ci.yml

name: CI

on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
  push:
    branches:
      - 'main'
    tags:
      - 'v*'

# Least-privilege default: the schema job needs nothing but read access to the
# checked-out tree. The release job elevates to contents:write per job below, so
# a write scope is never handed to the job that executes repository code.
permissions:
  contents: read

jobs:
  schema:
    name: Schema conformance
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # No job pushes with git credentials; don't persist the token into
          # .git/config where checked-out repo code could read it.
          persist-credentials: false
      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
        with:
          distribution: temurin
          java-version: '17'
      # Compiles every schema the SDKs generate their bindings from, then
      # validates the captured payloads in test/fixtures against them. Fails on
      # a schema that does not compile, a payload that does not validate, an
      # attribute a payload carries but the schema does not declare, and a
      # message type or endpoint with no payload at all.
      - name: Check schemas against captured payloads
        run: make check

  release:
    name: Release
    # Only a tag builds a release, and only after the schema check on that same
    # tag has passed - a tag that does not compile must not become a download.
    if: startsWith(github.ref, 'refs/tags/v')
    needs: schema
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      # Consumers that regenerate bindings want the XSDs and nothing else;
      # GitHub's own source archives carry the fixtures and tooling too.
      - name: Package the schema
        run: zip -r "oddsfeedschema-${GITHUB_REF_NAME}.zip" schema
      - name: Publish the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          asset="oddsfeedschema-${TAG}.zip"
          # A release written by hand before the tag was pushed keeps its notes;
          # this only adds the asset. A bare tag gets generated notes instead.
          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release upload "$TAG" "$asset" --clobber
          else
            prerelease=""
            case "$TAG" in *-*) prerelease="--prerelease" ;; esac
            gh release create "$TAG" "$asset" \
              --title "$TAG" --generate-notes $prerelease
          fi