name: CI

on:
  push:
    branches:
      - '**'
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      container: ${{ steps.filter.outputs.container }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - name: Detect container changes
        id: filter
        uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
        with:
          filters: |
            container:
              - 'backend/**'
              - 'frontend/**'
              - 'deploy/**'
              - '.dockerignore'
              - 'release/version.yaml'
              - '.github/workflows/_container.yml'
              - '.github/workflows/ci.yml'

  quality:
    uses: ./.github/workflows/_quality.yml
    with:
      ref: ${{ github.event.pull_request.head.sha || github.sha }}

  container:
    needs: [changes, quality]
    if: needs.changes.outputs.container == 'true'
    permissions:
      contents: read
      security-events: write
    uses: ./.github/workflows/_container.yml
    with:
      ref: ${{ github.event.pull_request.head.sha || github.sha }}