# This workflow will run clang-format and comment on the PR.
# Because of security reasons, it is crucial that this workflow
# executes no shell script nor runs make.
# Read this before editing: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

name: Clang-Format
on:
  pull_request_target:
    branches:
      - "master"
    paths:
      - "**.cpp"
      - "**.h"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  pull-requests: write

jobs:
  Clang-Format:
    name: Clang-Format
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Run clang-format style check
        uses: jidicula/clang-format-action@654a770daa28443dd111d133e4083e21c1075674 # v4.18.0
        id: clang-format
        continue-on-error: true
        with:
          clang-format-version: "20"
          exclude-regex: "incbin"

      - name: Comment on PR
        if: steps.clang-format.outcome == 'failure'
        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
        with:
          message: |
            clang-format 20 needs to be run on this PR.
            If you do not have clang-format installed, the maintainer will run it when merging.
            For the exact version please see https://packages.ubuntu.com/questing/clang-format-20.
            An easier way to install it might be through https://apt.llvm.org/#llvmsh.

            _(execution **${{ github.run_id }}** / attempt **${{ github.run_attempt }}**)_
          comment-tag: execution
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Comment on PR
        if: steps.clang-format.outcome != 'failure'
        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
        with:
          message: |
            _(execution **${{ github.run_id }}** / attempt **${{ github.run_attempt }}**)_
          create-if-not-exists: false
          comment-tag: execution
          mode: delete
          github-token: ${{ secrets.GITHUB_TOKEN }}