name: Static Analysis
on:
    pull_request: {}
    push:
        branches: [develop, master]
    merge_group:
        types: [checks_requested]
concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
    cancel-in-progress: true

env:
    # This must be set for fetchdep.sh to get the right branch
    PR_NUMBER: ${{ github.event.pull_request.number }}
    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

permissions: {} # No permissions required

jobs:
    lint:
        strategy:
            fail-fast: false
            matrix:
                include:
                    - name: Typescript Syntax Check
                      install: layered
                      command: "lint:types"
                    - name: Oxfmt
                      install: normal
                      command: "lint:fmt"
                    - name: Oxlint
                      install: normal
                      command: "lint:js"
                    - name: Style Lint
                      install: normal
                      command: "lint:style"
                    - name: Workflow Lint
                      install: normal
                      command: "lint:workflows"
                    - name: Analyse Dead Code
                      install: normal
                      command: "lint:knip"
                    - name: Rethemendex Check
                      command: "rethemendex"
                      assert-diff: true
                    - name: Docs
                      install: layered
                      command: "docs:build"
                    - name: Unused settings
                      install: normal
                      command: "lint:unused-settings"
        name: ${{ matrix.name }}
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
              with:
                  persist-credentials: false

            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
              if: matrix.install != ''
              with:
                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install Dependencies (layered)
              if: matrix.install == 'layered'
              run: "./scripts/layered.sh"
            - name: Install Dependencies (normal)
              if: matrix.install == 'normal'
              run: "pnpm install --frozen-lockfile"

            - name: Run ${{ matrix.command }}
              run: pnpm nx run-many -t "$CMD" -p
              env:
                  CMD: ${{ matrix.command }}

            - name: Assert no changes
              run: git diff --exit-code
              if: matrix.assert-diff

    zizmor:
        name: Zizmor Github Actions lint
        runs-on: ubuntu-24.04
        permissions:
            security-events: write
        steps:
            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
              with:
                  persist-credentials: false

            - name: Run zizmor
              uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0

    i18n:
        strategy:
            fail-fast: false
            matrix:
                include:
                    - name: Element Web
                      path: "apps/web"
                      allowed-hardcoded-keys: |
                          console_dev_note
                          labs|element_call_video_rooms
                          labs|feature_disable_call_per_sender_encryption
                          voip|element_call
                          error|invalid_json
                          error|misconfigured
                          welcome|title_element
                          devtools|settings|elementCallUrl
                          labs|sliding_sync_description
                          settings|voip|noise_suppression_description
                          settings|voip|echo_cancellation_description
                    - name: Element Desktop
                      path: "apps/desktop"
                    - name: Shared Components
                      path: "packages/shared-components"
        name: "i18n Check (${{ matrix.name }})"
        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        permissions:
            pull-requests: read
        with:
            hardcoded-words: "Element"
            packageManager: pnpm
            path: ${{ matrix.path }}
            allowed-hardcoded-keys: ${{ matrix.allowed-hardcoded-keys }}

    # Dummy job to simplify branch protections
    ci:
        name: Static Analysis
        needs: [lint, i18n, zizmor]
        if: always()
        runs-on: ubuntu-24.04
        steps:
            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
              run: exit 1