model.ci.yml

name: Model

on:
  push:
    branches:
      - v3
      - main
      - stable
  pull_request:
    types: [labeled, opened, reopened, synchronize]

permissions:
  contents: read

jobs:
  ##
  ## Job: Buf Lint
  ##
  buf-lint:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    permissions:
      contents: "read"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: "Setup: Buf"
        uses: bufbuild/buf-setup-action@eb60cd0de4f14f1f57cf346916b8cd69a9e7ed0b # v1.26.1
        with:
          github_token: ${{ github.token }}
      - name: "Check: Buf Lint"
        uses: bufbuild/buf-lint-action@bd48f53224baaaf0fc55de9a913e7680ca6dbea4 # v1.0.3
        with:
          input: proto

  ##
  ## Job: Buf Breaking
  ##
  buf-breaking:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    permissions:
      contents: "read"
    continue-on-error: ${{ contains(github.event.pull_request.labels.*.name, 'ci:buf-breaking-ignore') }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: "Setup: Buf"
        uses: bufbuild/buf-setup-action@eb60cd0de4f14f1f57cf346916b8cd69a9e7ed0b # v1.26.1
        with:
          github_token: ${{ github.token }}
      - name: "Check: Buf Breaking"
        uses: bufbuild/buf-breaking-action@a074e988ee34efcd4927079e79c611f428354c01 # v1.1.3
        continue-on-error: ${{ contains(github.event.pull_request.labels.*.name, 'ci:buf-breaking-ignore') }}
        with:
          against: https://github.com/elide-dev/v3.git#branch=v3
          input: proto

  ##
  ## Job: Buf Push
  ##
  buf-push:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    needs: ["buf-lint", "buf-breaking"]
    if: |
      (
        github.ref == 'refs/heads/stable' ||
        github.ref == 'refs/heads/v3' ||
        startsWith(github.ref, 'refs/tags/v')
      )
    permissions:
      contents: "read"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: "Setup: Buf"
        uses: bufbuild/buf-setup-action@eb60cd0de4f14f1f57cf346916b8cd69a9e7ed0b # v1.26.1
        with:
          github_token: ${{ github.token }}
      - name: "Push: BSR"
        uses: bufbuild/buf-push-action@1c45f6a21ec277ee4c1fa2772e49b9541ea17f38 # v1.1.1
        with:
          buf_token: ${{ secrets.BUF_TOKEN }}
          input: proto