verify-public-interface.yml

name: Verify public interface
on:
  pull_request:
    types: [opened, labeled, unlabeled, synchronize]
    paths:
      - '**/*.swift'
      - '!StripeFinancialConnections/**'
      - '!StripeIdentity/**'
      - '!StripeConnections/**'

jobs:
  public-api-check:
    runs-on: macos-14
    permissions:
      pull-requests: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v2
        with:
            fetch-depth: 0

      - name: Build frameworks
        id: build-frameworks
        run: |
          modules=("StripeUICore" "StripeCameraCore" "StripeApplePay" "StripePayments" "StripePaymentsUI" "StripePaymentSheet" "StripeCardScan")

          # Checkout old version, build and generate API JSON
          echo "Building and generating public interface from master..."
          git checkout ${{ github.base_ref }}
          
          xcodebuild clean archive \
          -quiet \
          -workspace "Stripe.xcworkspace" \
          -scheme "AllStripeFrameworks" \
          -destination 'generic/platform=iOS Simulator' \
          -configuration "Release" \
          -archivePath "./StripeFrameworks-sim-master.xcarchive" \
          -sdk iphonesimulator \
          SUPPORTS_MACCATALYST=NO \
          BUILD_LIBRARIES_FOR_DISTRIBUTION=YES \
          SWIFT_ACTIVE_COMPILATION_CONDITIONS=STRIPE_BUILD_PACKAGE \
          SKIP_INSTALL=NO

          xcodebuild -create-xcframework \
          -framework "./StripeFrameworks-sim-master.xcarchive/Products/Library/Frameworks/StripePaymentSheet.framework" \
          -output "./StripePaymentSheet-master.xcframework"

          # Checkout new version, build and generate API JSON
          echo "Building and generating public interface from current branch..."
          git checkout ${{ github.head_ref }}

          xcodebuild clean archive \
          -quiet \
          -workspace "Stripe.xcworkspace" \
          -scheme "AllStripeFrameworks" \
          -destination 'generic/platform=iOS Simulator' \
          -configuration "Release" \
          -archivePath "./StripeFrameworks-sim-new.xcarchive" \
          -sdk iphonesimulator \
          SUPPORTS_MACCATALYST=NO \
          BUILD_LIBRARIES_FOR_DISTRIBUTION=YES \
          SWIFT_ACTIVE_COMPILATION_CONDITIONS=STRIPE_BUILD_PACKAGE \
          SKIP_INSTALL=NO

          xcodebuild -create-xcframework \
          -framework "./StripeFrameworks-sim-new.xcarchive/Products/Library/Frameworks/StripePaymentSheet.framework" \
          -output "./StripePaymentSheet-new.xcframework"

          echo "Generating public interface diff..."
          
          export API_DIFF=$(ruby ci_scripts/diff_pubilc_interface.rb \
          StripePaymentSheet-master.xcframework/ios-arm64_x86_64-simulator/StripePaymentSheet.framework/Modules/StripePaymentSheet.swiftmodule/x86_64-apple-ios-simulator.abi.json \
          StripePaymentSheet-new.xcframework/ios-arm64_x86_64-simulator/StripePaymentSheet.framework/Modules/StripePaymentSheet.swiftmodule/x86_64-apple-ios-simulator.abi.json)
          
          echo "API_DIFF=$API_DIFF" >> $GITHUB_ENV

      - name: Check for modified or added APIs
        id: check-api
        run: |
          if [[ -n "${{ env.API_DIFF }}" ]]; then
            echo "::set-output name=new_apis_detected::yes"
          else
            echo "::set-output name=new_apis_detected::"
          fi   

      - uses: peter-evans/find-comment@v1
        id: find_comment
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body-includes: New public APIs

      - uses: peter-evans/create-or-update-comment@v1
        id: create-update-comment
        if: steps.check-api.outputs.new_apis_detected == 'yes'
        with:
          body: |
            ⚠️ Change in public APIs detected:

            ```diff
            ${{ env.API_DIFF }}
            ```

            Consider the following:
            - Do these APIs need to be `public` or can they be protected with `@_spi(STP)`?
            - If these APIs need to be `public`, assess whether they require an API review.
            - If you are removing or modifying an existing public API does this require a breaking change?

            If you confirm these APIs need to be public and have undergone necessary review, add the label `adds public API` to this PR to acknowledge and bypass this check.
          edit-mode: replace
          comment-id: ${{ steps.find_comment.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Fail if not acknowledged
        if: "steps.check-api.outputs.new_apis_detected == 'yes' && !contains(github.event.pull_request.labels.*.name, 'adds public API')"
        run: exit 1