build-and-test-windows.yml

name: Build and Test Windows

# Windows builds are only run on-demand, to be run once before merging a PR, and for pushes to dev. This is because
# Windows builds are much slower and more expensive than Ubuntu ones, and them catching issues that aren't surfaced
# under Ubuntu is rare (but does happen). So, not running them for every push of every PR.
on:
  workflow_dispatch:
  pull_request:
    types: [labeled]
  push:
    branches:
      - dev

jobs:
  remove-run-windows-build-label:
    if: github.ref_name != github.event.repository.default_branch && 
        github.event.label.name == 'run-windows-build'
    name: Remove Run Windows Build Label
    runs-on: ubuntu-22.04
    timeout-minutes: 2
    steps:
    - name: Remove Run Windows Build Label
      # v2.0.0
      uses: buildsville/add-remove-label@eeae411a9be2e173f2420e1644514edbecc4e835
      with:
        # The token is necessary to be able to remove the label even if the workflow is triggered by a pull request
        # coming from a fork.
        token: ${{ secrets.LOMBIQBOT_GITHUB_PERSONAL_ACCESS_TOKEN }}
        labels: run-windows-build
        type: remove

  build-and-test-larger-runners:
    if: github.ref_name != github.event.repository.default_branch && 
        (github.event_name == 'workflow_dispatch' || github.event.label.name == 'run-windows-build')
    name: Build and Test Windows - root solution (larger runners)
    uses: Lombiq/GitHub-Actions/.github/workflows/build-and-test-orchard-core.yml@dev
    with:
      machine-types: "['gitrunners-windows-2022-x64-8vcpu']"
      timeout-minutes: 30
      set-up-sql-server: "true"
      set-up-azurite: "true"
      ui-test-parallelism: 0
      build-create-binary-log: "true"
      blame-hang-timeout: "5m"
      # Running ZAP for security scans in Docker under GHA Windows runners won't work since such virtualization is not
      # supported by GHA.
      test-filter: "FullyQualifiedName!~SecurityScanningTests"

  build-and-test-standard-runners:
    # Since dev builds are not awaited by anyone, they can run on the slower free runners.
    if: github.ref_name == github.event.repository.default_branch
    name: Build and Test Windows - root solution (standard runners)
    uses: Lombiq/GitHub-Actions/.github/workflows/build-and-test-orchard-core.yml@dev
    with:
      machine-types: "['windows-2022']"
      timeout-minutes: 60
      set-up-sql-server: "true"
      set-up-azurite: "true"
      build-create-binary-log: "true"
      blame-hang-timeout: "5m"
      # Running ZAP for security scans in Docker under GHA Windows runners won't work since such virtualization is not
      # supported by GHA.
      test-filter: "FullyQualifiedName!~SecurityScanningTests"

  build-and-test-nuget-test:
    if: github.ref_name == github.event.repository.default_branch || 
        github.event_name == 'workflow_dispatch' ||
        github.event.label.name == 'run-windows-build'
    name: Build and Test Windows - NuGetTest solution
    uses: Lombiq/GitHub-Actions/.github/workflows/build-and-test-orchard-core.yml@dev
    with:
      machine-types: "['windows-2022']"
      build-directory: NuGetTest
      timeout-minutes: 25
      blame-hang-timeout: "5m"
      # Running ZAP for security scans in Docker under GHA Windows runners won't work since such virtualization is not
      # supported by GHA.
      test-filter: "FullyQualifiedName!~SecurityScanningTests"

  powershell-static-code-analysis:
    if: github.ref_name == github.event.repository.default_branch || 
        github.event_name == 'workflow_dispatch' ||
        github.event.label.name == 'run-windows-build'
    name: PowerShell Static Code Analysis Windows
    uses: Lombiq/PowerShell-Analyzers/.github/workflows/static-code-analysis.yml@dev
    with:
      machine-types: "['windows-2022']"
      run-windows-powershell: "false"

  post-pull-request-checks-automation:
    name: Post Pull Request Checks Automation
    needs: [build-and-test-larger-runners, build-and-test-nuget-test, powershell-static-code-analysis]
    if: github.event.pull_request != ''
    uses: Lombiq/GitHub-Actions/.github/workflows/post-pull-request-checks-automation.yml@dev
    secrets:
      JIRA_BASE_URL: ${{ secrets.DEFAULT_JIRA_BASE_URL }}
      JIRA_USER_EMAIL: ${{ secrets.DEFAULT_JIRA_USER_EMAIL }}
      JIRA_API_TOKEN: ${{ secrets.DEFAULT_JIRA_API_TOKEN }}
      MERGE_TOKEN: ${{ secrets.LOMBIQBOT_GITHUB_PERSONAL_ACCESS_TOKEN }}

  remove-windows-build-warning-label:
    name: Remove Windows Build Warning Label
    runs-on: ubuntu-22.04
    timeout-minutes: 2
    needs: [build-and-test-larger-runners, build-and-test-nuget-test, powershell-static-code-analysis]
    steps:
    - name: Remove Windows Build Warning Label
      # v2.0.0
      uses: buildsville/add-remove-label@eeae411a9be2e173f2420e1644514edbecc4e835
      with:
        # The token is necessary to be able to remove the label even if the workflow is triggered by a pull request
        # coming from a fork.
        token: ${{ secrets.LOMBIQBOT_GITHUB_PERSONAL_ACCESS_TOKEN }}
        labels: requires-windows-build
        type: remove