ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Set up Go 1.25
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'

    - name: Install dependencies
      run: go mod download

    - name: Run tests
      run: go test -v -race -coverprofile=coverage.txt -covermode=atomic ./...

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v5
      with:
        file: ./coverage.txt
        flags: unittests
        name: codecov-umbrella

  lint:
    name: Lint
    runs-on: ubuntu-latest
    continue-on-error: true

    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Run golangci-lint
      uses: golangci/golangci-lint-action@v8
      with:
        version: latest

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [test]

    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: '1.25'

    - name: Build
      run: |
        go build -v -ldflags="-s -w" -o ghcr-exporter ./cmd

    - name: Upload build artifacts
      uses: actions/upload-artifact@v4
      with:
        name: ghcr-exporter
        path: ghcr-exporter
        retention-days: 30

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'table'
        exit-code: '1'
        severity: 'CRITICAL,HIGH'

  dev-build:
    name: Development Build
    runs-on: ubuntu-latest
    needs: [test]
    if: github.event_name == 'push'
    permissions:
      contents: read
      packages: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to GHCR
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Generate dev tag
      id: meta
      run: |
        # Create a dev tag with commit SHA and timestamp
        SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7)
        TIMESTAMP=$(date +%Y%m%d-%H%M%S)
        DEV_TAG="dev-${TIMESTAMP}-${SHORT_SHA}"
        echo "dev_tag=${DEV_TAG}" >> $GITHUB_OUTPUT
        echo "Generated dev tag: ${DEV_TAG}"

    - name: Extract metadata
      id: docker_meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          ${{ steps.meta.outputs.dev_tag }}
          dev

    - name: Build and push Docker image
      uses: docker/build-push-action@v6
      with:
        context: .
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.docker_meta.outputs.tags }}
        labels: ${{ steps.docker_meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=min
        continue-on-error: false
        build-args: |
          VERSION=${{ steps.meta.outputs.dev_tag }}
          COMMIT=${{ github.sha }}
          BUILD_DATE=${{ github.event.head_commit.timestamp }}