driver-schema-version.yml

# NOTE: it is UNSAFE to run ANY kind of script when using the pull_request_target trigger!
# DO NOT TOUCH THIS FILE UNLESS THE TRIGGER IS CHANGED.
# See warning in https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.

name: Driver SCHEMA_VERSION checks
on:
  pull_request_target:
    paths:
      - 'driver/event_table.c'
      - 'driver/ppm_events_public.h'
      - 'driver/event_stats.h'
      - 'driver/syscall_*'

jobs:
  paths-filter:
    runs-on: ubuntu-latest
    outputs:
      driver_schema_changed: ${{ steps.filter.outputs.driver_schema }}
    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
      id: filter
      with:
        filters: |
          driver_schema:
            - 'driver/SCHEMA_VERSION'

  driver-schema:
    runs-on: ubuntu-22.04
    permissions:
      pull-requests: write
    needs: paths-filter
    if: needs.paths-filter.outputs.driver_schema_changed == 'false'
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Check driver SCHEMA_VERSION
        uses: mshick/add-pr-comment@7c0890544fb33b0bdd2e59467fbacb62e028a096 # v2.8.1
        with:
          message: |
            Please double check **driver/SCHEMA_VERSION** file. See [versioning](https://github.com/falcosecurity/libs/blob/master/driver/README.VERSION.md#schema-version-number).
            
            /hold

      - name: Trigger failure
        run: |
          echo Driver schema version likely needs to be bumped
          cat ./driver/SCHEMA_VERSION
          echo
          echo Please double check **driver/SCHEMA_VERSION** file.
          echo See: https://github.com/falcosecurity/libs/blob/master/driver/README.VERSION.md#schema-version-number.
          exit 1