main.yml

name: main
on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: denoland/setup-deno@v2
      with:
        deno-version: 2.7.1
        cache: true
    - uses: pnpm/action-setup@v4
      with:
        package_json_file: web-next/package.json
    - name: Run codegen
      run: npx @dotenvx/dotenvx run -f .env.ci -- deno task -r codegen
    - name: Build web-next
      run: deno task build
      working-directory: web-next
    - name: Run tests
      if: always()
      run: npx @dotenvx/dotenvx run -f .env.ci -- deno task test
    - name: Run checks
      if: always()
      run: deno task check
    - name: Check for untranslated messages
      if: always()
      run: |
        cd web-next/src/locales
        has_untranslated=false
        for file in */messages.po; do
          echo "Checking $file..."
          while IFS= read -r line; do
            if [ -n "$line" ]; then
              line_num=$(echo "$line" | cut -d: -f1)
              msgid=$(echo "$line" | cut -d: -f2-)
              echo "::error file=web-next/src/locales/$file,line=$line_num::Untranslated message: $msgid"
              has_untranslated=true
            fi
          done < <(awk '/^msgid/ && !/^msgid ""$/ { msgid = $0; getline; while (/^"/) getline; if (/^msgstr ""$/) print NR ": " msgid }' "$file")

          if [ "$has_untranslated" = false ]; then
            echo "✅ All messages translated in $file"
          fi
        done
        if [ "$has_untranslated" = true ]; then
          echo "::error::Found untranslated messages in .po files. Please translate all messages before merging."
          exit 1
        fi
    - name: Extract web-next translations
      if: always()
      run: cd web-next && deno task extract
    - name: Check for uncommitted changes
      if: always()
      run: |
        if ! git diff --exit-code --quiet; then
          echo "::error::Generated files have uncommitted changes. Please run the generators locally and commit the changes."

          # Get list of changed files and create annotations
          git diff --name-only | while read -r file; do
            echo "::error file=$file::Generated file has uncommitted changes - please run generators locally and commit"

            # Show which lines were changed
            git diff --unified=0 "$file" | grep '^@@' | while read -r hunk; do
              # Extract line numbers from hunk header like @@ -1,3 +1,4 @@
              line_info=$(echo "$hunk" | sed 's/.*+\([0-9]*\).*/\1/')
              if [ -n "$line_info" ]; then
                echo "::error file=$file,line=$line_info::Generated content differs from committed version"
              fi
            done
          done

          exit 1
        fi

  image:
    needs: [test]
    permissions:
      contents: read
      packages: write
      attestations: write
    strategy:
      matrix:
        os:
        - ubuntu-latest
        - ubuntu-24.04-arm
    runs-on: ${{ matrix.os }}
    steps:
    - uses: docker/setup-buildx-action@v3
    - uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ github.token }}
    - id: arch
      run: |
        set -ex
        if [[ "$RUNNER_ARCH" = "ARM64" ]]; then
          echo arch=arm64 >> "$GITHUB_OUTPUT"
        else
          echo arch=amd64 >> "$GITHUB_OUTPUT"
        fi
    - if: github.event_name == 'push'
      uses: docker/build-push-action@v6
      with:
        pull: "true"
        push: "true"
        no-cache: "false"
        build-args:
          GIT_COMMIT=${{ github.sha }}
        tags: ghcr.io/${{ github.repository }}:git-${{ github.sha }}-${{ steps.arch.outputs.arch }}
        labels: |
          org.opencontainers.image.revision=${{ github.sha }}
        annotations: |
          org.opencontainers.image.title=Hackers' Pub
          org.opencontainers.image.description=ActivityPub-enabled social network for hackers
          org.opencontainers.image.url=https://hackers.pub/
          org.opencontainers.image.source=https://github.com/dahlia/hackerspub
          org.opencontainers.image.revision=${{ github.sha }}
          org.opencontainers.image.licenses=AGPL-3.0-only
        cache-from:
          type=registry,ref=ghcr.io/${{ github.repository }}:build-cache-${{ steps.arch.outputs.arch }}
        cache-to:
          type=registry,ref=ghcr.io/${{ github.repository }}:build-cache-${{ steps.arch.outputs.arch }},mode=max
        provenance: false
    - if: github.event_name == 'pull_request'
      uses: docker/build-push-action@v6
      with:
        pull: "true"
        push: "false"
        no-cache: "true"
        build-args:
          GIT_COMMIT=${{ github.sha }}
        tags: ghcr.io/${{ github.repository }}:git-${{ github.sha }}-${{ steps.arch.outputs.arch }}
        labels: |
          org.opencontainers.image.revision=${{ github.sha }}
        annotations: |
          org.opencontainers.image.title=Hackers' Pub
          org.opencontainers.image.description=ActivityPub-enabled social network for hackers
          org.opencontainers.image.url=https://hackers.pub/
          org.opencontainers.image.source=https://github.com/dahlia/hackerspub
          org.opencontainers.image.revision=${{ github.sha }}
          org.opencontainers.image.licenses=AGPL-3.0-only
        cache-from:
          type=registry,ref=ghcr.io/${{ github.repository }}:build-cache-${{ steps.arch.outputs.arch }}
        provenance: false

  manifest:
    if: github.event_name == 'push'
    needs: [image]
    permissions:
      contents: read
      packages: write
      attestations: write
    runs-on: ubuntu-latest
    steps:
    - uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ github.token }}
    - uses: Noelware/docker-manifest-action@0.4.2
      with:
        inputs: ghcr.io/${{ github.repository }}:git-${{ github.sha }},ghcr.io/${{ github.repository }}:latest
        images: ghcr.io/${{ github.repository }}:git-${{ github.sha }}-amd64,ghcr.io/${{ github.repository }}:git-${{ github.sha }}-arm64
        push: true