name: Qodana

on:
  workflow_dispatch:
  pull_request:
    branches: [master, beta, canary, internal]
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches: [master, beta, canary, internal]

permissions:
  contents: read
  checks: write
  pull-requests: write

concurrency:
  group: qodana-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref }}
  cancel-in-progress: true

jobs:
  qodana:
    name: Qodana
    if: >-
      github.event_name != 'pull_request' ||
      (
        github.event.pull_request.draft == false &&
        github.event.pull_request.head.repo.full_name == github.repository &&
        github.event.pull_request.user.login != 'dependabot[bot]'
      )
    runs-on: ubuntu-24.04
    timeout-minutes: 60

    steps:
      - name: Checkout repository
        # v5.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Require Qodana project token
        shell: bash
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
        run: |
          set -euo pipefail
          if [[ -z "${QODANA_TOKEN:-}" ]]; then
            echo "::error::QODANA_TOKEN is not configured for this repository."
            exit 1
          fi

      - name: Qodana
        # v2026.1.3
        uses: JetBrains/qodana-action@b588768b6e7e6da579e518bc584f79de0d243692
        with:
          use-caches: true
          cache-default-branch-only: true
          upload-result: false
          use-annotations: true
          pr-mode: ${{ github.event_name == 'pull_request' }}
          post-pr-comment: true
          github-token: ${{ github.token }}
          push-fixes: none
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}