# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Node CI

on:
  push:
    branches-ignore:
      - 'dependabot/**'
  pull_request:
    branches:
      - '*'

permissions:
  contents: read
  security-events: write

jobs:
  test:
    name: NodeJS ${{ matrix.node-version }} on ${{ matrix.os }}

    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        node-version: [20.x, 22.x, 24.x]
        os: [ubuntu-latest, windows-latest, macos-15]

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 1
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node-version }}

      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Environment Information
        run: |
          node --version
          npm --version
          gradle --version

      # "bin/templates/platform_www/cordova.js" is ignored because it is a generated file.
      # It contains mixed content from the npm package "cordova-js" and "./cordova-js-src".
      # The report might not be resolvable because of the external package.
      # If the report is related to this repository, it would be detected when scanning "./cordova-js-src".
      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: javascript, java-kotlin
          queries: security-and-quality
          config: |
            paths-ignore:
              - coverage
              - node_modules
              - templates/project/assets/www/cordova.js
              - test/androidx/app/src/main/assets/www/cordova.js

      - name: npm install and test
        run: |
          npm cit
        env:
          CI: true

      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

      # v4.6.0
      - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
        if: success()
        with:
          name: ${{ runner.os }} node.js ${{ matrix.node-version }}
          token: ${{ secrets.CORDOVA_CODECOV_TOKEN }}
          fail_ci_if_error: false