name: SAFE Scan

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    name: Build on OTP ${{matrix.otp}} / Elixir ${{matrix.elixir}}
    strategy:
      # Specify the OTP and Elixir versions to use when building
      # and running the workflow steps.
      matrix:
        otp: ["27.3.4"]
        elixir: ["1.19.0-rc.0"]
    env:
      MIX_ENV: prod
    steps:
      # Step: Setup Elixir + Erlang using erlef/setup-beam
      - name: Set up Elixir and Erlang
        uses: erlef/setup-beam@v1
        with:
          otp-version: ${{matrix.otp}}
          elixir-version: ${{matrix.elixir}}

      # Step: Check out the code.
      - name: Checkout code
        uses: actions/checkout@v4

      # Step: Define how to cache deps. Restores existing cache if present.
      - name: Cache deps
        id: cache-deps
        uses: actions/cache@v4
        env:
          cache-name: cache-elixir-deps
        with:
          path: deps
          key: ${{ runner.os }}-mix-${{ env.cache-name }}-${{ hashFiles('**/mix.lock') }}
          restore-keys: |
            ${{ runner.os }}-mix-${{ env.cache-name }}-
      - name: Install dependencies
        run: mix deps.get
      - name: Compiles without warnings
        run: mix compile --warnings-as-errors
      - name: Upload _build directory
        uses: actions/upload-artifact@v4
        with:
          name: build-artifact
          path: _build
  security-check:
    runs-on: ubuntu-latest
    needs: build
    container:
      image: erlangsolutions/safe:1.1.0-otp-24
    env:
      MIX_ENV: prod
    steps:
      - name: Download _build directory
        uses: actions/download-artifact@v4
        with:
          name: build-artifact
          path: _build

      - uses: actions/checkout@v4
      - run: safe start
        env:
          SAFE_LICENSE: ${{ secrets.SAFE_LICENSE }}
      - name: Persist results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: project-safe-results
          path: _results/aprs.me.safe