on_pr_target.yml

# This is workflow runs on PR
#
name: Pull Request Target

# Controls when the action will run.
on:
  # Trigger workflow for pull requests.
  pull_request_target:
    types: [opened, synchronize, reopened]

concurrency:
  group: PRT_${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  lint-pr:
    name: '▶️ actions'
    uses: ./.github/workflows/lint-pr.yml

  lint-code:
    name: '▶️ actions'
    uses: ./.github/workflows/lint-code.yml

  # Test is currently covered by test-code
  # build-code:
  #   name: '▶️ actions'
  #   needs: [lint-pr, lint-code]
  #   uses: ./.github/workflows/build-code.yml

  test-code:
    name: '▶️ actions'
    needs: [lint-pr, lint-code]
    uses: ./.github/workflows/test-code.yml

  codeql:
    name: '▶️ actions'
    needs: [lint-pr, lint-code]
    uses: ./.github/workflows/codeql.yml

  sonarqube:
    name: '▶️ actions'
    needs: [lint-pr, lint-code]
    uses: ./.github/workflows/sonarqube.yml
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN  }}

  # visual-test:
  #   name: '▶️ actions'
  #   # execute after successful code validation to save unnecessary screenshots costs
  #   needs: [lint-code, build-code, test-code, codeql, sonarqube]
  #   if: github.event.pull_request.draft == false # do not run on draft PR
  #   uses: ./.github/workflows/visual-test.yml
  #   secrets:
  #     PERCY_TOKEN: ${{ secrets.PERCY_TOKEN  }}

  dependabot:
    name: '▶️ actions'
    uses: ./.github/workflows/dependabot.yml
    secrets:
      GH_TOKEN: ${{ secrets.GH_TOKEN  }}

  publish:
    name: '▶️ actions'
    needs: [test-code, codeql, sonarqube]

    # Publish only if not PR is not in Draft state and it was not opened by dependabot
    if: github.event.pull_request.draft == false && github.actor != 'dependabot[bot]'

    uses: ./.github/workflows/publish.yml
    secrets:
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN  }}
      CLOUDFLARE_ID: ${{ secrets.CLOUDFLARE_ID  }}