ci.yml

# SPDX-License-Identifier: Apache-2.0
# umoci: Umoci Modifies Open Containers' Images
# Copyright (C) 2016-2025 SUSE LLC
# Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: ci

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  release:
    types: [ published ]
  schedule:
    - cron: '0 0 * * *'

permissions:
  contents: read
  pull-requests: read

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
      - run: make release
      - name: upload artifacts
        uses: actions/upload-artifact@v6
        with:
          name: release-${{ github.run_id }}
          path: release/*

  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version: '^1'
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.6
      - name: go fix
        run: |
          go fix ./...
          git diff --exit-code
      - name: gopls modernise
        run: |
          go run golang.org/x/tools/go/analysis/passes/modernize/cmd/modernize@latest -fix -test ./...
          git diff --exit-code
      - run: |
          make local-validate

  # TODO: Run the integration tests and rest of the CI, so we don't need to
  #       special-case MacOS here.
  macos:
    runs-on: macos-latest
    env:
      COVERAGE: umoci.coverage
      GOCOVERDIR: umoci.coverdir
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version: '^1'
      - name: install dependencies
        run: |
          brew ls --versions parallel && brew unlink parallel # clashes with moreutils
          brew install coreutils moreutils
      - run: make local-validate-build
      - run: make local-test-unit
      - run: go tool covdata textfmt -i "$GOCOVERDIR" -o "$COVERAGE"
      - name: codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: opencontainers/umoci
          files: ${{ env.COVERAGE }}
      - name: upload coverage
        uses: actions/upload-artifact@v6
        with:
          name: coverage-${{ runner.os }}-${{ github.job }}-${{ strategy.job-index }}
          path: ${{ env.GOCOVERDIR }}

  unit:
    runs-on: ubuntu-latest
    env:
      COVERAGE: umoci.coverage
      GOCOVERDIR: umoci.coverdir
    steps:
      - uses: actions/checkout@v6
      - name: set up docker buildx
        uses: docker/setup-buildx-action@v3
      - name: fetch cached ci image
        id: fetch-ci-image
        uses: actions/cache@v5
        with:
          path: ${{ github.workspace }}/.ci-cache/
          key: ${{ github.workflow }}-image-${{ hashFiles('Dockerfile') }}-${{ github.sha }}-${{ github.run_id }}
          restore-keys: |
            ${{ github.workflow }}-image-${{ hashFiles('Dockerfile') }}-${{ github.sha }}-
            ${{ github.workflow }}-image-${{ hashFiles('Dockerfile') }}-
            ${{ github.workflow }}-image-
      - name: load ci image
        run: make ci-cache
      - run: make test-unit
      - run: go tool covdata textfmt -i "$GOCOVERDIR" -o "$COVERAGE"
      - name: codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: opencontainers/umoci
          files: ${{ env.COVERAGE }}
      - name: upload coverage
        uses: actions/upload-artifact@v6
        with:
          name: coverage-${{ runner.os }}-${{ github.job }}-${{ strategy.job-index }}
          path: ${{ env.GOCOVERDIR }}

  integration:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image:
          - registry.opensuse.org/opensuse/leap:latest
          - almalinux:latest
          - debian:latest
          - ubuntu:latest
          - fedora:latest
        test:
          - root
          - rootless
    env:
      TEST_DOCKER_IMAGE: ${{ matrix.image }}
      COVERAGE: umoci.coverage
      GOCOVERDIR: umoci.coverdir
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - name: set up docker buildx
        uses: docker/setup-buildx-action@v3
      - name: fetch cached ci image
        id: fetch-ci-image
        uses: actions/cache@v5
        with:
          path: ${{ github.workspace }}/.ci-cache/
          key: ${{ github.workflow }}-image-${{ hashFiles('Dockerfile') }}-${{ github.sha }}-${{ github.run_id }}
          restore-keys: |
            ${{ github.workflow }}-image-${{ hashFiles('Dockerfile') }}-${{ github.sha }}-
            ${{ github.workflow }}-image-${{ hashFiles('Dockerfile') }}-
            ${{ github.workflow }}-image-
      - name: load ci image
        run: make ci-cache
      - run: make TEST_DOCKER_IMAGE=$TEST_DOCKER_IMAGE test-${{ matrix.test }}-integration
      - run: go tool covdata textfmt -i "$GOCOVERDIR" -o "$COVERAGE"
      - name: codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: opencontainers/umoci
          files: ${{ env.COVERAGE }}
      - name: upload coverage
        uses: actions/upload-artifact@v6
        with:
          name: coverage-${{ runner.os }}-${{ github.job }}-${{ strategy.job-index }}
          path: ${{ env.GOCOVERDIR }}

  coverage:
    runs-on: ubuntu-latest
    needs:
      - macos
      - unit
      - integration
    env:
      GOCOVERDIR: umoci.coverage
    steps:
      - uses: actions/checkout@v6
      - name: download all coverage
        uses: actions/download-artifact@v7
        with:
          path: coverage
      - name: compute coverage
        run: |
          ./hack/ci-coverage.sh --merge="$GOCOVERDIR" --func coverage/*/
      - name: upload final coverage
        uses: actions/upload-artifact@v6
        with:
          name: coverage
          path: ${{ env.GOCOVERDIR }}

  complete:
    runs-on: ubuntu-latest
    needs:
      - release
      - validate
      - macos
      - unit
      - integration
      - coverage
    steps:
      - run: echo "all done"