ci.yml

name: ci

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    branches:
      - main
      - release/**
    paths-ignore:
      - 'website/**'
      - 'docs/**'
      - '*.md'
      - 'CODEOWNERS'
      - 'LICENSE'
      - '.github/copilot-instructions.md'
      - '.github/workflows/retag.yml'
      - '.github/workflows/retag/**'
      - 'cmd/retagger/**'
      - 'cmd/worker-image-matrix/**'
      - '.github/workflows/worker-images/**'
      - '.github/workflows/worker-images.yml'
      - '.github/workflows/dependabot.yml'
      - '.github/workflows/release.yml'
      - '.github/workflows/deploy-docs.yml'

  push:
    branches:
      - main
      - release/**
    paths-ignore:
      - 'website/**'
      - 'docs/**'
      - '*.md'
      - 'CODEOWNERS'
      - 'LICENSE'
      - '.github/copilot-instructions.md'
      - '.github/workflows/retag.yml'
      - '.github/workflows/retag/**'
      - 'cmd/retagger/**'
      - 'cmd/worker-image-matrix/**'
      - '.github/workflows/worker-images/**'
      - '.github/workflows/worker-images.yml'

permissions:
  contents: read
  packages: read

jobs:
  lint:
    runs-on: ubuntu-22.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
        with:
          egress-policy: audit

      - name: checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: '1.24'
          cache: false
      # Use the golang-ci lint action which automattically sets up GHA caching and other things
      # Note: There is also a "lint" target in docker-bake.hcl for local linting
      # If you make changes to this, please make sure to also update the local linting target
      - name: golangci-lint
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        with:
          version: v2.1.6
          args: --timeout=30m
      - name: custom linters
        run: go run ./cmd/lint ./...
      - name: validate generated files
        run: |
          go generate ./... || exit $?
          if ! git diff --exit-code; then
            echo "::error::Missing updates to generated files. Please run 'go generate ./...' and commit the changes"
            exit 1
          fi

  integration:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        suite:
          - Mariner2
          - Azlinux3
          - Bookworm
          - Bullseye
          - Bionic
          - Focal
          - Jammy
          - Noble
          - Windows
          - Almalinux8
          - Almalinux9
          - Rockylinux8
          - Rockylinux9
          - Trixie
          - other
        include:
          - suite: other
            skip: Mariner2|Azlinux3|Bookworm|Bullseye|Bionic|Focal|Jammy|Noble|Windows|Almalinux8|Almalinux9|Rockylinux8|Rockylinux9|Trixie

    # TODO: support diff/merge
    # Right now this is handled by the e2e suite, but we can migrate that here.
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
        with:
          egress-policy: audit

      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: '1.24'
          cache: false

      - name: Cleanup runner
        run: docker system prune -f --volumes --all

      - name: checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - uses: ./.github/actions/enable-containerd

      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        name: Login to GHCR
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup tracing
        id: setup-tracing
        uses: ./.github/actions/setup-tracing
      - name: download deps
        run: go mod download
      - name: Setup QEMU
        run: docker run --rm --privileged tonistiigi/binfmt:latest --install all
      - name: Setup source policy
        uses: ./.github/actions/setup-source-policy
      - name: Get docker info
        run: |
          docker info
          docker version
          docker buildx version
          containerd --version
      - name: Run integration tests
        run: |
          set -ex
          if [ -n "${TEST_SUITE}" ] && [ ! "${TEST_SUITE}" = "other" ]; then
            run="-run=${TEST_SUITE}"
          fi
          if [ -n "${TEST_SKIP}" ]; then
            skip="-skip=${TEST_SKIP}"
          fi
          go test -timeout=59m -v -json ${run} ${skip} ./test | go run ./cmd/test2json2gha --slow 120s --logdir /tmp/testlogs
        env:
          TEST_SUITE: ${{ matrix.suite }}
          TEST_SKIP: ${{ matrix.skip }}
      - name: Finalize traces
        if: always()
        uses: ./.github/actions/teardown-tracing
        with:
          artifact-name: integration-test-traces-${{matrix.suite}}
          tracing-id: ${{ steps.setup-tracing.outputs.tracing-id }}
          traces-path: ${{ steps.setup-tracing.outputs.traces-path }}
      - name: Upload reports
        if: always()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: integration-test-logs-${{matrix.suite}}
          path: /tmp/testlogs/*
          retention-days: 1
      - name: dump logs
        if: failure()
        id: dump-logs
        run: |
          set -e

          dir="$(mktemp -d)"
          f="${dir}/dockerd.log"
          echo "DOCKERD_LOG_PATH=${f}" >> $GITHUB_OUTPUT
          sudo journalctl -u docker > "${f}"
      - name: Upload buildkit logs
        if: failure()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: e2e-dockerd-logs-${{ matrix.suite }}
          path: ${{ steps.dump-logs.outputs.DOCKERD_LOG_PATH }}
          retention-days: 1

  unit:
    runs-on: ubuntu-22.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
        with:
          egress-policy: audit

      - name: checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: '1.24'
          cache: false
      - name: download deps
        run: go mod download
      - name: Run unit tests
        run: go test -v --test.short --json ./... | go run ./cmd/test2json2gha

  e2e:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        disable_diff_merge: ["1", "0"]
    name: "Test E2E (disable diff/merge: ${{ matrix.disable_diff_merge }})"
    env:
      DALEC_DISABLE_DIFF_MERGE: ${{ matrix.disable_diff_merge }}
      FRONTEND_REF: localhost:5000/dalec/frontend
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
        with:
          egress-policy: audit

      - name: checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          # We need to fetch all commits so that we can diff against the base branch
          fetch-depth: 0

      - name: Expose GitHub tokens for caching
        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124 # v3.1.0
      - name: Setup source policy
        uses: ./.github/actions/setup-source-policy
      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        name: Login to GHCR
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: ./.github/actions/format-repo
        id: format-repo
      - name: Setup builder
        run: |
          # Sometimes the builder runs out of space... so cleanup anything we can first.
          docker image prune -a -f

          docker run -d --net=host ghcr.io/${{ steps.format-repo.outputs.result }}/mirror/dockerhub/library/registry:latest

          # If diff/merge are enabled we need to use a buildx builder to make sure the feature is supported.
          # Otherwise we can just use the default docker builder.
          if [ "${DALEC_DISABLE_DIFF_MERGE}" = "0" ]; then
            docker buildx create --use --driver-opt network=host
            echo FRONTEND_BAKE_TARGET="frontend-ci-full" >> $GITHUB_ENV
            echo USE_BUILDX=1 >> $GITHUB_ENV
          else
            echo DALEC_NO_CACHE_EXPORT="1" >> $GITHUB_ENV
            echo FRONTEND_BAKE_TARGET="frontend-ci" >> $GITHUB_ENV
          fi
      - name: Build frontend image
        run: docker buildx bake ${FRONTEND_BAKE_TARGET}
      - name: test
        run: |
          docker buildx bake test
      - name: Build go-md2man example in docs
        run: |
          version=$(cat docs/examples/go-md2man.yml | yq .version)
          docker build -t go-md2man:$version -f docs/examples/go-md2man.yml --target=mariner2/rpm --output=_output .
          docker build -t go-md2man:$version -f docs/examples/go-md2man.yml --target=mariner2 .
      - name: dump logs
        if: failure()
        id: dump-logs
        run: |
          set -e

          dir="$(mktemp -d)"
          f="${dir}/dockerd.log"
          echo "DOCKERD_LOG_PATH=${f}" >> $GITHUB_OUTPUT
          if [ "${USE_BUILDX}" = "1" ]; then
            docker logs $(docker ps -lq) > "${f}"
          else
            sudo journalctl -u docker > "${f}"
          fi
      - name: Upload buildkit logs
        if: failure()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: e2e-dockerd-logs-diffmerge=${{ matrix.disable_diff_merge }}
          path: ${{ steps.dump-logs.outputs.DOCKERD_LOG_PATH }}
          retention-days: 1