name: build

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

jobs:
  test:
    runs-on: ubuntu-latest

    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2

      - name: Set up Python
        uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6 # tag=v3.1.2
        with:
          cache: pip

      - name: Install dependencies
        run: pip install -r requirements.txt

      - name: Run pre-commit
        run: >-
          pre-commit try-repo --all-files
          --ref="${GITHUB_SHA}"
          "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"

  tag:
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: [test]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
        with:
          fetch-depth: 0 # all tags

      - name: Get Renovate version
        id: get-renovate-version
        uses: mikefarah/yq@1425d0720ec16e51172b88c871ac85f56bcd8ae3 # tag=v4.25.1
        with:
          cmd: >-
            yq eval
            '.[]|select(.id=="renovate-config-validator")|.additional_dependencies[0]|split("@").[1]'
            .pre-commit-hooks.yaml

      - name: Create tag
        run: |
          TAG=${{ steps.get-renovate-version.outputs.result }}
          if ! git show-ref --tags "${TAG}" --quiet; then
            git tag "${TAG}" && git push origin "${TAG}"
          fi