ci.yaml

name: CI

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

env:
  IMAGE_NAME: home

jobs:
  format:
    name: Format
    runs-on: ubicloud-standard-2
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Setup Python
        uses: ./.github/actions/setup-python

      - name: Install formatters
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
        with:
          install: true
          cache: true
          install_args: "\"cargo:taplo-cli\" dprint"

      - name: Run formatters
        run: |
          mise format:ci

  lint:
    name: Lint
    runs-on: ubicloud-standard-2
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Setup Python
        uses: ./.github/actions/setup-python

      - name: Install linters
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
        with:
          install: true
          cache: true
          install_args: "\"cargo:taplo-cli\" \"npm:@infisical/cli\""

      - name: Run linters
        run: |
          mise lint:ci --continue-on-error

  type-check:
    name: Type Check
    runs-on: ubicloud-standard-2
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Setup Python
        uses: ./.github/actions/setup-python

      - name: Run Fast Type Check
        run: mise typecheck:ty

      - name: Add .venv/bin to PATH
        run: echo "$PWD/.venv/bin" >> $GITHUB_PATH

      - name: Run Slow Type Check
        uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3
        with:
          version: PATH
          project: ./pyrightconfig.json

  test:
    name: Test
    runs-on: ubicloud-standard-2
    permissions:
      pull-requests: write
      issues: write
      contents: read

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Setup Python
        uses: ./.github/actions/setup-python

      - name: Run tests
        if: ${{ github.event_name == 'pull_request'}}
        run: |
          mise run test:ci

      - name: Create test summary
        uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # v2
        with:
          show: "all"
          paths: results/pytest-junit.xml
          output: pytest-summary.md
        if: ${{ github.event_name == 'pull_request' && !cancelled() }}

      - name: Wrap test summary in details
        if: ${{ github.event_name == 'pull_request' && !cancelled() }}
        run: |
          echo "<details>" > pytest-summary-wrapped.md
          echo "" >> pytest-summary-wrapped.md
          echo "<summary>Test Results</summary>" >> pytest-summary-wrapped.md
          echo "" >> pytest-summary-wrapped.md
          cat pytest-summary.md >> pytest-summary-wrapped.md
          echo "" >> pytest-summary-wrapped.md
          echo "</details>" >> pytest-summary-wrapped.md
          mv pytest-summary-wrapped.md pytest-summary.md

      - name: Update PR with test results
        uses: ./.github/actions/find-update-or-create-comment
        if: ${{ github.event_name == 'pull_request' && !cancelled() }}
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body-includes: "Test Results"
          comment-author: "github-actions[bot]"
          body-path: pytest-summary.md
          edit-mode: replace

      - name: Run tests with coverage
        if: ${{ !cancelled() }}
        run: |
          mise run test:cov

  build:
    name: Build Docker Image
    runs-on: ubicloud-standard-2
    needs: [test, lint, type-check, format]
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine branch name
        id: branch
        run: |
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            echo "name=${{ github.head_ref }}" >> $GITHUB_OUTPUT
          else
            echo "name=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          fi

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=sha,prefix=${{ steps.branch.outputs.name }}-,format=short
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    name: Deploy to Fly.io
    runs-on: ubicloud-standard-2
    needs: [build]
    if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Setup Fly.io CLI
        uses: superfly/flyctl-actions/setup-flyctl@63da3ecc5e2793b98a3f2519b3d75d4f4c11cec2

      - name: Deploy to Fly.io
        run: flyctl deploy --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}