ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  schedule:
    - cron: "0 12 * * *"

jobs:
  ruby-versions:
    uses: ruby/actions/.github/workflows/ruby_versions.yml@master
    with:
      engine: cruby-truffleruby # TODO: change to all when jruby is supported
      min_version: 3.0

  test:
    needs: ruby-versions
    runs-on: ${{ matrix.os }}
    name: Ruby ${{ matrix.ruby }} / ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
        os: [ubuntu-latest]
        # os: [ ubuntu-latest, macos-latest, windows-latest ]
        # include:
        #   - { os: windows-latest, ruby: ucrt }
        #   - { os: windows-latest, ruby: mingw }
        #   - { os: windows-latest, ruby: mswin }

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Set up Ruby
        uses: ruby/setup-ruby@161cd54b698f1fb3ea539faab2e036d409550e3c # v1.187.0
        with:
          ruby-version: ${{ matrix.ruby }}
          bundler-cache: true
      - name: Run the tests
        run: bin/rake test
      - name: Run the conformance tests
        uses: sigstore/sigstore-conformance@ee4de0e602873beed74cf9e49d5332529fe69bf6 # v0.0.11
        with:
          entrypoint: ${{ github.workspace }}/bin/conformance-entrypoint
          xfail: test_verify_rejects_bad_tsa_timestamp
          skip-signing: true
        if: ${{ matrix.os }} == "ubuntu-latest"
      - name: Run the conformance tests against staging
        uses: sigstore/sigstore-conformance@ee4de0e602873beed74cf9e49d5332529fe69bf6 # v0.0.11
        with:
          entrypoint: ${{ github.workspace }}/bin/conformance-entrypoint
          xfail: test_verify_rejects_bad_tsa_timestamp
          environment: staging
          skip-signing: true
        if: ${{ matrix.os }} == "ubuntu-latest"
      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
        if: ${{ matrix.ruby }} == ${{ fromJson(needs.ruby-versions.outputs.latest) }} && ${{ matrix.os }} == "ubuntu-latest" && always()
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: sigstore/sigstore-ruby

  all-tests-pass:
    if: always()

    needs:
      - test

    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - name: check test jobs
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}

  lint:
    runs-on: ubuntu-latest
    name: Lint
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Set up Ruby
        uses: ruby/setup-ruby@161cd54b698f1fb3ea539faab2e036d409550e3c # v1.187.0
        with:
          ruby-version: "3.3.1"
          bundler-cache: true
      - name: Run the linter
        run: bin/rubocop