ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: write
  pull-requests: write
  packages: write

jobs:
  dagger-ci:
    runs-on: [monorepo-runner-set]
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - uses: 1password/load-secrets-action/configure@v2
        with:
          connect-host: http://onepassword-connect.1password.svc.cluster.local:8080
          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}

      - uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          NPM_TOKEN: op://bic45kuflnwsnxnd67dzcnxjze/5p65mbzr237yyzt2sfnfao3a5a/NPM_TOKEN
          GH_TOKEN: op://bic45kuflnwsnxnd67dzcnxjze/5p65mbzr237yyzt2sfnfao3a5a/GH_TOKEN
          S3_ACCESS_KEY_ID: op://bic45kuflnwsnxnd67dzcnxjze/5p65mbzr237yyzt2sfnfao3a5a/S3_ACCESS_KEY_ID
          S3_SECRET_ACCESS_KEY: op://bic45kuflnwsnxnd67dzcnxjze/5p65mbzr237yyzt2sfnfao3a5a/S3_SECRET_ACCESS_KEY

      - name: Extract kubectl version
        id: kubectl-version
        run: |
          KUBECTL_VERSION=v1.34.1
          echo "version=$KUBECTL_VERSION" >> "$GITHUB_OUTPUT"

      - name: Cache kubectl
        uses: actions/cache@v4
        id: kubectl-cache
        with:
          path: ~/.local/bin/kubectl
          key: kubectl-${{ steps.kubectl-version.outputs.version }}-linux-amd64

      - name: Install kubectl
        if: steps.kubectl-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/.local/bin
          curl -LO "https://dl.k8s.io/release/${{ steps.kubectl-version.outputs.version }}/bin/linux/amd64/kubectl"
          chmod +x kubectl
          mv kubectl ~/.local/bin/

      - name: Add kubectl to PATH
        run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Extract Dagger version
        id: dagger-version
        run: |
          DAGGER_IMAGE=$(kubectl get pod --selector=name=dagger-dagger-helm-engine --namespace=dagger -o jsonpath='{.items[0].spec.containers[0].image}')
          DAGGER_VERSION="${DAGGER_IMAGE##*:v}"
          echo "version=$DAGGER_VERSION" >> "$GITHUB_OUTPUT"

      - name: Cache Dagger CLI
        uses: actions/cache@v4
        id: dagger-cache
        with:
          path: ~/.local/bin/dagger
          key: dagger-${{ steps.dagger-version.outputs.version }}-linux-amd64

      - name: Install Dagger CLI
        if: steps.dagger-cache.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          DAGGER_VERSION="${{ steps.dagger-version.outputs.version }}"
          BIN_DIR="$HOME/.local/bin"

          # Try primary source first
          if ! curl -fsSL https://dl.dagger.io/dagger/install.sh | DAGGER_VERSION="$DAGGER_VERSION" BIN_DIR="$BIN_DIR" sh; then
            echo "WARNING: Primary source (dl.dagger.io) failed, trying GitHub releases..."

            # Fallback to GitHub releases
            mkdir -p "$BIN_DIR"
            DAGGER_URL="https://github.com/dagger/dagger/releases/download/v${DAGGER_VERSION}/dagger_v${DAGGER_VERSION}_linux_amd64.tar.gz"

            echo "Downloading from: $DAGGER_URL"
            curl -fsSL "$DAGGER_URL" | tar xz -C /tmp
            mv /tmp/dagger "$BIN_DIR/dagger"
            chmod +x "$BIN_DIR/dagger"
          fi

          # Verify installation
          if [ ! -f "$BIN_DIR/dagger" ]; then
            echo "ERROR: Dagger CLI installation failed"
            exit 1
          fi

          "$BIN_DIR/dagger" version

      - name: Get Dagger Engine Pod Name
        run: |
          DAGGER_ENGINE_POD_NAME="$(kubectl get pod --selector=name=dagger-dagger-helm-engine --namespace=dagger --output=jsonpath='{.items[0].metadata.name}')"
          echo "_EXPERIMENTAL_DAGGER_RUNNER_HOST=kube-pod://$DAGGER_ENGINE_POD_NAME?namespace=dagger" >> "$GITHUB_ENV"

      - name: Install Dagger module dependencies
        working-directory: .dagger
        run: bun install --frozen-lockfile

      - name: Run Dagger CI pipeline
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ARGS=(
            --source=.
            --branch="${{ github.ref_name }}"
            --github-token=env:GH_TOKEN
            --npm-token=env:NPM_TOKEN
            --s3-access-key-id=env:S3_ACCESS_KEY_ID
            --s3-secret-access-key=env:S3_SECRET_ACCESS_KEY
          )

          if [[ "${{ github.ref_name }}" == "main" ]]; then
            ARGS+=(
              --version="1.0.${{ github.run_number }}"
              --git-sha="${{ github.sha }}"
              --registry-username="${{ github.actor }}"
              --registry-password=env:GITHUB_TOKEN
            )
          fi

          dagger call ci "${ARGS[@]}"