ci.yaml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  GOPRIVATE: github.com/weaveworks/cluster-controller

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read # for actions/checkout to fetch code
    steps:
      - name: Configure git for private modules
        env:
          GITHUB_BUILD_USERNAME: ${{ secrets.BUILD_BOT_USER }}
          GITHUB_BUILD_TOKEN: ${{ secrets.BUILD_BOT_PERSONAL_ACCESS_TOKEN }}
        run: git config --global url."https://${GITHUB_BUILD_USERNAME}:${GITHUB_BUILD_TOKEN}@github.com".insteadOf "https://github.com"

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup
        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: 1.23.x
          cache: true

      - name: Test
        run: make test

      - name: e2e Tests
        run: make e2e-tests

  build-docs:
    runs-on: ubuntu-latest
    permissions:
      contents: read # for actions/checkout to fetch code
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0 # for git describe
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Build docs
        run: |
          make api-docs
          if [[ -n $(git status --porcelain) ]]; then
            echo ""
            echo "Docs are out of date!"
            echo "The following files have changed:"
            git status --porcelain
            echo "Please run 'make api-docs' and commit the changes."
            echo "If it was something unrelated to the docs, that is strange... scope down this check or commit those files too?"
            exit 1
          fi

  build:
    runs-on: ubuntu-latest
    needs: [test]
    permissions:
      contents: read # for actions/checkout to fetch code
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0 # for git describe
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Get version
        id: get_version
        run: echo "VERSION=$(make version)" >> $GITHUB_OUTPUT

      - name: Configure git for private modules
        env:
          GITHUB_BUILD_USERNAME: ${{ secrets.BUILD_BOT_USER }}
          GITHUB_BUILD_TOKEN: ${{ secrets.BUILD_BOT_PERSONAL_ACCESS_TOKEN }}
        run: git config --global url."https://${GITHUB_BUILD_USERNAME}:${GITHUB_BUILD_TOKEN}@github.com".insteadOf "https://github.com"

      - name: Build Docker image (test only)
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          push: false
          tags: gitopssets-controller:test
          build-args: VERSION=${{ steps.get_version.outputs.VERSION }}

  release-please:
    runs-on: ubuntu-latest
    needs: [build]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
      pull-requests: write
      issues: write
      repository-projects: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - name: Run release-please
        id: release
        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
        with:
          release-type: go

  release:
    runs-on: ubuntu-latest
    needs: [release-please]
    # only run when release-please creates a release
    if: needs.release-please.outputs.release_created == 'true'
    permissions:
      contents: write # for creating releases
      packages: write # for pushing to ghcr.io
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0 # for git describe

      - name: Setup Go
        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: 1.23.x
          cache: true

      - name: Get version
        id: get_version
        run: echo "VERSION=${{ needs.release-please.outputs.tag_name }}" >> $GITHUB_OUTPUT

      - name: Install Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
        with:
          version: '3.14.2'

      - name: Login to GitHub Container Registry
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure git for private modules
        env:
          GITHUB_BUILD_USERNAME: ${{ secrets.BUILD_BOT_USER }}
          GITHUB_BUILD_TOKEN: ${{ secrets.BUILD_BOT_PERSONAL_ACCESS_TOKEN }}
        run: git config --global url."https://${GITHUB_BUILD_USERNAME}:${GITHUB_BUILD_TOKEN}@github.com".insteadOf "https://github.com"

      - name: Build and push release Docker image
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          push: true
          tags: |
            ghcr.io/weaveworks/gitopssets-controller:${{ steps.get_version.outputs.VERSION }}
            ghcr.io/weaveworks/gitopssets-controller:latest
          labels: |
            org.opencontainers.image.title=GitOpsSet Controller
            org.opencontainers.image.description=A controller for managing GitOpsSet resources
            org.opencontainers.image.source=https://github.com/weaveworks/gitopssets-controller
            org.opencontainers.image.url=https://github.com/weaveworks/gitopssets-controller
            org.opencontainers.image.documentation=https://github.com/weaveworks/gitopssets-controller
            org.opencontainers.image.version=${{ steps.get_version.outputs.VERSION }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.licenses=Apache-2.0
          build-args: VERSION=${{ steps.get_version.outputs.VERSION }}

      - name: Build and publish Helm chart
        run: |
          make publish-helm-chart
        env:
          VERSION: ${{ steps.get_version.outputs.VERSION }}
          IMG: ghcr.io/weaveworks/gitopssets-controller:${{ steps.get_version.outputs.VERSION }}
          CHART_REGISTRY: ghcr.io/weaveworks/charts

      - name: Generate release manifests
        run: |
          make release
        env:
          VERSION: ${{ steps.get_version.outputs.VERSION }}
          IMG: ghcr.io/weaveworks/gitopssets-controller:${{ steps.get_version.outputs.VERSION }}

      - name: Upload release artifacts
        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
        with:
          tag_name: ${{ needs.release-please.outputs.tag_name }}
          files: |
            release.yaml