ci.yml

# SPDX-FileCopyrightText: 2025 Aleksandr Mezin <mezin.alexander@gmail.com>
#
# SPDX-License-Identifier: CC0-1.0

name: ci

on:
  workflow_call:
    inputs:
      push:
        type: boolean
        description: Push autogenerated changes
        default: false

    outputs:
      dist-tarball-artifact-id:
        description: Artifact id of dist tarball
        value: ${{ jobs.dist.outputs.artifact-id }}

      dist-tarball-checksum-artifact-id:
        description: Artifact id of dist tarball checksum file
        value: ${{ jobs.dist.outputs.checksum-artifact-id }}

      bundle-artifact-id:
        description: Artifact id of extension bundle file
        value: ${{ jobs.bundle.outputs.artifact-id }}

      release-notes-artifact-id:
        description: Artifact id of release notes file, if a new release should be published
        value: ${{ jobs.lint.outputs.release-notes-artifact-id }}

      version-tag:
        description: Current version tag
        value: ${{ jobs.lint.outputs.tag }}

defaults:
  run:
    shell: bash

permissions:
  contents: read

env:
  FORCE_COLOR: 1
  PIP_DISABLE_PIP_VERSION_CHECK: 1
  TERM: xterm-color
  TQDM_DISABLE: 1
  DEVTOOLS_COLOR: always

jobs:
  plan:
    runs-on: ubuntu-slim
    timeout-minutes: 5
    needs:
      - bundle
      - lint

    outputs:
      need-tests: ${{ steps.diff.outputs.changed != 'false' }}
      test-containers: ${{ steps.test-config.outputs.containers }}

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - id: actions
        name: Get the list of actions used in build and test jobs
        run: |
          names="$(yq -oj -I0 "$YQ_FILTER" .github/workflows/ci.yml)"
          echo "names=$names" | tee -a "$GITHUB_OUTPUT"
        env:
          YQ_FILTER: >-
            [
              .jobs["bundle", "test", "archlinux-package", "archlinux-package-check", "archlinux-installed-test"] |
              .steps.[].uses |
              select(.) |
              capture("^\\./\\.github/actions/(?<name>.*)$") |
              .name
            ] | unique

      - id: diff
        name: Check if tests are necessary
        uses: amezin/detect-changes-action@95b2732dd7b66cafe3e683304c0a3da0fb0bf674 # v2.2.4
        continue-on-error: true
        with:
          files: |
            ${{ needs.bundle.outputs.build-inputs }}

            # Files that influence build and test, even though they aren't included in the package
            .github/actions/{${{ join(fromJSON(steps.actions.outputs.names)) }}}/**
            .github/workflows/ci.yml
            requirements/{test,test-images,meson}.txt
            tests/**
            tools/heapgraph.py
            pytest.ini
            tox.ini
            PKGBUILD

            # Exclude any documentation and translations
            !**/*.md
            !**/*.license
            !**/REUSE.toml
            !LICENSES/**
            !po/**

            # Include meson.build files, even from po/ directory
            **/meson.build
            meson.options
            subprojects/*.wrap

      - id: test-config
        name: Determine test configurations
        working-directory: tests
        run: |
          containers="$(yq -oj -I0 "$YQ_FILTER" compose.yaml)"
          echo "containers=$containers" | tee -a "$GITHUB_OUTPUT"
        env:
          YQ_FILTER: >-
            [ .services | keys.[] | select(. != "archlinux") ]

  lint:
    runs-on: ubuntu-26.04
    timeout-minutes: 5

    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
      release-notes-artifact-id: ${{ steps.release-notes.outputs.artifact-id }}

    steps:
      - name: Checkout
        id: checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - id: apt
        uses: ./.github/actions/apt-install
        with:
          args: >-
            --no-install-recommends
            colorized-logs
            tox

      - name: Install development dependencies from npm
        id: npm
        uses: ./.github/actions/npm-install
        if: ${{ !cancelled() && steps.checkout.outcome == 'success' }}

      - name: Install Python dependencies
        id: pip
        uses: ./.github/actions/tox-preinstall
        with:
          environments: reuse,flake8,meson-format,pip-compile
        if: ${{ !cancelled() && steps.apt.outcome == 'success' }}

      - name: Install meson
        uses: ./.github/actions/setup-meson

      - name: Download subprojects
        run: meson subprojects download
        shell: pipetty bash -e {0}

      - name: Lint JS code with ESLint
        uses: ./.github/actions/eslint
        if: ${{ !cancelled() && steps.npm.outcome == 'success' }}

      - name: Lint Python code with flake8
        uses: ./.github/actions/flake8
        if: ${{ !cancelled() && steps.pip.outcome == 'success' }}

      - name: Lint Markdown files
        uses: ./.github/actions/markdownlint
        if: ${{ !cancelled() && steps.npm.outcome == 'success' }}

      - name: Check repository REUSE compliance
        uses: ./.github/actions/reuse
        if: ${{ !cancelled() && steps.pip.outcome == 'success' }}

      - name: Check meson.build formatting
        uses: ./.github/actions/meson-format
        if: ${{ !cancelled() && steps.pip.outcome == 'success' }}

      - name: Check Python requirements .txt files
        uses: ./.github/actions/pip-compile
        if: ${{ !cancelled() && steps.pip.outcome == 'success' }}

      - name: Check PICT test cases
        uses: ./.github/actions/pict
        if: ${{ !cancelled() && steps.checkout.outcome == 'success' }}

      - name: Add flake8 to PATH
        run: echo "$GITHUB_WORKSPACE/.tox/flake8/bin" >>"$GITHUB_PATH"
        if: ${{ !cancelled() && steps.pip.outcome == 'success' }}

      - name: Check GitHub Actions workflows
        uses: ./.github/actions/actionlint
        if: ${{ !cancelled() && steps.checkout.outcome == 'success' }}

      - name: Lint latest changelog entry
        run: npm run lint:release-notes
        if: ${{ !cancelled() && steps.npm.outcome == 'success' }}

      - name: Get current version
        id: version
        run: |
          version="$(jq -r .version package.json)"
          tag="v${version}"
          echo "version=$version" | tee -a "$GITHUB_OUTPUT"
          echo "tag=$tag" | tee -a "$GITHUB_OUTPUT"

      - name: Ensure version is the same in all places
        run: |
          npm version --ignore-scripts=false --allow-same-version "$VERSION"

          if ! git diff --exit-code --color=always
          then
            echo "::error:: Version doesn't match across files. Run 'npm version --ignore-scripts=false'"
            exit 1
          fi
        env:
          VERSION: ${{ steps.version.outputs.version }}

      - name: List existing releases
        id: releases
        run: |
          existing="$(gh release list --json tagName | jq -c '[.[].tagName]')"
          echo "existing=$existing" | tee -a "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}

      - name: Verify changelog version
        run: >-
          npm run-script changelog --
          ${{ case(contains(fromJSON(steps.releases.outputs.existing), steps.version.outputs.tag), '-u', '-d "$(date +%F)"') }}
          -v "$VERSION"
        env:
          VERSION: ${{ steps.version.outputs.version }}

      - name: Extract changelog entry
        run: npm run-script changelog -- -p "$RUNNER_TEMP/release-notes.md"

      - name: Upload release notes
        id: release-notes
        if: ${{ !contains(fromJSON(steps.releases.outputs.existing), steps.version.outputs.tag) }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: "${{ runner.temp }}/release-notes.md"
          if-no-files-found: error
          archive: false

  dist:
    runs-on: ubuntu-26.04
    timeout-minutes: 5

    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
      checksum-artifact-id: ${{ steps.checksum-upload.outputs.artifact-id }}

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: ./.github/actions/apt-install
        with:
          cache-save: true
          # Building package cache -> install all packages needed by other jobs
          args: >-
            --no-install-recommends
            colorized-logs
            desktop-file-utils
            gettext
            gjs
            libgtk-3-bin
            python3-gi
            tox
            xsltproc

      - name: Install meson
        uses: ./.github/actions/setup-meson

      - name: Download subprojects
        run: meson subprojects download
        shell: pipetty bash -e {0}

      - name: Prepare build directory
        run: meson setup '-Dshebang_override=/usr/bin/env gjs' '-Dtests=disabled' build
        shell: pipetty bash -e {0}

      - name: Generate dist tarball
        run: meson dist -C build --include-subprojects --no-tests --formats gztar
        shell: pipetty bash -e {0}

      - name: Upload dist tarball
        id: upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: build/meson-dist/ddterm-*.tar.gz
          if-no-files-found: error
          archive: false

      - name: Upload dist tarball checksum
        id: checksum-upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: build/meson-dist/ddterm-*.tar.gz.*sum
          if-no-files-found: error
          archive: false

  bundle:
    runs-on: ubuntu-26.04
    timeout-minutes: 5

    needs:
      - dist

    outputs:
      build-inputs: ${{ steps.ninja-inputs.outputs.inputs }}
      artifact-id: ${{ steps.upload.outputs.artifact-id }}

    steps:
      - name: Download dist tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ needs.dist.outputs.artifact-id }}
          path: ${{ runner.temp }}/dist
          skip-decompress: true

      - name: Extract dist tarball
        run: tar xvf "$RUNNER_TEMP"/dist/* --strip-components=1

      - uses: ./.github/actions/apt-install
        with:
          args: >-
            --no-install-recommends
            colorized-logs
            desktop-file-utils
            gettext
            gjs
            tox
            xsltproc

      - name: Install meson
        uses: ./.github/actions/setup-meson

      - name: Prepare build directory
        run: meson setup '-Dshebang_override=/usr/bin/env gjs' '-Dtests=disabled' build
        shell: pipetty bash -e {0}

      - name: Build extension bundle
        run: ninja -j1 bundle
        working-directory: build

      - name: Upload extension bundle as artifact
        id: upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: "build/*.shell-extension.zip"
          if-no-files-found: error
          archive: false

      - name: Run checks
        run: meson test -v -j1
        working-directory: build
        shell: pipetty bash -e {0}

      - name: Check REUSE compliance of generated bundle
        run: tox -e reuse-bundle -- build/*.shell-extension.zip

      - name: Generate a list of input files
        id: ninja-inputs
        working-directory: build
        run: |
          inputs="$(ninja -t inputs | xargs realpath "--relative-base=$GITHUB_WORKSPACE" | grep -v '^build/')"
          { echo "inputs<<../EOF"; echo "$inputs"; echo "../EOF"; } | tee -a "$GITHUB_OUTPUT"

  update-translations:
    needs:
      - lint
      - bundle

    runs-on: ubuntu-26.04
    timeout-minutes: 5

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: ./.github/actions/apt-install
        with:
          args: >-
            --no-install-recommends
            colorized-logs
            gettext
            gjs
            libgtk-3-bin
            tox
            xsltproc

      - name: Install meson
        uses: ./.github/actions/setup-meson

      - name: Prepare build directory
        id: setup
        run: meson setup '-Dtests=disabled' build
        shell: pipetty bash -e {0}

      - name: Update POTFILES.in
        run: ninja -j1 potfiles
        working-directory: build

      - name: Update .pot file
        run: ninja -j1 pot
        working-directory: build

      - name: Update .po files
        run: ninja -j1 msgmerge
        working-directory: build

      - name: Diff
        id: diff
        # Note: git diff --name-only ignores --ignore-matching-lines arg
        run: |
          git diff --color '--ignore-matching-lines=^"POT-Creation-Date: ' 'po/*.po' 'po/*.pot' 'po/POTFILES.in' | tee "$RUNNER_TEMP/po.diff"
          size="$(stat --printf=%s "$RUNNER_TEMP/po.diff")"
          echo "size=$size" | tee -a "$GITHUB_OUTPUT"

      - name: Create pull request
        if: vars.APP_ID && fromJSON(steps.diff.outputs.size) && inputs.push
        uses: ./.github/actions/pull-request
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_KEY }}
          title: 'translations: update translation files'
          description: 'Update translation files. Before merging this, make sure there are no unmerged changes from Weblate.'
          files: |
            po/*.po
            po/*.pot
            po/POTFILES.in

  test:
    needs:
      - dist
      - plan
      - bundle
      - lint

    strategy:
      fail-fast: false
      matrix:
        container: ${{ fromJSON(needs.plan.outputs.test-containers) }}

    if: fromJSON(needs.plan.outputs.need-tests)
    runs-on: ubuntu-26.04
    timeout-minutes: 15

    env:
      VIRTUALENV_SYSTEM_SITE_PACKAGES: 'true'

    steps:
      - name: Download dist tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ needs.dist.outputs.artifact-id }}
          path: ${{ runner.temp }}/dist
          skip-decompress: true

      - name: Extract dist tarball
        run: tar xvf "$RUNNER_TEMP"/dist/* --strip-components=1

      - uses: ./.github/actions/apt-install
        with:
          args: >-
            --no-install-recommends
            python3-gi
            tox

      - name: Download extension bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ needs.bundle.outputs.artifact-id }}
          skip-decompress: true

      - name: Install dependencies
        uses: ./.github/actions/tox-preinstall
        with:
          environments: pytest,images

      - name: Run tests
        uses: ./.github/actions/container-test
        with:
          container: ${{ matrix.container }}
          args: >-
            ${{ case(contains(matrix.container, 'alpine'), '', '--journald') }}
            --bundle=ddterm@amezin.github.com.shell-extension.zip

  archlinux-package:
    needs:
      - plan
      - bundle
      - lint

    runs-on: ubuntu-26.04
    timeout-minutes: 10
    container:
      image: ghcr.io/archlinux/archlinux:base-devel-20260705.0.552542@sha256:21a71a9356d75341088aea90fdae0973eb6ffeeaebc472086b26847605a50f5d
      options: --privileged --tmpfs /run

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0  # for pkgver()

      - name: Create build chroot
        uses: ./.github/actions/mkarchroot

      - name: Build package
        uses: ./.github/actions/makechrootpkg
        with:
          makepkg-args: --nocheck

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ github.job }}
          path: |
            *.pkg.tar.*
            *.log
          if-no-files-found: error

      - id: pkgfilename
        shell: bash -e -O extglob {0}
        run: |
          pkgfilename="$(echo -n *.pkg.tar@(|.+([^.])))"
          echo "pkgfilename=$pkgfilename" | tee -a "$GITHUB_OUTPUT"

    outputs:
      pkgfilename: ${{ steps.pkgfilename.outputs.pkgfilename }}

  archlinux-installed-test:
    needs:
      - plan
      - archlinux-package

    if: fromJSON(needs.plan.outputs.need-tests)
    runs-on: ubuntu-26.04
    timeout-minutes: 15

    env:
      VIRTUALENV_SYSTEM_SITE_PACKAGES: 'true'

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: ./.github/actions/apt-install
        with:
          args: >-
            --no-install-recommends
            python3-gi
            tox

      - name: Download extension package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: archlinux-package

      - name: Install dependencies
        uses: ./.github/actions/tox-preinstall
        with:
          environments: pytest,images

      - name: Run tests
        uses: ./.github/actions/container-test
        with:
          container: archlinux
          args: --journald "--sys-package=$PKGFILENAME"
        env:
          PKGFILENAME: ${{ needs.archlinux-package.outputs.pkgfilename }}

  archlinux-package-check:
    needs:
      - plan
      - archlinux-package

    if: fromJSON(needs.plan.outputs.need-tests)
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    container:
      image: ghcr.io/archlinux/archlinux:base-devel-20260705.0.552542@sha256:21a71a9356d75341088aea90fdae0973eb6ffeeaebc472086b26847605a50f5d
      options: --privileged --tmpfs /run --security-opt apparmor=unconfined

    steps:
      - name: Allow unprivileged userns in AppArmor
        run: |
          # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
          sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
          sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0  # for pkgver()

      - name: Create build chroot
        uses: ./.github/actions/mkarchroot

      - name: Build package
        uses: ./.github/actions/makechrootpkg
        with:
          makepkg-args: --check

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ github.job }}
          path: |
            *.pkg.tar.*
            *.log
          if-no-files-found: error