build-server.yml

name: build-server
run-name: ${{ github.actor }} server build

permissions:
  contents: write
  packages: write
  attestations: write
  id-token: write

on:
  push:
    branches:
      - dev
    tags:
      - 'server@*'
  pull_request:
    branches:
      - dev

env:
  CARGO_TERM_COLOR: always
  ROOT_DIR: apps/server/
  REGISTRY: ghcr.io
  USER_NAME: lastsunday
  IMAGE_NAME: job-hunting
  BIN_NAME: server

jobs:
  server-build:
    runs-on: ubuntu-latest
    steps:
      - name: Set Version Env
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          echo "VERSION=$(echo '${{  github.ref_name }}' | sed -e 's/server\@//g')" >> $GITHUB_ENV

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
        name: Install pnpm
        with:
          version: 10.5.0
          run_install: false

      - name: Install Node.js
        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610
        with:
          node-version: 22
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm exec nx run server:build --verbose

      - name: Run tests
        run: pnpm exec nx run server:test --verbose

  server-release:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{env.ROOT_DIR}}
    needs: server-build
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
      - name: Gen latest changelog
        run: |
          awk '/^##[^#]/{print NR}' CHANGELOG.md | head -n 2 | xargs | tr ' ' ',' | xargs -I {} sed -n {}p  CHANGELOG.md | sed '$d' > CHANGELOG.txt
      - name: Release
        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda
        id: create_release
        with:
          body_path: ${{env.ROOT_DIR}}CHANGELOG.txt
          make_latest: false

  server-upload-assets:
    needs: server-release
    defaults:
      run:
        shell: bash
        working-directory: ${{env.ROOT_DIR}}
    if: startsWith(github.ref, 'refs/tags/')
    strategy:
      matrix:
        include:
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            targetOSAndARCH: linux-arm64
          - target: aarch64-apple-darwin
            os: macos-latest
            targetOSAndARCH: macos-arm64
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            targetOSAndARCH: linux-amd64
          - target: x86_64-apple-darwin
            os: macos-latest
            targetOSAndARCH: macos-amd64
          # Universal macOS binary is supported as universal-apple-darwin.
          - target: universal-apple-darwin
            os: macos-latest
            targetOSAndARCH: macos
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            targetOSAndARCH: window-amd64
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
      - name: Set Version Env
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          echo "VERSION=$(echo '${{  github.ref_name }}' | sed -e 's/server\@//g')" >> $GITHUB_ENV
      - uses: taiki-e/upload-rust-binary-action@e7953b6078194a4ae5f5619632e3715db6275561
        with:
          # (required) Comma-separated list of binary names (non-extension portion of filename) to build and upload.
          # Note that glob pattern is not supported yet.
          bin: ${{ env.BIN_NAME}}
          archive: $bin-${{ env.VERSION }}-$target
          # (optional) Target triple, default is host triple.
          target: ${{ matrix.target }}
          # (required) GitHub token for uploading assets to GitHub Releases.
          token: ${{ secrets.GITHUB_TOKEN }}
          manifest-path: Cargo.toml
      - name: Rename bin file
        if: matrix.target != 'x86_64-pc-windows-msvc'
        run: |
          mv ${{github.workspace}}/dist/target/${{ matrix.target }}/release/${{ env.BIN_NAME}} ${{github.workspace}}/dist/target/${{ matrix.target }}/release/${{ env.BIN_NAME}}-${{ matrix.targetOSAndARCH }}
      - name: Upload artifact
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
        if: matrix.target != 'x86_64-pc-windows-msvc'
        with:
          name: ${{ env.BIN_NAME}}-${{ matrix.targetOSAndARCH }}
          path: ${{github.workspace}}/dist/target/${{ matrix.target }}/release/${{ env.BIN_NAME}}-${{ matrix.targetOSAndARCH }}

  server-upload-docker:
    runs-on: ubuntu-latest
    needs: server-upload-assets
    defaults:
      run:
        shell: bash
        working-directory: ${{env.ROOT_DIR}}
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Check out
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Download bin
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          path: ${{env.ROOT_DIR}}${{ env.IMAGE_NAME}}
          pattern: ${{ env.BIN_NAME}}-*
          merge-multiple: true
      - name: Move bin file
        run: |
          mv ${{ env.IMAGE_NAME}}/* ./
      - name: Chmod bin file 755
        run: |
          chmod 755 ${{ env.BIN_NAME}}-*
      - name: Set up QEMU
        uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9
      - name: Log in to Docker Hub
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Log in to the Container registry
        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
        with:
          images: |
            ${{env.USER_NAME}}/${{ env.IMAGE_NAME}}
            ghcr.io/${{env.USER_NAME}}/${{ env.IMAGE_NAME}}
      - name: Build and push Docker images
        id: push
        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
        with:
          context: ${{env.ROOT_DIR}}
          platforms: |
            linux/amd64
            linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018
        with:
          subject-name: ${{ env.REGISTRY }}/${{env.USER_NAME}}/${{ env.IMAGE_NAME}}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true