name: Run test and build
description: Test and build action, reused among workflows
inputs:
  SEGMENT_KEY:
    required: true
  ARTIFACTORY_HOST:
    required: true
  ARTIFACTORY_PASSWORD:
    required: true
  ARTIFACTORY_USERNAME:
    required: true
  GARASIGN_PASSWORD:
    required: true
  GARASIGN_USERNAME:
    required: true
  SNYK_TOKEN:
    required: true
  JIRA_API_TOKEN:
    required: true

runs:
  using: "composite"
  # Steps represent a sequence of tasks that will be executed as part of the job
  steps:
    - name: Install Deps Ubuntu
      if: ${{ runner.os == 'Linux' }}
      run: sudo apt-get update -y && sudo apt-get -y install libkrb5-dev libsecret-1-dev net-tools libstdc++6 gnome-keyring
      shell: bash

    # Default Python (3.12) doesn't have support for distutils because of
    # which the dep install fails constantly on macos
    # https://github.com/nodejs/node-gyp/issues/2869
    - uses: actions/setup-python@v5
      with:
        python-version: '3.11'

    - name: Run node-gyp bug workaround script
      run: |
        curl -sSfLO https://raw.githubusercontent.com/mongodb-js/compass/42e6142ae08be6fec944b80ff6289e6bcd11badf/.evergreen/node-gyp-bug-workaround.sh && bash node-gyp-bug-workaround.sh
      shell: bash

    - name: Set SEGMENT_KEY
      env:
        SEGMENT_KEY: ${{ inputs.SEGMENT_KEY }}
      run: |
        echo "SEGMENT_KEY=${SEGMENT_KEY}" >> $GITHUB_ENV
      shell: bash

    - name: Validate SEGMENT_KEY
      run: |
        if [ -z "${SEGMENT_KEY}" ]; then
          echo "SEGMENT_KEY is not set or is empty"
          exit 1
        fi
      shell: bash

    - name: Install Dependencies
      shell: bash
      run: |
        pnpm install --frozen-lockfile

    - name: Run Checks
      run: pnpm run check
      # the glob here just fails
      if: ${{ runner.os != 'Windows' }}
      shell: bash

    - name: Run Tests
      env:
        NODE_OPTIONS: "--max_old_space_size=4096"
        MDB_IS_TEST: "true"
      run: |
        pnpm run test
      shell: bash

    - name: Build .vsix
      env:
        NODE_OPTIONS: "--require ./scripts/no-npm-list-fail.js --max_old_space_size=4096"
      # NOTE: --githubBranch is "The GitHub branch used to infer relative links in README.md."
      run: |
        pnpm exec vsce package --githubBranch main
      shell: bash

    - name: Check .vsix filesize
      run: pnpm run check-vsix-size
      shell: bash

    - name: Sign .vsix
      if: runner.os == 'Linux'
      env:
        ARTIFACTORY_PASSWORD: ${{ inputs.ARTIFACTORY_PASSWORD }}
        ARTIFACTORY_USERNAME: ${{ inputs.ARTIFACTORY_USERNAME }}
        GARASIGN_PASSWORD: ${{ inputs.GARASIGN_PASSWORD }}
        GARASIGN_USERNAME: ${{ inputs.GARASIGN_USERNAME }}
      run: |
        set -e
        FILE_TO_SIGN=$(find . -maxdepth 1 -name '*.vsix' -print -quit)
        if [ -z "$FILE_TO_SIGN" ]; then
          echo "Error: No .vsix file found in the current directory." >&2
          exit 1
        fi
        node scripts/sign-vsix.js "${FILE_TO_SIGN}"
        ls *.vsix.sig
      shell: bash

    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: VSIX built on ${{ runner.os }}
        path: |
          *.vsix
          *.vsix.sig

    - name: Run Snyk Test
      if: runner.os == 'Linux'
      shell: bash
      env:
        SNYK_TOKEN: ${{ inputs.SNYK_TOKEN }}
      run: |
        pnpm run snyk-test

    - name: Upload Snyk Report
      if: runner.os == 'Linux'
      uses: actions/upload-artifact@v4
      with:
        name: Snyk Report - ${{ github.run_id }}
        path: |
          .sbom/snyk-test-result.html
          .sbom/snyk-test-result.json

    # TODO(VSCODE-706): Fix Snyk vuln ticket generation
    # - name: Create Jira Tickets
    #   if: >
    #     runner.os == 'Linux' &&
    #     (
    #       github.event_name == 'push' && github.ref == 'refs/heads/main' ||
    #       github.event_name == 'workflow_dispatch' ||
    #       github.event_name == 'schedule'
    #     )
    #   shell: bash
    #   env:
    #     JIRA_API_TOKEN: ${{ inputs.JIRA_API_TOKEN }}
    #     JIRA_BASE_URL: "https://jira.mongodb.org"
    #     JIRA_PROJECT: "VSCODE"
    #     JIRA_VULNERABILITY_BUILD_INFO: "- [GitHub Run|https://github.com/mongodb-js/vscode/actions/runs/${{github.run_id}}/jobs/${{github.job}}]"
    #   run: |
    #     pnpm run create-vulnerability-tickets > /dev/null

    - name: Generate Vulnerability Report (Fail on >= High)
      if: runner.os == 'Linux'
      continue-on-error: ${{ github.event_name == 'pull_request' }}
      shell: bash
      run: |
        # The standard output is suppressed since Github Actions logs are
        # available for everyone with read access to the repo, which is everyone that is
        # logged in for public repos.
        # This command is only here to fail on failures for `main` and tags.
        pnpm run generate-vulnerability-report > /dev/null
