ci.yml

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    branches:
      - main
    paths-ignore:
      - '**.png'
      - '**.md'
      - 'LICENSE*'
      - '.git*'
      - '.envrc'
      - 'garnix.yaml'
      - '.github/workflows/cd.yml'
  workflow_dispatch:

permissions:
  pull-requests: write
  contents: read
  issues: write
  checks: read
  statuses: read

jobs:
  coverage:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
    - uses: actions/checkout@v6
    - uses: cachix/install-nix-action@v31
      with:
        github_access_token: ${{ secrets.GITHUB_TOKEN }}
        extra_nix_config: | # TODO Ensure nix uses the most performant cache between Garnix and Cachix every time
          extra-substituters = https://cache.garnix.io
          extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
    - uses: cachix/cachix-action@v17
      with:
        name: gfauredev
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
    - run: sleep 5 #  Sleep hoping Garnix evaluation will start after
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'Evaluate flake.nix'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'check coverage.*'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - run: nix build .#checks.x86_64-linux.coverage -o coverage # From Garnix
    - run: .script/coverage-report.sh
      id: coverage_report
    - if: always() && github.event_name == 'pull_request'
      uses: peter-evans/create-or-update-comment@v5
      with:
        issue-number: ${{ github.event.pull_request.number }}
        body: |
          ### 📊 Coverage Report

          **Lines: ${{ steps.coverage_report.outputs.COVERED }}/${{ steps.coverage_report.outputs.TOTAL }} (${{ steps.coverage_report.outputs.PERCENT }}%)**

          ⏱️ Tests: ${{ steps.coverage_report.outputs.TESTS_COUNT }} tests in ${{ steps.coverage_report.outputs.DURATION }}s

          ${{ steps.coverage_report.outputs.REPORT }}
    - run: exit "${{ steps.coverage_report.outputs.FAIL }}"

  android-build:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      checks: read    # Required by wait-on-check-action
      statuses: read  # Required by wait-on-check-action
    steps:
    - uses: actions/checkout@v6
      with:
        lfs: true
    - uses: cachix/install-nix-action@v31
      with:
        github_access_token: ${{ secrets.GITHUB_TOKEN }}
        extra_nix_config: |
          extra-substituters = https://cache.garnix.io
          extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
    - uses: cachix/cachix-action@v17
      with:
        name: gfauredev
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
    - run: sleep 5 #  Sleep hoping Garnix evaluation will start after
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'Evaluate flake.nix'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'package androidBuild.*'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - uses: timheuer/base64-to-file@v1.2.4
      with:
        fileName: 'logout.jks'
        encodedString: ${{ secrets.ANDROID_KEYSTORE_B64 }}
      id: keystore
    - run: nix run .#androidBuild
      env:
        ANDROID_KEYSTORE_PATH: ${{ steps.keystore.outputs.filePath }}
        ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
    - uses: actions/upload-artifact@v4
      with: { name: android, path: '*.apk' }

  lighthouse:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    needs: coverage
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
    - uses: actions/checkout@v6
    - uses: cachix/install-nix-action@v31
      with:
        github_access_token: ${{ secrets.GITHUB_TOKEN }}
        extra_nix_config: | # TODO Ensure nix uses the most performant cache between Garnix and Cachix every time
          extra-substituters = https://cache.garnix.io
          extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
    - uses: cachix/cachix-action@v17
      with:
        name: gfauredev
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
    - name: Start web app server
      run: |
        nix run &
        timeout 60 bash -c 'until curl -sf http://localhost:8080/LogOut/ > /dev/null 2>&1; do sleep 1; done'
    - uses: treosh/lighthouse-ci-action@v12
      with:
        urls: http://localhost:8080/LogOut/
        uploadArtifacts: true
        temporaryPublicStorage: true
        configPath: .lighthouserc.json
      id: lighthouse_audit
    - if: always() && github.event_name == 'pull_request'
      run: .script/lighthouse-report.sh '${{ steps.lighthouse_audit.outputs.links }}'
      id: lighthouse_results
    - if: always() && github.event_name == 'pull_request'
      uses: peter-evans/create-or-update-comment@v5
      with:
        issue-number: ${{ github.event.pull_request.number }}
        body: ${{ steps.lighthouse_results.outputs.BODY }}

  e2e-web:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    needs: coverage
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
    - uses: actions/checkout@v6
    - uses: cachix/install-nix-action@v31
      with:
        github_access_token: ${{ secrets.GITHUB_TOKEN }}
        extra_nix_config: | # TODO Ensure nix uses the most performant cache between Garnix and Cachix every time
          extra-substituters = https://cache.garnix.io
          extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
    - uses: cachix/cachix-action@v17
      with:
        name: gfauredev
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
    - name: Remove system Chrome to prevent version mismatch with nixpkgs chromedriver
      run: sudo apt-get remove -y google-chrome-stable
    - run: |
        set -o pipefail
        nix run .#webE2eTest |& tee maestro_console.log
    - if: failure() && github.event_name == 'pull_request'
      env:
        CLOUDINARY_CLOUD_NAME: ${{ secrets.CLOUDINARY_CLOUD_NAME }}
        CLOUDINARY_UPLOAD_PRESET: ${{ secrets.CLOUDINARY_UPLOAD_PRESET }}
      run: .script/e2e-web-report.sh
      id: upload_screenshots
    - if: failure() && github.event_name == 'pull_request' && steps.upload_screenshots.outputs.REPORT_BODY != ''
      uses: peter-evans/create-or-update-comment@v5
      with:
        issue-number: ${{ github.event.pull_request.number }}
        body: ${{ steps.upload_screenshots.outputs.REPORT_BODY }}
    - if: failure() || cancelled()
      uses: actions/upload-artifact@v7
      with:
        name: maestro-web-report
        path: ~/.maestro/tests/