name: Qodana

on:
  workflow_dispatch:
  pull_request:
    branches:
      - master
      - beta
      - canary
      - internal
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
  push:
    branches:
      - master
      - beta
      - canary
      - internal

concurrency:
  group: qodana-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  qodana:
    name: Qodana
    if: >-
      github.event_name != 'pull_request' ||
      (
        github.event.pull_request.draft == false &&
        github.event.pull_request.head.repo.full_name == github.repository &&
        github.event.pull_request.user.login != 'dependabot[bot]'
      )
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: read
      checks: write
      pull-requests: write
    steps:
      - name: Require Qodana Cloud token
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${QODANA_TOKEN}" ]]; then
            echo "::error::QODANA_TOKEN is not configured for this repository."
            exit 1
          fi

      - name: Check out the analyzed commit
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Run Qodana
        uses: JetBrains/qodana-action@4861e015da555e86a72b862892aba6c2b93e6891 # v2026.1.3
        with:
          pr-mode: ${{ github.event_name == 'pull_request' }}
          use-caches: true
          cache-default-branch-only: true
          use-annotations: true
          post-pr-comment: true
          github-token: ${{ github.token }}
          push-fixes: none
          upload-result: false
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}