name: Engine & CLI

on:
  push:
    branches: ["main"]
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review
  # Enable manual trigger for easy debugging
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write

jobs:
  lint:
    uses: ./.github/workflows/_hack_make.yml
    secrets: inherit
    with:
      mage-targets: engine:lint

  test:
    uses: ./.github/workflows/_hack_make.yml
    secrets: inherit
    with:
      mage-targets: engine:testrace
      size: dagger-runner-16c-64g

  # Run Engine tests in dev Engine so that we can spot integration failures early
  # Only run a subset of important test cases since we just need to verify basic
  # functionality rather than repeat every test already run in the other targets.
  testdev:
    uses: ./.github/workflows/_hack_make.yml
    secrets: inherit
    with:
      mage-targets: engine:testimportant
      size: dagger-runner-16c-64g
      dev-engine: true


  test-publish-cli:
    uses: ./.github/workflows/_hack_make.yml
    secrets: inherit
    with:
      mage-targets: cli:testpublish

  test-publish-engine:
    uses: ./.github/workflows/_hack_make.yml
    secrets: inherit
    with:
      mage-targets: engine:testpublish

  scan-engine:
    if: ${{ github.repository == 'dagger/dagger' }}
    # Use our own Dagger runner when running in the dagger/dagger repo (including PRs)
    runs-on: dagger-runner-2c-8g
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v4
        with:
          go-version: "1.21"
          cache-dependency-path: "internal/mage/go.sum"
      - name: "Build Dev Engine"
        run: |
          ./hack/dev
        env:
          _EXPERIMENTAL_DAGGER_RUNNER_HOST: "unix:///var/run/buildkit/buildkitd.sock"
          DAGGER_CLOUD_TOKEN: "${{ secrets.DAGGER_CLOUD_TOKEN }}"
      - name: "Scan Dev Engine for Vulnerabilities"
        uses: aquasecurity/trivy-action@0.11.2
        with:
          input: ./bin/engine.tar
          format: "json"
          exit-code: "1"
          severity: "CRITICAL,HIGH"
