spiegel-keyman/.github/workflows/api-verification.yml

name: "API Verification"
on:
 workflow_run:
    workflows: [Ubuntu packaging]
    types:
      - completed

env:
  STATUS_CONTEXT: 'API Verification'
  PKG_NAME: 'libkeymancore'
  GH_TOKEN: ${{ github.token }}

jobs:
  api_verification:
    name: Verify API for libkeymancore*.so
    runs-on: ubuntu-latest
    outputs:
      KEYMAN_VERSION: ${{ steps.environment_step.outputs.KEYMAN_VERSION }}
      PRERELEASE_TAG: ${{ steps.environment_step.outputs.PRERELEASE_TAG }}
      GIT_SHA: ${{ steps.environment_step.outputs.GIT_SHA }}
      GIT_BASE: ${{ steps.environment_step.outputs.GIT_BASE }}
      IS_TEST_BUILD: ${{ steps.environment_step.outputs.IS_TEST_BUILD }}
      GIT_BRANCH: ${{ steps.environment_step.outputs.GIT_BRANCH }}
      GIT_BASE_BRANCH: ${{ steps.environment_step.outputs.GIT_BASE_BRANCH }}
      GIT_USER: ${{ steps.environment_step.outputs.GIT_USER }}
      SKIP_API_CHECK: ${{ steps.environment_step.outputs.SKIP_API_CHECK }}

    steps:
    - name: Restore artifacts
      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      with:
        path: |
          artifacts
        key: artifacts-key-${{ github.event.workflow_run.id }}
        restore-keys: artifacts-key-

    - name: Read environment
      id: environment_step
      run: |
        cat artifacts/env >> $GITHUB_OUTPUT

    - name: Set pending status on PR builds
      id: set_status
      if: steps.environment_step.outputs.IS_TEST_BUILD == 'true' && steps.environment_step.outputs.SKIP_API_CHECK != 'true'
      shell: bash
      run: |
        gh api \
          --method POST \
          -H "Accept: application/vnd.github+json" \
          /repos/$GITHUB_REPOSITORY/statuses/${{ steps.environment_step.outputs.GIT_SHA }} \
          -f state='pending' \
          -f target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
          -f description='API verification started' \
          -f context="$STATUS_CONTEXT"

    - name: Checkout
      if: steps.environment_step.outputs.SKIP_API_CHECK != 'true'
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        ref: '${{ steps.environment_step.outputs.GIT_SHA }}'
        fetch-depth: 0
        clean: false
        path: ${{ github.workspace }}/keyman/

    - name: Install devscripts
      if: steps.environment_step.outputs.SKIP_API_CHECK != 'true'
      uses: ./keyman/.github/actions/apt-install
      with:
        packages: devscripts equivs

    - name: "Verify API for libkeymancore*.so (${{ steps.environment_step.outputs.GIT_BRANCH }}, branch ${{ steps.environment_step.outputs.GIT_BASE_BRANCH }}, by ${{ steps.environment_step.outputs.GIT_USER }})"
      if: steps.environment_step.outputs.SKIP_API_CHECK != 'true'
      run: |
        echo "Verify API for libkeymancore*.so (${{ steps.environment_step.outputs.GIT_BRANCH }}, branch ${{ steps.environment_step.outputs.GIT_BASE_BRANCH }}, by ${{ steps.environment_step.outputs.GIT_USER }}):" | tee -a ${GITHUB_STEP_SUMMARY}

        BIN_PACKAGE=$(ls "${GITHUB_WORKSPACE}/artifacts/" | grep "${PKG_NAME}[0-9]*_${{ steps.environment_step.outputs.KEYMAN_VERSION }}-1${{ steps.environment_step.outputs.PRERELEASE_TAG }}+$(lsb_release -c -s)1_amd64.deb")
        cd ${{ github.workspace }}/keyman/linux
        ./scripts/deb-packaging.sh \
          --gha \
          --bin-pkg "${GITHUB_WORKSPACE}/artifacts/${BIN_PACKAGE}" \
          --git-sha "${{ steps.environment_step.outputs.GIT_SHA }}" \
          --git-base "${{ steps.environment_step.outputs.GIT_BASE }}" \
          verify 2> >(tee -a ${GITHUB_STEP_SUMMARY} >&2)

    - name: Archive .symbols file
      if: steps.environment_step.outputs.SKIP_API_CHECK != 'true' && always()
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: libkeymancore.symbols
        path: ${{ github.workspace }}/keyman/linux/debian/tmp/DEBIAN/symbols

  set_status:
    name: Set result status on PR builds
    needs: [api_verification]
    runs-on: ubuntu-latest
    if: ${{ always() && needs.api_verification.outputs.IS_TEST_BUILD == 'true' && needs.api_verification.outputs.SKIP_API_CHECK != 'true' }}
    steps:
    - name: Set success
      if: needs.api_verification.result == 'success'
      run: |
        echo "RESULT=success" >> $GITHUB_ENV
        echo "MSG=API verification succeeded" >> $GITHUB_ENV

    - name: Set cancelled
      if: needs.api_verification.result == 'cancelled'
      run: |
        echo "RESULT=error" >> $GITHUB_ENV
        echo "MSG=API verification cancelled" >> $GITHUB_ENV

    - name: Set failure
      if: needs.api_verification.result == 'failure'
      run: |
        echo "RESULT=failure" >> $GITHUB_ENV
        echo "MSG=API verification failed" >> $GITHUB_ENV

    - name: Set final status
      run: |
        gh api \
          --method POST \
          -H "Accept: application/vnd.github+json" \
          /repos/$GITHUB_REPOSITORY/statuses/${{ needs.api_verification.outputs.GIT_SHA }} \
          -f state="$RESULT" \
          -f target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
          -f description="$MSG" \
          -f context="$STATUS_CONTEXT"