on.pr.yml

---
name: "PR"

"on":
  ## Run on PR filings
  pull_request:
    paths:
      - docs/**/*.*
      - example/**/*.*
      - graalvm/**/*.*
      - internal/**/*.*
      - tools/**/*.*

  ## Run on PR queue check requests
  merge_group: {}

concurrency:
  # Cancel previous actions from the same PR: https://stackoverflow.com/a/72408109
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  dependency-graph:
    name: "Dependency Graph"
    continue-on-error: true
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit
      - name: "Setup: Checkout"
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - name: "Report: Dependency Graph"
        continue-on-error: true
        uses: advanced-security/maven-dependency-submission-action@5d0f9011b55d6268922128af45275986303459c3 # v4.0.3

  dependency-review:
    name: "Dependency Review"
    runs-on: ubuntu-latest
    needs: [dependency-graph]
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit
      - name: "Checkout Repository"
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - name: "Dependency Review"
        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
        with:
          config-file: "./.github/dependency-review-config.yml"
          comment-summary-in-pr: always
          retry-on-snapshot-warnings: true
          warn-only: true

  test:
    name: "Tests: ${{ matrix.label }}"
    uses: ./.github/workflows/module.build.yml
    strategy:
      fail-fast: false
      matrix:
        runner: [ubuntu-latest]
        main: [true]
        label: ["Ubuntu"]
        labs: [false]
        flags: ["--config=linux"]
        testlabel: ["Ubuntu"]
        coverage: [false]
        include:
          # Bazel 7
          - runner: ubuntu-latest
            label: Ubuntu
            labs: false
            main: true
            coverage: false
            flags: --config=linux
          - runner: macos-latest
            label: macOS
            labs: false
            main: true
            coverage: true
            flags: --config=mac
          - runner: windows-2022
            label: Windows
            labs: false
            main: true
            coverage: false
            flags: --config=windows

    secrets: inherit
    with:
      runner: ${{ matrix.runner }}
      label: ${{ matrix.label }}
      labs: ${{ matrix.labs }}
      main: ${{ matrix.main }}
      flags: ${{ matrix.flags }}
      coverage: ${{ matrix.coverage }}