name: Clang-tidy Hash CI

on:
  pull_request:
    paths:
      - ".clang-tidy"
      - "platformio.ini"
      - "requirements_dev.txt"
      - "sdkconfig.defaults"
      - ".clang-tidy.hash"
      - "script/clang_tidy_hash.py"
      - ".github/workflows/ci-clang-tidy-hash.yml"

permissions:
  contents: read        # actions/checkout for the PR head
  pull-requests: write  # pulls.createReview / listReviews / dismissReview when the clang-tidy hash is out of date

jobs:
  verify-hash:
    name: Verify clang-tidy hash
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"

      - name: Verify hash
        run: |
          python script/clang_tidy_hash.py --verify

      - if: failure()
        name: Show hash details
        run: |
          python script/clang_tidy_hash.py
          echo "## Job Failed" | tee -a $GITHUB_STEP_SUMMARY
          echo "You have modified clang-tidy configuration but have not updated the hash." | tee -a $GITHUB_STEP_SUMMARY
          echo "Please run 'script/clang_tidy_hash.py --update' and commit the changes." | tee -a $GITHUB_STEP_SUMMARY

      - if: failure() && github.event.pull_request.head.repo.full_name == github.repository
        name: Request changes
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            await github.rest.pulls.createReview({
              pull_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              event: 'REQUEST_CHANGES',
              body: 'You have modified clang-tidy configuration but have not updated the hash.\nPlease run `script/clang_tidy_hash.py --update` and commit the changes.'
            })

      - if: success() && github.event.pull_request.head.repo.full_name == github.repository
        name: Dismiss review
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            let reviews = await github.rest.pulls.listReviews({
              pull_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo
            });
            for (let review of reviews.data) {
              if (review.user.login === 'github-actions[bot]' && review.state === 'CHANGES_REQUESTED') {
                await github.rest.pulls.dismissReview({
                  pull_number: context.issue.number,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  review_id: review.id,
                  message: 'Clang-tidy hash now matches configuration.'
                });
              }
            }