test-and-build.yml

name: Build and Release

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
    paths-ignore:
      - '**/README.md'
      - 'examples/**'
      - 'docs/**'
      - 'config/**'
      - 'deploy/**'
  pull_request:
    branches: [ main ]
    paths-ignore:
      - '**/README.md'
      - 'examples/**'
      - 'docs/**'
      - 'config/**'
      - 'deploy/**'

permissions:
  contents: write
  packages: write

env:
  GO_VERSION: '1.26'
  GOEXPERIMENT: 'jsonv2'
  MACOS_XCODE_VERSION: 'latest-stable'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  unit-tests:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Run unit tests
      run: |
        make gen-buf
        # Run all tests except functional and integration tests  
        go test -v -short $(go list ./... | grep -v '/test/functional' | grep -v '/test/integration')

  workflowcheck:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Install workflowcheck
      run: go install go.temporal.io/sdk/contrib/tools/workflowcheck@v0.4.0

    - name: Run workflowcheck
      run: |
        make gen-buf
        workflowcheck -test=false -config workflowcheck.yaml ./internal/... ./sdk/...

  functional-tests:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Run functional tests
      run: |
        make gen-buf
        # Run functional tests (these use testcontainers/Docker)
        # Docker is available by default on ubuntu-latest runners
        cd test && go test -v -timeout 10m ./functional/...

  integration-services:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Run services integration tests
      run: |
        make gen-buf
        cd test && go test -v -timeout 5m ./integration/services/...

  integration-workflows:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Run workflows integration tests
      run: |
        make gen-buf
        cd test && go test -v -timeout 15m ./integration/workflows/...

  build-linux-amd64:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Build linux/amd64 binary
      run: make build-linux-amd64

    - name: Upload linux/amd64 binary
      uses: actions/upload-artifact@v4
      with:
        name: thand-linux-amd64
        path: bin/thand-linux-amd64
        retention-days: 1

  macos-validation:
    runs-on: macos-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Select Xcode
      uses: maxim-lobanov/setup-xcode@v1
      with:
        xcode-version: ${{ env.MACOS_XCODE_VERSION }}

    - name: Capture Xcode version
      id: xcode
      run: |
        VERSION=$(xcodebuild -version | tr '\n' ' ' | sed 's/  */ /g')
        echo "version=$VERSION" >> $GITHUB_OUTPUT
        xcodebuild -version

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Install XcodeGen
      run: |
        brew list xcodegen >/dev/null 2>&1 || brew install xcodegen
        xcodegen version

    - name: Cache macOS DerivedData
      uses: actions/cache@v4
      with:
        path: .build/macos/DerivedData
        key: macos-deriveddata-${{ runner.os }}-${{ steps.xcode.outputs.version }}-${{ hashFiles('proto/localbroker/**/*.proto', 'buf*.yaml', 'platform/macos/PrivilegeServices/project.yml', 'platform/macos/PrivilegeServices/**/*.swift', 'platform/macos/PrivilegeServices/**/*.plist', 'platform/macos/PrivilegeServices/**/*.entitlements', 'platform/macos/PrivilegeServices/**/*.template', 'scripts/*macos-privilege-services*.sh', 'scripts/localbroker-codegen-common.sh', 'Makefile') }}
        restore-keys: |
          macos-deriveddata-${{ runner.os }}-${{ steps.xcode.outputs.version }}-

    - name: Build
      run: make build

    - name: Test
      run: make test

    - name: Verify unsigned package layout
      run: THAND_MACOS_SKIP_SIGNING=1 make package-macos-privilege-services-dev

  integration-frontend:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    needs: [build-linux-amd64]

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Download linux/amd64 binary
      uses: actions/download-artifact@v4
      with:
        name: thand-linux-amd64
        path: bin/

    - name: Make binary executable
      run: chmod +x bin/thand-linux-amd64

    - name: Install Chrome/Chromium
      run: |
        sudo apt-get update
        sudo apt-get install -y chromium-browser

    - name: Run frontend E2E integration tests
      run: |
        make gen-buf
        cd test && go test -v -timeout 30m ./integration/frontend/...
      env:
        DISPLAY: :99
        CHROME_BIN: /usr/bin/chromium-browser

  auto-tag:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    outputs:
      new-tag: ${{ steps.bump.outputs.new-version }}
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        token: ${{ secrets.GITHUB_TOKEN }}

    - name: Get latest tag
      id: latest-tag
      run: |
        LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
        echo "latest-tag=$LATEST_TAG" >> $GITHUB_OUTPUT

    - name: Bump version
      id: bump
      run: |
        LATEST_TAG=${{ steps.latest-tag.outputs.latest-tag }}
        
        # Remove 'v' prefix and split version
        VERSION=${LATEST_TAG#v}
        IFS='.' read -ra VERSION_PARTS <<< "$VERSION"
        
        MAJOR=${VERSION_PARTS[0]:-0}
        MINOR=${VERSION_PARTS[1]:-0}
        PATCH=${VERSION_PARTS[2]:-0}
        
        # Check commit messages for version bump indicators
        if git log --format=%B -n 1 | grep -qi "BREAKING CHANGE\|major:"; then
          NEW_VERSION="v$((MAJOR + 1)).0.0"
        elif git log --format=%B -n 1 | grep -qi "feat:\|feature:\|minor:"; then
          NEW_VERSION="v$MAJOR.$((MINOR + 1)).0"
        else
          NEW_VERSION="v$MAJOR.$MINOR.$((PATCH + 1))"
        fi
        
        echo "new-version=$NEW_VERSION" >> $GITHUB_OUTPUT
        echo "Bumping from $LATEST_TAG to $NEW_VERSION"

    - name: Create and push tag
      run: |
        NEW_VERSION=${{ steps.bump.outputs.new-version }}
        git config user.name "github-actions[bot]"
        git config user.email "github-actions[bot]@users.noreply.github.com"
        git tag -a $NEW_VERSION -m "Auto-release $NEW_VERSION"
        git push origin $NEW_VERSION

  build:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [auto-tag, unit-tests, functional-tests, integration-services, integration-workflows, integration-frontend]
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
          - goos: windows
            goarch: amd64
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        submodules: recursive

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Get version from auto-tag
      id: version
      run: |
        VERSION="${{ needs.auto-tag.outputs.new-tag }}"
        echo "version=$VERSION" >> $GITHUB_OUTPUT
        echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

    - name: Build for ${{ matrix.goos }}/${{ matrix.goarch }}
      run: |
        make gen-buf
        VERSION=${{ steps.version.outputs.version }}
        COMMIT=${{ steps.version.outputs.commit }}
        GOOS=${{ matrix.goos }}
        GOARCH=${{ matrix.goarch }}
        
        # Create dist directory
        mkdir -p dist
        
        # Set output name
        output_name="agent"
        if [ "$GOOS" = "windows" ]; then
          output_name="agent.exe"
        fi
        
        echo "Building for $GOOS/$GOARCH..."
        GOEXPERIMENT=jsonv2 CGO_ENABLED=0 GOOS=$GOOS GOARCH=$GOARCH go build -a -installsuffix cgo \
          -ldflags "-X github.com/thand-io/agent/internal/common.Version=$VERSION -X github.com/thand-io/agent/internal/common.GitCommit=$COMMIT" \
          -o "dist/$output_name" .
        
        # Create archive
        if [ "$GOOS" = "windows" ]; then
          cd dist && zip "agent-${GOOS}-${GOARCH}.zip" "$output_name" && cd ..
        else
          cd dist && tar -czf "agent-${GOOS}-${GOARCH}.tar.gz" "$output_name" && cd ..
        fi
        
        # Also keep the binary for direct download
        mv "dist/$output_name" "dist/agent-${GOOS}-${GOARCH}$([ "$GOOS" = "windows" ] && echo ".exe" || echo "")"

    - name: Upload build artifacts
      uses: actions/upload-artifact@v4
      with:
        name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}-${{ steps.version.outputs.version }}
        path: dist/

  docker-release:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [auto-tag, build]
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 1

    - name: Get version from auto-tag
      id: version
      run: |
        VERSION="${{ needs.auto-tag.outputs.new-tag }}"
        echo "version=$VERSION" >> $GITHUB_OUTPUT
        echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

    - name: Download build artifacts
      uses: actions/download-artifact@v4
      with:
        pattern: binaries-*-${{ steps.version.outputs.version }}
        path: dist/
        merge-multiple: true

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to Container Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata for release
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=raw,value=dev
          type=raw,value=${{ steps.version.outputs.version }}

    - name: Build and push Docker image (dev + version tags)
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ./Dockerfile.cicd
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        build-args: |
          VERSION=${{ steps.version.outputs.version }}
          COMMIT=${{ steps.version.outputs.commit }}
        cache-from: type=gha
        cache-to: type=gha,mode=max