semver-checks.yml

name: semver-checks

# Trigger when a PR is opened or changed
on:
  pull_request_target:
    types:
      - opened
      - synchronize
      - reopened
  merge_group:

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  check_if_pr_breaks_semver:
    runs-on: ubuntu-latest
    permissions:
      # this job runs with read because it checks out the PR head which could contain malicious code
      contents: read
    steps:
      - uses: actions/checkout@v4
        name: checkout full rep
        with:
          fetch-depth: 0
          ref: >-
            ${{ github.event_name == 'merge_group'
                && github.event.merge_group.head_sha
                || github.event.pull_request.head.sha }}
      - name: Install minimal stable
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          cache: false
      # See build.yml top-level comment for why save-if is restricted to main.
      - uses: Swatinem/rust-cache@v2
        with:
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
      - name: Install cargo-semver-checks
        shell: bash
        run: |
          cargo install cargo-semver-checks --locked
      - name: Compute baseline revision
        id: baseline
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "merge_group" ]; then
            echo "rev=${{ github.event.merge_group.base_sha }}" >> "$GITHUB_OUTPUT"
          else
            # Use the merge-base instead of the PR base SHA. The base SHA is the tip of
            # the target branch when the webhook fires, which can differ from where the PR
            # actually diverged. Using merge-base avoids false positives when the PR branch
            # is behind the target branch.
            MERGE_BASE=$(git merge-base ${{ github.event.pull_request.head.sha }} ${{ github.event.pull_request.base.sha }})
            echo "rev=${MERGE_BASE}" >> "$GITHUB_OUTPUT"
          fi
      - name: Run check
        id: check
        continue-on-error: true
        shell: bash
        # only check semver on released crates (delta_kernel and delta_kernel_ffi).
        # note that this won't run on proc macro/derive crates, so don't need to include
        # delta_kernel_derive etc.
        run: |
          cargo semver-checks -p delta_kernel -p delta_kernel_ffi --all-features \
            --baseline-rev ${{ steps.baseline.outputs.rev }}
      - name: On Failure
        id: set_failure
        if: ${{ steps.check.outcome == 'failure' }}
        run: |
          echo "Checks failed"
          echo "check_status=failure" >> $GITHUB_OUTPUT
      - name: On Success
        id: set_success
        if: ${{ steps.check.outcome == 'success' }}
        run: |
          echo "Checks succeed"
          echo "check_status=success" >> $GITHUB_OUTPUT
    outputs:
      check_status: ${{ steps.set_failure.outputs.check_status || steps.set_success.outputs.check_status }}
  update_label_if_needed:
    needs: check_if_pr_breaks_semver
    runs-on: ubuntu-latest
    permissions:
      # this job only looks at previous output and then sets a label, so malicious code in the PR
      # isn't a concern
      pull-requests: write
    steps:
      - name: On Failure
        if: github.event_name == 'pull_request_target' && needs.check_if_pr_breaks_semver.outputs.check_status == 'failure'
        uses: actions-ecosystem/action-add-labels@v1
        with:
          labels: breaking-change
      - name: Remove breaking-change label
        if: github.event_name == 'pull_request_target' && needs.check_if_pr_breaks_semver.outputs.check_status == 'success' && contains(github.event.pull_request.labels.*.name, 'breaking-change')
        uses: actions-ecosystem/action-remove-labels@v1
        with:
          labels: breaking-change
      - name: On Success
        if: needs.check_if_pr_breaks_semver.outputs.check_status == 'success'
        run: |
          echo "Checks succeed"
      - name: Fail On Incorrect Previous Output
        if: needs.check_if_pr_breaks_semver.outputs.check_status != 'success' && needs.check_if_pr_breaks_semver.outputs.check_status != 'failure'
        run: exit 1