build.yml

name: build

on:
  push:
    branches:
      - main
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  LOG_LEVEL: debug

jobs:
  setup:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          show-progress: false

      - uses: ./setup
        with:
          checkout: false
          save-cache: true

      - name: validate cache key
        shell: bash
        run: |
          re="^node_modules-[0-9a-z]+$"
          if [[ ${CACHE_KEY} =~ $re ]]; then
            echo "Cache key ok: ${CACHE_KEY}"
          else
            echo "Cache key invalid: ${CACHE_KEY}"
            exit 1
          fi

  test:
    needs:
      - setup
    runs-on: ubuntu-latest

    # tests shouldn't need more than 15 min
    timeout-minutes: 15

    permissions:
      id-token: write

    steps:
      - name: Init platform
        id: init
        shell: bash
        run: |
          git config --global core.autocrlf false
          git config --global core.symlinks true

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 10 # required by codecov
          show-progress: false

      - uses: ./setup
        with:
          checkout: false

      - name: lint
        run: |
          pnpm eslint -f gha
          pnpm prettier

      - run: pnpm compile

      - run: pnpm test:vitest

      - name: Upload coverage
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: always()
        with:
          name: coverage
          path: coverage

      - name: Codecov test results && !cancelled()
        if: github.event_name != 'merge_group'
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          use_oidc: true
          report_type: test_results

      - name: Codecov coverage results
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          use_oidc: true

  e2e:
    needs:
      - setup
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          show-progress: false

      - uses: ./setup
        with:
          checkout: false

      - run: pnpm compile

      - name: remove node_modules
        run: rm -rf node_modules

      - name: docker-config
        uses: ./
        with:
          command: docker-config

      - name: Prepare e2e
        run: |
          docker pull alpine
          docker tag alpine renovate/ubuntu
          docker tag alpine renovate/ubuntu:18.04

      - name: docker-builder (node)
        uses: ./
        with:
          command: docker-builder
          image-prefix: containerbase/
          image: node
          config: e2e/node.json
          dry-run: true
          prune: true

      - name: docker-builder (yarn)
        uses: ./
        with:
          command: docker-builder
          config: e2e/yarn.json
          dry-run: true
          major-minor: false

      - name: docker-builder (python)
        uses: ./
        with:
          command: docker-builder
          config: e2e/python.json
          tag-suffix: 'slim'
          build-args: 'IMAGE=slim'
          dry-run: true

      - name: docker-builder (ubuntu)
        uses: ./
        with:
          command: docker-builder
          config: e2e/ubuntu.json
          dry-run: true

      - name: docker-builder (helm)
        uses: ./
        with:
          command: docker-builder
          config: e2e/helm.json
          dry-run: true
          token: ${{ github.token }}

      - name: docker-builder (java)
        uses: ./
        with:
          command: docker-builder
          config: e2e/java.json
          dry-run: true

      - name: binary-builder (python)
        uses: ./
        with:
          command: binary-builder
          config: e2e/python.json
          dry-run: true
          token: ${{ github.token }}
        env:
          DISTRO: focal
          ARCH: aarch64

      - name: dummy-command
        uses: ./
        with:
          command: dummy
          dry-run: true

  e2e-os:
    needs:
      - setup
    runs-on: ${{ matrix.os }}-latest
    timeout-minutes: 10

    strategy:
      matrix:
        os:
          - ubuntu
          - macos
          - windows

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          show-progress: false

      - name: Prepare OS
        if: runner.os == 'Windows'
        shell: bash
        run: |
          echo 'scriptShell: "C:\\Program Files\\git\\bin\\bash.exe"' >> pnpm-workspace.yaml

      - name: fetch node version
        id: node-version
        shell: bash
        run: |
          node_version=$(grep 'using: node' action.yml | awk -F': ' '{print $2}' | tr -d 'node')
          echo "node_version=${node_version}" >> $GITHUB_OUTPUT

      - uses: ./setup
        with:
          checkout: false
          save-cache: false
          read-cache: false
          node-version: ${{ steps.node-version.outputs.node_version }}

      - name: validate cache key
        shell: bash
        run: |
          os="${{ runner.os != 'Linux' && format('-{0}', runner.os) || '' }}"
          arch="${{ runner.arch != 'X64' && format('-{0}', runner.arch) || '' }}"
          re="^node_modules${os}${arch}-${{ steps.node-version.outputs.node_version }}-[0-9a-z]+$"
          if [[ ${CACHE_KEY} =~ $re ]]; then
            echo "Cache key ok: ${CACHE_KEY}"
          else
            echo "Cache key invalid: ${CACHE_KEY}"
            exit 1
          fi

  # Catch-all required check for test matrix and coverage
  test-success:
    needs:
      - setup
      - test
      - e2e
      - e2e-os
    runs-on: ubuntu-latest
    timeout-minutes: 1
    if: always()
    steps:
      - name: Fail for failed or cancelled setup
        if: |
          needs.setup.result == 'failure' ||
          needs.setup.result == 'cancelled'
        run: exit 1

      - name: Fail for failed or cancelled test
        if: |
          needs.test.result == 'failure' ||
          needs.test.result == 'cancelled'
        run: exit 1

      - name: Fail for failed or cancelled e2e
        if: |
          needs.e2e.result == 'failure' ||
          needs.e2e.result == 'cancelled'
        run: exit 1

      - name: Fail for failed or cancelled e2e-os
        if: |
          needs.e2e-os.result == 'failure' ||
          needs.e2e-os.result == 'cancelled'
        run: exit 1

  release:
    needs:
      - test-success

    runs-on: ubuntu-latest

    # tests shouldn't need more than 15 min
    timeout-minutes: 15

    permissions:
      contents: write
      issues: write
      id-token: write

    steps:
      - name: Init platform
        id: init
        shell: bash
        run: |
          # Use github action user for the commit
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          ref: 'release'
          show-progress: false

      - name: fetch pr
        if: ${{github.event_name == 'pull_request'}}
        run: |
          git fetch origin +${{ github.sha }}:${{ github.ref }}

      - name: Merge
        id: merge
        run: |
          git merge --no-ff -Xtheirs -m 'skip: merge (${{ github.sha }}) [skip release]' ${{ github.sha }}
          commit=$(git rev-parse HEAD)
          echo "commit=${commit}" >> $GITHUB_OUTPUT

      - uses: ./setup
        with:
          checkout: false

      - name: Push release branch
        run: git push origin release:release
        if: ${{github.ref == 'refs/heads/main'}}

      - name: Release
        run: |
          # override for semantic-release
          export GITHUB_REF=refs/heads/release GITHUB_SHA=${{ steps.merge.outputs.commit }}
          pnpm release
        if: ${{github.ref == 'refs/heads/main'}}
        env:
          GITHUB_TOKEN: ${{ github.token }}