ci.yaml

name: CI

on: [pull_request, push]

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: ${{ github.head_ref != '' }}

jobs:
  build:
    name: CI
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      id-token: write
      security-events: write

    strategy:
      matrix:
        platform:
          - "linux/amd64"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set variables
        id: set-variables
        run: |
          echo "DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_OUTPUT
          echo "GIT_HEAD_HASH=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
          echo "PLATFORM_NAME=${{ matrix.platform }}" | sed 's|/|-|g' >> $GITHUB_OUTPUT

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          buildkitd-config-inline: |
            [worker.oci]
              max-parallelism = 1

      - name: Build image
        uses: docker/build-push-action@v7
        with:
          build-args: |
            QBT_VERSION=devel
          cache-from: type=gha
          cache-to: type=gha,mode=max
          labels: |
            org.opencontainers.image.authors=https://github.com/qbittorrent/qBittorrent/graphs/contributors
            org.opencontainers.image.base.name=docker.io/alpine:latest
            org.opencontainers.image.description=An advanced BitTorrent client programmed in C++, based on Qt toolkit and libtorrent-rasterbar
            org.opencontainers.image.documentation=https://github.com/qbittorrent/docker-qbittorrent-nox#qbittorrent-nox-docker-image-
            org.opencontainers.image.created=${{ steps.set-variables.outputs.DATE }}
            org.opencontainers.image.licenses=GPL-3.0+
            org.opencontainers.image.ref.name=CI-devel
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=https://github.com/qbittorrent/docker-qbittorrent-nox
            org.opencontainers.image.title=qbittorrent-nox docker image
            org.opencontainers.image.url=https://github.com/qbittorrent/docker-qbittorrent-nox
            org.opencontainers.image.vendor=qBittorrent
            org.opencontainers.image.version=master
          load: true
          platforms: ${{ matrix.platform }}
          tags: |
            qbittorrent-nox_${{ steps.set-variables.outputs.PLATFORM_NAME }}:devel

      - name: Test run
        run: |
          docker run \
            --entrypoint "/usr/bin/qbittorrent-nox" \
            --platform ${{ matrix.platform }} \
            qbittorrent-nox_${{ steps.set-variables.outputs.PLATFORM_NAME }}:devel \
            --version

      # To run the image locally:
      # 1. `docker load < artifact`
      # 2. remove `build` field and replace `image` field with the imported image in docker-compose.yml
      # 3. `docker compose up`
      - name: Export image
        run: |
          docker save \
            --output qbittorrent-nox_devel-${{ steps.set-variables.outputs.GIT_HEAD_HASH }}_${{ steps.set-variables.outputs.PLATFORM_NAME }} \
            qbittorrent-nox_${{ steps.set-variables.outputs.PLATFORM_NAME }}:devel

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: qbittorrent-nox_devel-${{ steps.set-variables.outputs.GIT_HEAD_HASH }}_${{ steps.set-variables.outputs.PLATFORM_NAME }}
          path: qbittorrent-nox_devel-${{ steps.set-variables.outputs.GIT_HEAD_HASH }}_${{ steps.set-variables.outputs.PLATFORM_NAME }}

      - name: Generate build provenace attestations
        uses: actions/attest@v4
        with:
          subject-path: qbittorrent-nox_devel-${{ steps.set-variables.outputs.GIT_HEAD_HASH }}_${{ steps.set-variables.outputs.PLATFORM_NAME }}

      - name: Check GitHub Actions workflow
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pip install zizmor
          IGNORE_RULEID='(.ruleId != "zizmor/cache-poisoning")
            and (.ruleId != "zizmor/template-injection")
            and (.ruleId != "zizmor/unpinned-uses")'
          IGNORE_ID='(.id != "zizmor/cache-poisoning")
            and (.id != "zizmor/template-injection")
            and (.id != "zizmor/unpinned-uses")'
          zizmor \
            --format sarif \
            --persona auditor \
            ./ \
            | jq "(.runs[].results |= map(select($IGNORE_RULEID)))
              | (.runs[].tool.driver.rules |= map(select($IGNORE_ID)))" \
            > "${{ runner.temp }}/zizmor_results.sarif"

      - name: Upload zizmor results
        uses: github/codeql-action/upload-sarif@v4
        with:
          category: zizmor
          sarif_file: "${{ runner.temp }}/zizmor_results.sarif"