name: Backend Code Checks

on:
  pull_request:
    paths-ignore:
      - '*.md'
      - 'docs/**'
      - 'latest.json'
  push:
    branches:
      - main
    paths-ignore:
      - '*.md'
      - 'docs/**'
      - 'latest.json'

jobs:
  detect-changes:
    name: Detect whether code changed
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      changed: ${{ steps.detect-changes.outputs.backend }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: true # required to get more history in the changed-files action
          fetch-depth: 2
      - name: Detect changes
        id: detect-changes
        uses: ./.github/actions/change-detection
        with:
          self: .github/workflows/backend-code-checks.yml

  validate-configs:
    permissions:
      contents: read
      id-token: write
    needs: detect-changes
    if: needs.detect-changes.outputs.changed == 'true'
    name: Validate Backend Configs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Setup Go
        uses: actions/setup-go@v5.5.0
        with:
          # Explicitly set Go version to 1.24.1 to ensure consistent OpenAPI spec generation
          # The crypto/x509 package has additional fields in Go 1.24.1 that affect the generated specs
          # This ensures the GHAs environment matches what we use in the Drone pipeline
          go-version: 1.24.1
          cache: true

      - name: Verify code generation
        run: |
          CODEGEN_VERIFY=1 make gen-cue
          CODEGEN_VERIFY=1 make gen-jsonnet

      - name: Validate go.mod
        run: go run scripts/modowners/modowners.go check go.mod

      # Enterprise setup is needed for complete OpenAPI spec generation
      # We only do this for internal PRs
      - name: Setup Grafana Enterprise
        if: github.event.pull_request.head.repo.fork == false
        uses: ./.github/actions/setup-enterprise

      - name: Generate and Validate OpenAPI Specs
        run: |
          # For PRs from forks, we'll just run the basic swagger-gen without validation
          if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
            echo "PR is from a fork, skipping enterprise-based validation"
            make swagger-gen
            exit 0
          fi

          # Clean and regenerate OpenAPI specs
          make swagger-clean && make openapi3-gen

          # Check if the generated specs differ from what's in the repository
          for f in public/api-merged.json public/openapi3.json; do git add $f; done
          if [ -z "$(git diff --name-only --cached)" ]; then
            echo "OpenAPI specs are up to date!"
          else
            echo "OpenAPI specs are OUT OF DATE!"
            git diff --cached
            echo "Please ensure the branch is up-to-date, then regenerate the specification by running make swagger-clean && make openapi3-gen"
            exit 1
          fi