sdk-coverage.yml

name: SDK coverage

on:
  workflow_call:
    inputs:
      source_repository:
        description: Source repository containing the API contracts
        required: true
        type: string
      source_sha:
        description: Exact source revision to inspect
        required: true
        type: string
      source_branch:
        description: Source branch whose contract changed
        required: true
        type: string
      sdk_target_branch:
        description: SDK integration branch (main)
        required: true
        type: string
      messaging_spec_path:
        description: Repository-relative Messaging OpenAPI path
        required: true
        type: string
      platform_spec_path:
        description: Repository-relative Platform OpenAPI path
        required: true
        type: string
    secrets:
      SDK_COVERAGE_CLIENT_ID:
        required: true
      SDK_COVERAGE_APP_PRIVATE_KEY:
        required: true
      LINEAR_API_KEY:
        required: false

permissions:
  contents: read

jobs:
  synchronize:
    runs-on: ubuntu-latest
    steps:
      - name: Enforce SDK main routing
        env:
          SOURCE_BRANCH: ${{ inputs.source_branch }}
          SDK_TARGET_BRANCH: ${{ inputs.sdk_target_branch }}
        run: |
          if [[ "$SOURCE_BRANCH" != "dev" && "$SOURCE_BRANCH" != "main" ]]; then
            echo "source_branch must be dev or main" >&2
            exit 1
          fi
          if [[ "$SDK_TARGET_BRANCH" != "main" ]]; then
            echo "SDK contracts from dev and main both target SDK main" >&2
            exit 1
          fi

      - name: Check out source contracts
        uses: actions/checkout@v6
        with:
          repository: ${{ inputs.source_repository }}
          ref: ${{ inputs.source_sha }}
          path: source
          persist-credentials: false

      - name: Create SDK repository token
        id: sdk-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ secrets.SDK_COVERAGE_CLIENT_ID }}
          private-key: ${{ secrets.SDK_COVERAGE_APP_PRIVATE_KEY }}
          owner: polymorfa
          repositories: sdks
          permission-contents: read

      - name: Check out SDK coverage ledger
        uses: actions/checkout@v6
        with:
          repository: polymorfa/sdks
          ref: ${{ inputs.sdk_target_branch }}
          path: sdk
          token: ${{ steps.sdk-token.outputs.token }}
          persist-credentials: false

      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: sdk/package-lock.json

      - name: Install SDK tooling
        working-directory: sdk
        run: npm ci

      - name: Compare contracts with handwritten coverage
        env:
          MESSAGING_SPEC_PATH: ${{ inputs.messaging_spec_path }}
          PLATFORM_SPEC_PATH: ${{ inputs.platform_spec_path }}
        working-directory: sdk
        run: |
          node scripts/check-coverage.mjs \
            --messaging "../source/$MESSAGING_SPEC_PATH" \
            --platform "../source/$PLATFORM_SPEC_PATH" \
            --ledger contracts/coverage.json \
            --report "$RUNNER_TEMP/sdk-coverage.json"

      - name: Save coverage evidence before tracker synchronization
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: sdk-coverage-${{ inputs.source_sha }}
          path: ${{ runner.temp }}/sdk-coverage.json
          retention-days: 90
      - name: Reconcile engineering coverage in Linear
        env:
          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
          LINEAR_TEAM_ID: ${{ vars.LINEAR_TEAM_ID }}
          SOURCE_REPOSITORY: ${{ inputs.source_repository }}
          SOURCE_SHA: ${{ inputs.source_sha }}
          COVERAGE_REPORT: ${{ runner.temp }}/sdk-coverage.json
          COVERAGE_LINKS_OUTPUT: ${{ runner.temp }}/linear-coverage-links.json
        working-directory: sdk
        run: node scripts/sync-linear-coverage.mjs
      - name: Save feature-to-ticket mappings
        if: success()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: linear-coverage-links-${{ inputs.source_sha }}
          path: ${{ runner.temp }}/linear-coverage-links.json
          retention-days: 90