name: vet OSS Components

on:
  pull_request:
  push:
    branches:
      - main

# PRs share a concurrency group (cancel/serialize); Pushes use unique groups to avoid cancellation/queuing
concurrency:
  group: ${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.ref) || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read
  issues: write
  pull-requests: write
  security-events: write

jobs:
  vet:
    name: vet
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        id: checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Enable Cloud Mode
        run: echo "SAFEDEP_CLOUD_MODE=true" >> $GITHUB_ENV

      - name: Override Cloud Mode if Actor is Dependabot
        if: github.actor == 'dependabot[bot]'
        run: echo "SAFEDEP_CLOUD_MODE=false" >> $GITHUB_ENV

      - name: Override Cloud Mode if PR is from External Repository
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
        run: echo "SAFEDEP_CLOUD_MODE=false" >> $GITHUB_ENV

      - name: Run vet
        uses: safedep/vet-action@01f547ee95dfd4f8f11fa64b399e5e00f22b0801
        with:
          policy: .github/vet/policy.yml
          cloud: ${{ env.SAFEDEP_CLOUD_MODE }}
          cloud-key: ${{ secrets.SAFEDEP_CLOUD_API_KEY }}
          cloud-tenant: ${{ secrets.SAFEDEP_CLOUD_TENANT_DOMAIN }}
          enable-comments-proxy: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SAFEDEP_CLOUD_MODE: ${{ env.SAFEDEP_CLOUD_MODE }}