name: Erlang CI

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - uses: erlef/setup-beam@v1
        with:
          otp-version: "24"
          rebar3-version: "3.20.0"
      - name: Compile
        run: rebar3 compile

      - name: Upload _build directory
        uses: actions/upload-artifact@v3
        with:
          name: build-artifact
          path: _build

  security-check:
    runs-on: ubuntu-latest
    needs: build
    container:
      image: erlangsolutions/safe:1.1.0-otp-24
    steps:
      - name: Download _build directory
        uses: actions/download-artifact@v3
        with:
          name: build-artifact
          path: _build

      - uses: actions/checkout@v4
      - run: safe start
        env:
          SAFE_LICENSE: ${{ secrets.SAFE_LICENSE }}
      - name: Persist results
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: project-safe-results
          path: _results/aprs.me.safe