verify-public-interface.yml

name: Verify public interface
on:
  pull_request:
    types: [opened, labeled, unlabeled, synchronize]
    paths:
      - '**/*.swift'
      - '!StripeFinancialConnections/**'
      - '!StripeIdentity/**'
      - '!StripeConnections/**'

jobs:
  public-api-check:
    runs-on: macos-14
    permissions:
      pull-requests: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v2
        with:
            fetch-depth: 0

      - name: Build frameworks and compare interfaces
        id: build-frameworks-compare-interface
        run: |
          ruby ci_scripts/api_diff/build_xcframeworks.rb
          ruby ci_scripts/api_diff/diff_public_interface.rb
          if [ -f diff_result.txt ]; then
            echo "diff<<EOF" >> $GITHUB_ENV
            cat diff_result.txt >> $GITHUB_ENV
            echo "EOF" >> $GITHUB_ENV
          else 
            echo "diff_result.txt not found, skipping." 
          fi
          
      - uses: peter-evans/find-comment@v1
        id: find_comment
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body-includes: Public API changes detected

      - uses: peter-evans/create-or-update-comment@v1
        id: create-update-comment
        if: env.diff != ''
        with:
          body: |
            ⚠️ Public API changes detected:

            ${{ env.diff }}

            If you are adding a new public API consider the following:
            - Do these APIs need to be `public` or can they be protected with `@_spi(STP)`?
            - If these APIs need to be `public`, assess whether they require an API review.
            
            If you are modifying or removing a public API:
            - Does this require a breaking version change?
            - Do these changes require API review?

            If you confirm these APIs need to be added/updated and have undergone necessary review, add the label `modifies public API` to this PR to acknowledge and bypass this check.

            ℹ️ If this comment appears to be left in error, make sure your branch is up-to-date with `master`.
          edit-mode: replace
          comment-id: ${{ steps.find_comment.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Fail if not acknowledged
        if: "env.diff != '' && !contains(github.event.pull_request.labels.*.name, 'modifies public API')"
        run: exit 1