name: R valgrind tests

# 'run-name' is used here to distinguish in the API between different runs from forks.
#
# When this was added, it was the only way to feed workflow inputs into something that
# would show up in the output of 'gh run list'.
#
# See https://github.com/orgs/community/discussions/73223#discussioncomment-11862624
run-name: R valgrind tests (pr=${{ inputs.pr-number }})

# automatically cancel in-progress builds if another commit is pushed
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# default to 0 permissions
# (job-level overrides add the minimal permissions needed)
permissions:
  contents: none

on:
  workflow_dispatch:
    inputs:
      pr-branch:
        type: string
        description: |
          Branch the PR was submitted from.
          Branches from forks should be prefixed with the user/org they originate from,
          like '{user}:{branch}'.
      pr-number:
        type: string
        description: Pull request ID, found in the PR URL.

jobs:
  test-r-valgrind:
    name: r-package (ubuntu-latest, R-devel, valgrind)
    timeout-minutes: 360
    runs-on: ubuntu-latest
    container: wch1/r-debug  # zizmor: ignore[unpinned-images]
    env:
      GITHUB_TOKEN: ${{ github.token }}
    permissions:
      actions: write
      checks: write
      contents: read
      id-token: write
      pull-requests: write
      statuses: write
    steps:
      - name: Install essential software before checkout
        shell: bash
        run: |
          apt-get update
          apt-get install --no-install-recommends -y \
            curl \
            jq
      - name: Install GitHub CLI
        run: |
          GH_CLI_VERSION="2.83.0"
          curl \
            --fail \
            -O \
            -L \
            https://github.com/cli/cli/releases/download/v${GH_CLI_VERSION}/gh_${GH_CLI_VERSION}_linux_amd64.tar.gz
          tar -xvf ./gh_${GH_CLI_VERSION}_linux_amd64.tar.gz
          mv ./gh_${GH_CLI_VERSION}_linux_amd64/bin/gh /usr/local/bin/
      - name: Trust git cloning LightGBM
        run: |
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          fetch-depth: 5
          submodules: true
          persist-credentials: false
          repository: lightgbm-org/LightGBM
          ref: "refs/pull/${{ inputs.pr-number }}/merge"
      - name: Run tests with valgrind
        shell: bash
        run: ./.ci/test-r-package-valgrind.sh
      - name: Send final status
        if: ${{ always() }}
        env:
          GITHUB__WORKFLOW: ${{ github.workflow }}
          INPUTS__PR_NUMBER: ${{ inputs.pr-number }}
          JOB__STATUS: ${{ job.status }}
        run: |
          $GITHUB_WORKSPACE/.ci/set-commit-status.sh \
            "${GITHUB_WORKFLOW}" \
            "${JOB__STATUS}" \
            "${{ github.sha }}"
          comment="Workflow **${GITHUB__WORKFLOW}** has been triggered! 🚀\r\n"
          comment="${comment}\r\n${GITHUB_SERVER_URL}/lightgbm-org/LightGBM/actions/runs/${GITHUB_RUN_ID} \r\n"
          comment="${comment}\r\nStatus: ${JOB__STATUS}"
          $GITHUB_WORKSPACE/.ci/append-comment.sh \
            "${INPUTS__PR_NUMBER}" \
            "${comment}"
      - name: Rerun workflow-indicator
        if: ${{ always() }}
        env:
          INPUTS__PR_BRANCH: ${{ inputs.pr-branch }}
        run: |
          bash $GITHUB_WORKSPACE/.ci/rerun-workflow.sh \
            "optional_checks.yml" \
            "${INPUTS__PR_BRANCH}" \
            || true