-json input description in build.yml for available fields.
      # JDK 17: baseline JDK version (we build with 25 but target 17)
      # Validation TCK - in-container: runs the TCK with WildFly in container mode
      # Sig test: Jakarta Validation API signature compatibility check
      # Windows: full build from scratch (no Linux containers available)
      matrix-json: >-
        [
          { "name": "JDK", "java-test-version": 17,
            "runs-on": "runs-on/fleet=linux-standard/env=commonhaus" },
          { "name": "Validation TCK - in-container",
            "maven-args": "-am -pl :hibernate-validator-tck-runner -Dincontainer -Dincontainer-prepared",
            "runs-on": "runs-on/fleet=linux-standard/env=ibm" },
          { "name": "Sig test", "coverage": false,
            "maven-args": "-pl :hibernate-validator-build-enforcer,:hibernate-validator-build-config,:hibernate-validator-tck-runner -Psigtest -DskipTests -Ddevelocity.scan.disabled=true -Dno-build-cache" },
          { "name": "Windows", "full-build": true, "coverage": false,
            "runs-on": "windows-latest" }
        ]
    secrets: inherit