model.ci.yml

name: Model

on:
  push:
    branches:
      - v3
      - main
      - stable
  pull_request:
    types: [labeled, opened, reopened, synchronize]

permissions:
  contents: read

jobs:
  ##
  ## Job: Buf Lint
  ##
  buf-lint:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    permissions:
      contents: "read"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: "Setup: Buf"
        uses: bufbuild/buf-setup-action@382440cdb8ec7bc25a68d7b4711163d95f7cc3aa # v1.28.1
        with:
          github_token: ${{ github.token }}
      - name: "Check: Buf Lint"
        uses: bufbuild/buf-lint-action@044d13acb1f155179c606aaa2e53aea304d22058 # v1.1.0
        with:
          input: proto

  ##
  ## Job: Buf Breaking
  ##
  buf-breaking:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    permissions:
      contents: "read"
    continue-on-error: ${{ contains(github.event.pull_request.labels.*.name, 'ci:buf-breaking-ignore') }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: "Setup: Buf"
        uses: bufbuild/buf-setup-action@382440cdb8ec7bc25a68d7b4711163d95f7cc3aa # v1.28.1
        with:
          github_token: ${{ github.token }}
      - name: "Check: Buf Breaking"
        uses: bufbuild/buf-breaking-action@a074e988ee34efcd4927079e79c611f428354c01 # v1.1.3
        continue-on-error: ${{ contains(github.event.pull_request.labels.*.name, 'ci:buf-breaking-ignore') }}
        with:
          against: https://github.com/elide-dev/v3.git#branch=v3
          input: proto

  ##
  ## Job: Buf Push
  ##
  buf-push:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    needs: ["buf-lint", "buf-breaking"]
    if: |
      (
        github.ref == 'refs/heads/stable' ||
        github.ref == 'refs/heads/v3' ||
        startsWith(github.ref, 'refs/tags/v')
      )
    permissions:
      contents: "read"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: "Setup: Buf"
        uses: bufbuild/buf-setup-action@382440cdb8ec7bc25a68d7b4711163d95f7cc3aa # v1.28.1
        with:
          github_token: ${{ github.token }}
      - name: "Push: BSR"
        uses: bufbuild/buf-push-action@a654ff18effe4641ebea4a4ce242c49800728459 # v1.2.0
        with:
          buf_token: ${{ secrets.BUF_TOKEN }}
          input: proto