.github/workflows/breaking_changes_detector.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

# Detect semver-incompatible (breaking) API changes in crates modified by a PR.
#
# Only public workspace crates that have file changes are checked.
# Crates with `publish = false` (such as benchmarks and test-utils) and
# datafusion-sqllogictest are excluded.
#
# This workflow only runs cargo-semver-checks and uploads the result as an
# artifact. The actual PR comment is posted by a companion workflow
# (`breaking_changes_detector_comment.yml`) that picks up the artifact via
# `workflow_run`.
#
# Why split it?
#   "The GITHUB_TOKEN has read-only permissions in pull requests from forked
#    repositories."
#     https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request
# A read-only token cannot post comments, so on fork PRs the previous
# single-workflow design failed with HTTP 403. We can't simply broaden the
# trigger here either: cargo-semver-checks compiles PR code (build.rs, proc
# macros), so granting this job a write token would expose it to any code
# in the PR. And ASF infra policy independently forbids `pull_request_target`
# for any workflow that exposes GITHUB_TOKEN
# (https://infra.apache.org/github-actions-policy.html). The companion
# `workflow_run` workflow runs in the base-repo context with write access
# and never executes PR code.

name: "Detect breaking changes"

on:
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  check-semver:
    name: Check semver
    runs-on: ubuntu-latest
    steps:
      # The checkout is GitHub's test merge commit of the PR into the base
      # branch. Depth 2 fetches that commit and its two parents: the base
      # branch commit the PR was merged into, and the PR head.
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 2

      # Compare against the base branch commit the PR was merged into, not the
      # base branch's current tip, which may include changes the PR is not
      # built on.
      - name: Determine base commit
        id: base
        run: |
          BASE_SHA=$(git rev-parse HEAD^1)
          echo "sha=$BASE_SHA" >> "$GITHUB_OUTPUT"
          echo "Base commit: $BASE_SHA"

      - name: Determine changed crates
        id: changed_crates
        env:
          BASE_SHA: ${{ steps.base.outputs.sha }}
        run: |
          PACKAGES=$(ci/scripts/changed_crates.sh changed-crates "$BASE_SHA")
          echo "packages=$PACKAGES" >> "$GITHUB_OUTPUT"
          echo "Changed crates: $PACKAGES"

      # The `substrait` crate's build script runs protoc, which is not
      # preinstalled on ubuntu-latest runners.
      - name: Install protoc
        if: steps.changed_crates.outputs.packages != ''
        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283  # v2.87.29
        with:
          tool: protoc@3.21.12

      - name: Install cargo-semver-checks
        if: steps.changed_crates.outputs.packages != ''
        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283  # v2.87.29
        with:
          tool: cargo-semver-checks

      - name: Run cargo-semver-checks
        id: check_semver
        if: steps.changed_crates.outputs.packages != ''
        env:
          BASE_SHA: ${{ steps.base.outputs.sha }}
          PACKAGES: ${{ steps.changed_crates.outputs.packages }}
        run: |
          set +e
          # `tee` lets cargo's output stream live into the Actions log
          # while we also keep a copy for the PR comment.
          ci/scripts/changed_crates.sh semver-check "$BASE_SHA" $PACKAGES \
            2>&1 | tee /tmp/semver-output.txt
          EXIT_CODE=${PIPESTATUS[0]}
          # Pass the result through an output instead of failing the job:
          # a detected breaking change should surface as a PR comment, not a
          # red check, so PR authors aren't confused by an intentional break.
          if [ "$EXIT_CODE" -eq 0 ]; then
            echo "result=success" >> "$GITHUB_OUTPUT"
          else
            echo "result=failure" >> "$GITHUB_OUTPUT"
          fi

      # Stage the data the companion comment workflow needs into a single
      # directory. We default the result to "success" so the comment
      # workflow clears any stale comment when the check step is skipped
      # (e.g. no published crates changed).
      - name: Stage artifact for comment workflow
        if: always()
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          CHECK_RESULT: ${{ steps.check_semver.outputs.result || 'success' }}
        run: |
          mkdir -p semver-artifact
          echo "$PR_NUMBER" > semver-artifact/pr_number
          echo "$CHECK_RESULT" > semver-artifact/result
          if [ -f /tmp/semver-output.txt ]; then
            sed 's/\x1b\[[0-9;]*m//g' /tmp/semver-output.txt > semver-artifact/logs
          else
            : > semver-artifact/logs
          fi

      - name: Upload artifact
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: semver-check-result
          path: semver-artifact/
          retention-days: 1