name: check

on:
  push:
    branches:
      - '**'

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 2024-10-23
        with:
          # The fingerprint step below needs history to find the last commit
          # that touched the Docker build context.
          fetch-depth: 0

      - name: Neutralize superseded run statuses
        # Gitea cancels the in-flight run when another commit is pushed to the
        # same branch and records the cancellation as `failure`, so a commit
        # that was never tested reads red. The cancellation is unconditional
        # server-side for push events and cannot be disabled from a workflow
        # file, so the superseding run rewrites those statuses to `skipped`.
        # Only the exact cancellation status is touched; a real failure is
        # left alone.
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          set -eu
          api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}"
          ctx='check / check (push)'
          for sha in $(git rev-list --max-count=20 "${GITHUB_SHA}^" || true); do
            latest="$(curl -sf "${api}/commits/${sha}/status" | jq -r \
              --arg c "$ctx" \
              '[.statuses[] | select(.context == $c)][0] // empty
               | "\(.status)|\(.description)"')" || continue
            [ "$latest" = 'failure|Has been cancelled' ] || continue
            curl -sf -X POST "${api}/statuses/${sha}" \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H 'Content-Type: application/json' \
              -d "$(jq -nc --arg c "$ctx" '{
                context: $c,
                state: "skipped",
                description: "Superseded by a newer commit; never tested"
              }')" >/dev/null
            echo "neutralized superseded status on ${sha}"
          done

      - name: Fingerprint the build context
        # `.dockerignore` keeps docs out of the build context, so a docs-only
        # commit legitimately replays the whole image from cache and stays
        # cheap. Every other commit writes a new fingerprint into the context,
        # which invalidates the `COPY . .` layer of both check stages: a
        # commit that was never linted, formatted-checked, tested and built
        # cannot report success from cache.
        run: |
          set -eu
          fp="$(git log -1 --format=%H -- . ':!*.md' ':!LICENSE' ':!.editorconfig')"
          printf '%s\n' "${fp:-$GITHUB_SHA}" > .ci-fingerprint

      - name: Build Docker image (runs make check)
        run: script/cibuild