common.yml

name: Common

on:
  pull_request:
  merge_group:
    types:
      - checks_requested
  push:
    branches:
      - master
      - main
      - release/v*
    tags:
      - v*

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: read

jobs:
  changes:
    name: Changes
    uses: ./.github/workflows/changes-reusable.yml

  semantic-conventions:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    runs-on: ubuntu-latest
    name: Semantic Conventions
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install repository tools
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.8.2
          install_args: github:open-telemetry/weaver
          cache: false
      - name: Verify semantic conventions
        run: mise run --skip-tools semconv:check

  csharp-quality:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    runs-on: ubuntu-latest
    name: C# Quality
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Install net10.0
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 10.0.x
      - name: Install task runner
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.8.2
          install: false
          cache: false
      - name: Set up .NET NuGet authentication
        env:
          NUGET_GITHUB_ACTOR: ${{ github.actor }}
          NUGET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: mise run --skip-tools github:actions:nuget-authenticate
      - name: Resolve comparison refs
        id: refs
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          MERGE_GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
          MERGE_GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
          BEFORE_SHA: ${{ github.event.before }}
          CURRENT_SHA: ${{ github.sha }}
        run: mise run --skip-tools github:actions:resolve-comparison-refs
      - name: Restore
        run: |
          dotnet restore src/EventStore.sln
      - name: Lint unused variables
        run: |
          dotnet build --no-restore --configuration Release -p:Platform=x64 -warnaserror:CS0168,CS0219,CS8321 src/EventStore.sln
      - name: Verify C# formatting
        run: |
          ./ci/csharp-format-changed.sh src/EventStore.sln "${{ steps.refs.outputs.base }}" "${{ steps.refs.outputs.head }}"
      - name: Verify semantic convention package
        run: |
          dotnet pack --no-restore --configuration Release --output artifacts/packages \
            src/TrogonEventStore.SemanticConventions/TrogonEventStore.SemanticConventions.csproj

  vulnerability-scan:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    runs-on: ubuntu-latest
    name: Scan for Vulnerabilities
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install net10.0
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 10.0.x
      - name: Install task runner
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.8.2
          install: false
          cache: false
      - name: Set up .NET NuGet authentication
        env:
          NUGET_GITHUB_ACTOR: ${{ github.actor }}
          NUGET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: mise run --skip-tools github:actions:nuget-authenticate
      - name: Scan for Vulnerabilities
        run: mise run --skip-tools github:actions:vulnerability-scan

  protolock:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    runs-on: ubuntu-latest
    name: Protolock Status
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Protolock Status
        shell: bash
        run: |
          ./protolock.sh status --uptodate

  release-metadata:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    runs-on: ubuntu-latest
    name: Release Metadata
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Install task runner
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.8.2
          install: false
          cache: false
      - name: Verify release metadata
        run: mise run --skip-tools release-metadata:check
      - name: Verify container publication tags
        run: mise run --skip-tools github:actions:publish-container-test

  archive-storage-contract:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    runs-on: ubuntu-latest
    name: Archive Storage Contract
    env:
      EVENTSTORE_S3_TEST_ENDPOINT: http://localhost:9000
      EVENTSTORE_S3_TEST_REGION: us-east-1
      EVENTSTORE_S3_TEST_ACCESS_KEY: archive-contract
      EVENTSTORE_S3_TEST_SECRET_KEY: archive-contract-secret-key
      EVENTSTORE_S3_RECOVERY_BUCKET: archive-recovery-${{ github.run_id }}-${{ github.run_attempt }}
    services:
      rustfs:
        image: rustfs/rustfs:1.0.0-beta.11@sha256:84ce557a0245a06a9aae5516f55ee0f007fca78d41df356f419306fdc0cb168c
        ports:
          - 9000:9000
        env:
          RUSTFS_ACCESS_KEY: archive-contract
          RUSTFS_SECRET_KEY: archive-contract-secret-key
        options: >-
          --health-cmd "curl --fail http://localhost:9000/health"
          --health-interval 2s
          --health-timeout 2s
          --health-retries 30
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install net10.0
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 10.0.x
      - name: Install task runner
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.8.2
          install: false
          cache: false
      - name: Set up .NET NuGet authentication
        env:
          NUGET_GITHUB_ACTOR: ${{ github.actor }}
          NUGET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: mise run --skip-tools github:actions:nuget-authenticate
      - name: Run archive storage contract tests
        run: mise run --skip-tools github:actions:archive-storage-contract -- contract

      - name: Seed archive restart recovery data
        id: seed_archive_recovery
        env:
          EVENTSTORE_S3_RECOVERY_PHASE: seed
        run: mise run --skip-tools github:actions:archive-storage-contract -- recovery

      - name: Stop RustFS without removing its data
        env:
          RUSTFS_CONTAINER_ID: ${{ job.services.rustfs.id }}
        run: mise run --skip-tools github:actions:archive-storage-contract -- stop-storage

      - name: Assert archive storage is unavailable
        env:
          EVENTSTORE_S3_RECOVERY_PHASE: unavailable
        run: mise run --skip-tools github:actions:archive-storage-contract -- recovery

      - name: Restart RustFS and verify archive recovery
        if: ${{ always() && steps.seed_archive_recovery.outcome == 'success' }}
        env:
          EVENTSTORE_S3_RECOVERY_PHASE: verify-cleanup
          RUSTFS_CONTAINER_ID: ${{ job.services.rustfs.id }}
        run: mise run --skip-tools github:actions:archive-storage-contract -- restart-and-verify

      - name: Run archive cluster restore gate
        run: mise run --skip-tools github:actions:archive-storage-contract -- cluster-restore

  docker-compose:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    runs-on: ubuntu-latest
    name: Docker Compose Smoke Test
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install task runner
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.8.2
          install: false
          cache: false
      - name: Github Registry Docker Login
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: docker.pkg.github.com
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Docker Compose Smoke Test
        env:
          DOCKER_BUILDKIT: 1
          NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: mise run --skip-tools github:actions:docker-compose-smoke

  required:
    name: Common CI
    if: ${{ always() }}
    needs:
      - changes
      - semantic-conventions
      - csharp-quality
      - vulnerability-scan
      - protolock
      - release-metadata
      - archive-storage-contract
      - docker-compose
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install task runner
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.8.2
          install: false
          cache: false
      - name: Require successful jobs
        env:
          REQUIRED_JOBS: ${{ toJSON(needs) }}
        run: mise run --skip-tools github:actions:require-successful-jobs