ci.yml

name: CI

on:
  push:
    branches: [ main, 'release-please--branches--main' ]
  pull_request:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Set up Go 1.25
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'

    - name: Install dependencies
      run: go mod download

    - name: Run tests
      run: go test -v -race -coverprofile=coverage.txt -covermode=atomic ./...

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v5
      with:
        files: ./coverage.txt
        flags: unittests
        name: codecov-umbrella

  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Run linting using Makefile
      run: make lint-only

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [test]

    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'

    - name: Build
      run: |
        go build -v -ldflags="-s -w" -o ghcr-exporter ./cmd

    - name: Upload build artifacts
      uses: actions/upload-artifact@v5
      with:
        name: ghcr-exporter
        path: ghcr-exporter
        retention-days: 30

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'table'
        exit-code: '1'
        severity: 'CRITICAL,HIGH'

  dev-build:
    name: Development Build
    runs-on: ubuntu-latest
    needs: [test]
    if: github.event_name == 'push'
    permissions:
      contents: read
      packages: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to GHCR
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Generate dev tag
      id: meta
      run: |
        # Create a semver-compatible dev tag with commits since last release and commit SHA
        SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7)
        
        # Get the last release tag (excluding pre-release tags)
        LAST_TAG=$(git describe --tags --abbrev=0 --match="v[0-9]*.[0-9]*.[0-9]*" 2>/dev/null || echo "")
        
        if [ -z "$LAST_TAG" ]; then
          # No release tags found, use 0.0.0 and count all commits
          VERSION="0.0.0"
          COMMIT_COUNT=$(git rev-list --count HEAD)
        else
          # Extract version from tag (remove 'v' prefix)
          VERSION=${LAST_TAG#v}
          # Count commits since last release
          COMMIT_COUNT=$(git rev-list --count ${LAST_TAG}..HEAD)
        fi
        
        DEV_TAG="v${VERSION}-dev.${COMMIT_COUNT}.${SHORT_SHA}"
        echo "dev_tag=${DEV_TAG}" >> $GITHUB_OUTPUT
        echo "Last release tag: ${LAST_TAG:-'none'}"
        echo "Base version: ${VERSION}"
        echo "Commits since last release: ${COMMIT_COUNT}"
        echo "Generated dev tag: ${DEV_TAG}"

    - name: Extract metadata
      id: docker_meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          ${{ steps.meta.outputs.dev_tag }}
          dev

    - name: Build and push Docker image
      uses: docker/build-push-action@v6
      with:
        context: .
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.docker_meta.outputs.tags }}
        labels: ${{ steps.docker_meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=min
        build-args: |
          VERSION=${{ steps.meta.outputs.dev_tag }}
          COMMIT=${{ github.sha }}
          BUILD_DATE=${{ github.event.head_commit.timestamp }}