ci.yml

# Validation: everything needed to trust a commit, nothing that publishes a release. Runs for
# every pull request, and is called by release.yml for every push to main.
#
# Every check is `docker run <ci-image> task <something>`: the workflow moves things around and
# never decides what "good" means. A red job reproduces locally with the same task.
#
# Trust model, as in gitops-reverser: PR code is built and tested but never meets a write token.
# On PRs the CI image moves between jobs as an artifact; on trusted runs it is pushed to ghcr.io.
name: CI

on:
  # Every pull request, whatever its base, so a stacked PR is validated too.
  pull_request:
  workflow_call:
    outputs:
      ci-image:
        description: CI base container image (pushed to ghcr.io on trusted runs)
        value: ${{ jobs.ci-container.outputs.image }}
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  CI_WORKDIR: /workspaces/${{ github.event.repository.name }}

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  ci-container:
    name: CI base container
    runs-on: ubuntu-latest
    timeout-minutes: 30
    outputs:
      image: ${{ steps.image.outputs.name }}
    permissions:
      contents: read
      # Only trusted (non-PR) runs push. Fork PRs get a read-only token regardless.
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Login to GitHub Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set image name
        id: image
        run: |
          IMAGE="${REGISTRY}/configbutler/settings-image-ci:${{ github.sha }}"
          echo "name=${IMAGE}" >> "$GITHUB_OUTPUT"

      - name: Build CI base container
        # PRs build and load only; trusted runs also push. :latest moves only from main.
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: .devcontainer/Dockerfile
          target: ci
          push: ${{ github.event_name != 'pull_request' }}
          load: true
          tags: |
            ${{ steps.image.outputs.name }}
            ${{ github.ref == 'refs/heads/main' && format('{0}/configbutler/settings-image-ci:latest', env.REGISTRY) || '' }}
          cache-from: type=gha,scope=ci-container
          cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=ci-container' || '' }}

      - name: Validate CI container tools
        run: |
          docker run --rm "${{ steps.image.outputs.name }}" bash -lc "
            set -e
            go version
            task --version
            golangci-lint version
            actionlint --version
            hadolint --version
            markdownlint-cli2 --version
            oras version
            crane version
            docker --version
          "

      - name: Save CI container image (PR)
        if: github.event_name == 'pull_request'
        run: docker save "${{ steps.image.outputs.name }}" -o ci-container-image.tar

      - name: Upload CI container image artifact (PR)
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ci-container-image
          path: ci-container-image.tar
          if-no-files-found: error
          retention-days: 1

  validate-devcontainer:
    name: Validate Dev Container
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build dev container (validation only)
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: .devcontainer/Dockerfile
          target: dev
          push: false
          load: true
          tags: settings-image-devcontainer:test
          cache-from: type=gha,scope=devcontainer
          cache-to: ${{ github.event_name == 'pull_request' && '' || 'type=gha,scope=devcontainer,mode=max' }}

      - name: Validate dev container tools
        run: |
          docker run --rm settings-image-devcontainer:test bash -lc "
            set -e
            go version
            task --version
            bash -ic 'complete -p task >/dev/null'
            dlv version
            gopls version
            staticcheck -version
          "

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: ci-container
    permissions:
      contents: read
      packages: read
    env:
      CI_CONTAINER: ${{ needs.ci-container.outputs.image }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Login to Docker registry
        if: github.event_name != 'pull_request'
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ${{ env.REGISTRY }} -u ${{ github.actor }} --password-stdin

      - name: Download CI container image (PR)
        if: github.event_name == 'pull_request'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ci-container-image
          path: .

      - name: Load CI container image (PR)
        if: github.event_name == 'pull_request'
        run: docker load -i ci-container-image.tar && rm -f ci-container-image.tar

      - name: Run lint
        run: |
          docker run --rm \
            -v "${GITHUB_WORKSPACE}:${{ env.CI_WORKDIR }}" \
            -w "${{ env.CI_WORKDIR }}" \
            "${CI_CONTAINER}" \
            bash -lc '
              set -e
              git config --global --add safe.directory "$PWD"
              task lint
            '

  test:
    name: Unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: ci-container
    permissions:
      contents: read
      packages: read
    env:
      CI_CONTAINER: ${{ needs.ci-container.outputs.image }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Login to Docker registry
        if: github.event_name != 'pull_request'
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ${{ env.REGISTRY }} -u ${{ github.actor }} --password-stdin

      - name: Download CI container image (PR)
        if: github.event_name == 'pull_request'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ci-container-image
          path: .

      - name: Load CI container image (PR)
        if: github.event_name == 'pull_request'
        run: docker load -i ci-container-image.tar && rm -f ci-container-image.tar

      - name: Run tests and build
        run: |
          docker run --rm \
            -v "${GITHUB_WORKSPACE}:${{ env.CI_WORKDIR }}" \
            -w "${{ env.CI_WORKDIR }}" \
            "${CI_CONTAINER}" \
            bash -lc '
              set -e
              git config --global --add safe.directory "$PWD"
              task test
              task build
            '