name: Unit Tests

on:
  push:
    branches: [ "main", "7.*", "8.*", "9.*" ]
  pull_request:
    branches: [ "*" ]

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
      with:
        fetch-depth: 1

    - name: Fetch main branch
      run: |
        git fetch origin main:refs/remotes/origin/main

    - name: Set up Python 3.13
      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
      with:
        python-version: '3.13'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip cache purge
        pip install .[dev]
        pip install lib/kibana
        pip install lib/kql

    - name: Unit tests
      env:
        # only run the test test_rule_change_has_updated_date on pull request events to main
        GITHUB_EVENT_NAME: "${{ github.event_name}}"
        # only run remote validation if repo is set to do so otherwise defer to .github/workflows/esql-validation.yml
        DR_REMOTE_ESQL_VALIDATION: "${{ vars.remote_esql_validation }}"
        DR_CLOUD_ID: ${{ secrets.dr_cloud_id }}
        DR_KIBANA_URL: ${{ secrets.dr_cloud_id }}
        DR_ELASTICSEARCH_URL: ${{ secrets.dr_cloud_id }}
        DR_API_KEY: ${{ secrets.dr_api_key }}
        DR_IGNORE_SSL_ERRORS: ${{ secrets.dr_cloud_id }}
      run: |
        python -m detection_rules test

    - name: Build release package
      env:
        # only generate the navigator files on push events to main
        GENERATE_NAVIGATOR_FILES: "${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && '--generate-navigator' || ' ' }}"
      run: |
        python -m detection_rules dev build-release $GENERATE_NAVIGATOR_FILES

    - name: Archive production artifacts for branch builds
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      if: |
        github.event_name == 'push'
      with:
        name: release-files
        path: |
          releases

    - name: Update navigator gist files
      env:
        GITHUB_TOKEN: "${{ secrets.WRITE_TRADEBOT_GIST_TOKEN }}"
      if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
      run: python -m detection_rules dev update-navigator-gists