build.yml

name: Build

on:
  push:
    branches:
      - main

  pull_request:
    paths-ignore:
      - "**.md"
      - "**.mdx"

  schedule:
    # runs the CI everyday at 10AM
    - cron: "0 10 * * *"

  workflow_dispatch:
    inputs:
      dart_version:
        description: 'Dart version to test (stable or beta)'
        required: false
        default: 'stable'

jobs:
  # Check license headers on all source files
  check-license-header:
    name: Check License Headers
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Download addlicense
        run: |
          curl -sL https://github.com/google/addlicense/releases/download/v1.2.0/addlicense_v1.2.0_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin addlicense
          chmod +x /usr/local/bin/addlicense

      - name: Check license headers
        run: |
          addlicense -f scripts/header_template.txt \
            --check \
            --ignore "**/*.yml" \
            --ignore "**/*.yaml" \
            --ignore "**/*.xml" \
            --ignore "**/*.g.dart" \
            --ignore "**/*.sh" \
            --ignore "**/*.html" \
            --ignore "**/*.js" \
            --ignore "**/*.ts" \
            --ignore "**/*.txt" \
            --ignore "**/.dart_tool/**" \
            --ignore "LICENSE" \
            .

  lint:
    name: Lint (Dart ${{ matrix.dart-version }})
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        dart-version: ['3.9', stable, dev]

    defaults:
      run:
        working-directory: packages/firebase_admin_sdk

    steps:
      - uses: actions/checkout@v6

      - uses: dart-lang/setup-dart@v1
        with:
          sdk: ${{ matrix.dart-version }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: ~/.pub-cache
          key: pub-${{ matrix.dart-version }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ matrix.dart-version }}-
            pub-

      - run: dart pub global activate melos
        working-directory: .

      - run: melos bootstrap
        working-directory: .

      - run: dart format --set-exit-if-changed .
        if: matrix.dart-version == 'dev'

      - run: dart analyze
        if: matrix.dart-version != 'dev'

      - run: dart analyze --fatal-infos
        if: matrix.dart-version == 'dev'

  test:
    name: Test (Dart ${{ matrix.dart-version }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    strategy:
      fail-fast: false
      matrix:
        dart-version: [stable, beta]

    defaults:
      run:
        working-directory: packages/firebase_admin_sdk

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2

      - uses: actions/setup-java@v5
        with:
          java-version: '21'
          distribution: 'temurin'

      - uses: actions/setup-node@v6

      - uses: dart-lang/setup-dart@v1
        with:
          sdk: ${{ matrix.dart-version }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: ~/.pub-cache
          key: pub-${{ matrix.dart-version }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ matrix.dart-version }}-
            pub-

      - name: Cache Firebase CLI
        uses: actions/cache@v5
        with:
          path: ~/.cache/firebase/emulators
          key: firebase-emulators
          restore-keys: |
            firebase-

      - name: Add pub cache bin to PATH
        run: |
          echo "$HOME/.pub-cache/bin" >> $GITHUB_PATH
          echo "PUB_CACHE=$HOME/.pub-cache" >> $GITHUB_ENV

      - run: dart pub global activate melos
        working-directory: .

      - run: melos bootstrap
        working-directory: .

      - run: npm install -g firebase-tools

      - name: Run firebase_admin_sdk tests with coverage
        run: ${{ github.workspace }}/scripts/coverage.sh

      - name: Run google_cloud_firestore tests with coverage
        run: ${{ github.workspace }}/scripts/firestore-coverage.sh

      - name: Process coverage and check threshold
        if: matrix.dart-version == 'stable'
        id: coverage
        run: dart ../../scripts/process_coverage.dart

      - name: Comment coverage on PR
        if: matrix.dart-version == 'stable' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
        uses: actions/github-script@v9
        with:
          script: |
            const coverage = '${{ steps.coverage.outputs.coverage }}';
            const status = '${{ steps.coverage.outputs.status }}';
            const hitLines = '${{ steps.coverage.outputs.hit_lines }}';
            const totalLines = '${{ steps.coverage.outputs.total_lines }}';
            const coverageTable = `${{ steps.coverage.outputs.coverage_table }}`;

            const body = `## Coverage Report

            ${status}

            **Total Coverage:** ${coverage}%
            **Lines Covered:** ${hitLines}/${totalLines}

            ${coverageTable}

            _Minimum threshold: 40%_`;

            // Find existing comment
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const botComment = comments.find(comment =>
              comment.user.type === 'Bot' &&
              comment.body.includes('Coverage Report')
            );

            if (botComment) {
              // Update existing comment
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: body
              });
            } else {
              // Create new comment
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body: body
              });
            }

      - name: Upload coverage to codecov
        if: matrix.dart-version == 'stable'
        continue-on-error: true
        uses: codecov/codecov-action@v6
        with:
          files: coverage.lcov
          flags: unittests
          fail_ci_if_error: false

  test-wif:
    name: Test - WIF Auth (Dart ${{ matrix.dart-version }})
    runs-on: ubuntu-latest
    # Skip for fork PRs — secrets are not available
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
    permissions:
      contents: 'read'
      id-token: 'write'

    strategy:
      fail-fast: false
      matrix:
        dart-version: [stable, beta]

    defaults:
      run:
        working-directory: packages/firebase_admin_sdk

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2

      - uses: dart-lang/setup-dart@v1
        with:
          sdk: ${{ matrix.dart-version }}

      - name: Authenticate to Google Cloud/Firebase
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: '${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}'
          service_account: '${{ secrets.SERVICE_ACCOUNT }}'

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: ~/.pub-cache
          key: pub-${{ matrix.dart-version }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ matrix.dart-version }}-
            pub-

      - name: Add pub cache bin to PATH
        run: |
          echo "$HOME/.pub-cache/bin" >> $GITHUB_PATH
          echo "PUB_CACHE=$HOME/.pub-cache" >> $GITHUB_ENV

      - run: dart pub global activate melos
        working-directory: .

      - run: melos bootstrap
        working-directory: .

      - name: Run WIF auth test
        run: dart test test/integration/app/firebase_app_prod_test.dart --concurrency=1

  publish:
    name: Publish verification
    runs-on: ubuntu-latest
    needs: [check-license-header, lint, test, test-wif]
    # Run even if test-wif was skipped (fork PRs), but not if other jobs failed
    if: |
      always() &&
      needs.check-license-header.result == 'success' &&
      needs.lint.result == 'success' &&
      needs.test.result == 'success' &&
      (needs.test-wif.result == 'success' || needs.test-wif.result == 'skipped')

    defaults:
      run:
        working-directory: packages/firebase_admin_sdk

    steps:
      - uses: actions/checkout@v6

      - uses: dart-lang/setup-dart@v1
        with:
          sdk: stable

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: ~/.pub-cache
          key: pub-stable-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-stable-
            pub-

      - run: dart pub global activate melos
        working-directory: .

      - run: melos bootstrap
        working-directory: .

      - run: dart pub publish --dry-run