continuous-integration.yml

# A comprehensive CI workflow that performs linting, builds Docker images,
# and runs tests against the built images using [testcontainers](https://testcontainers.com/).
#
# ### Jobs
#
# 1. **linter**: Runs code linting using the shared linter workflow
# 2. **build-images**: Builds Docker images (depends on linter)
# 3. **prepare-test-matrix**: Prepares the matrix for test jobs
# 4. **test-images**: Runs testcontainers tests for each built image

---
name: Continuous Integration

# jscpd:ignore-start
on:
  workflow_call:
    inputs:
      runs-on:
        description: |
          JSON array of runner(s) to use.
          See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
        type: string
        default: '["ubuntu-latest"]'
        required: false
      oci-registry:
        description: "OCI registry where to pull and push images."
        type: string
        default: "ghcr.io"
        required: false
      oci-registry-username:
        description: |
          Username used to log against the OCI registry.
          See https://github.com/docker/login-action#usage.
        type: string
        default: ${{ github.repository_owner }}
        required: false
      platforms:
        description: |
          JSON array of platforms to build images for.
          See https://docs.docker.com/buildx/working-with-buildx/#build-multi-platform-images.
        type: string
        default: '["linux/amd64","linux/arm64"]'
        required: false
      images:
        description: |
          JSON array of images to build.
          If not provided, all available images will be considered.
          Example: `["php-8", "nodejs-24"]`
        type: string
        required: false
    outputs:
      built-images:
        description: |
          Built images data.
          See https://github.com/hoverkraft-tech/ci-github-container/blob/main/.github/workflows/docker-build-images.md#outputs.
        value: ${{ jobs.build-images.outputs.built-images }}
    secrets:
      oci-registry-password:
        description: |
          Password or GitHub token (packages:read and packages:write scopes) used to log against the OCI registry.
          Defaults to GITHUB_TOKEN if not provided.
        required: false
# jscpd:ignore-end

permissions: {}

jobs:
  linter:
    uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@03a5a2a3626b03434b19b79cdd2e141bea410bae # 0.34.1
    permissions:
      actions: read
      contents: read
      security-events: write
      statuses: write

  build-images:
    uses: ./.github/workflows/docker-build-images.yml
    permissions:
      contents: read
      issues: read
      packages: write
      pull-requests: write
      id-token: write
    with:
      runs-on: ${{ inputs.runs-on }}
      oci-registry: ${{ inputs.oci-registry }}
      oci-registry-username: ${{ inputs.oci-registry-username }}
      platforms: ${{ inputs.platforms }}
      images: ${{ inputs.images }}
    secrets:
      oci-registry-password: ${{ secrets.oci-registry-password || secrets.GITHUB_TOKEN || github.token }}

  prepare-test-matrix:
    needs: build-images
    if: needs.build-images.outputs.built-images
    runs-on: ${{ fromJson(inputs.runs-on) }}
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.prepare-matrix.outputs.matrix }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - id: prepare-matrix
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          BUILT_IMAGES: ${{ needs.build-images.outputs.built-images }}
        with:
          script: |
            const builtImages = JSON.parse(process.env.BUILT_IMAGES || '{}');
            const imageNames = Object.keys(builtImages);

            const matrix = [];
            for (const imageName of imageNames) {
              const imageData = builtImages[imageName];

              // Get the first image reference
              const imageRef = imageData.images && imageData.images.length > 0
                ? imageData.images[0]
                : `${imageData.registry}/${imageData.repository}:${imageData.tags[0]}`;

              matrix.push({
                name: imageName,
                imageRef: imageRef
              });
            }

            if (matrix.length === 0) {
              core.info('No images with tests found');
              return;
            }

            core.setOutput('matrix', JSON.stringify(matrix));

  test-images:
    needs: [build-images, prepare-test-matrix]
    if: needs.prepare-test-matrix.outputs.matrix
    runs-on: ${{ fromJson(inputs.runs-on) }}
    permissions:
      contents: read
      packages: read
      issues: write
      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.prepare-test-matrix.outputs.matrix) }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ${{ inputs.oci-registry }}
          username: ${{ inputs.oci-registry-username }}
          password: ${{ secrets.oci-registry-password || github.token }}

      - run: docker pull ${{ matrix.imageRef }}

      - name: Build testcontainers test image
        run: docker build --tag testcontainers:latest ./images/testcontainers-node

      - name: Run testcontainers tests
        run: |
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v ${{ github.workspace }}/images/${{ matrix.name }}:/workspace \
            -e IMAGE_NAME=${{ matrix.imageRef }} \
            -e HOST_TESTS_DIR=${{ github.workspace }}/images/${{ matrix.name }}/tests \
            -w /workspace \
            testcontainers:latest \
            node --test --test-reporter=spec --test-reporter-destination=stdout

      - name: 📊 Parse coverage reports
        if: always()
        id: parse-coverage-reports
        uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@03a5a2a3626b03434b19b79cdd2e141bea410bae # 0.34.1
        with:
          report-name: "Test Results - ${{ matrix.name }}"
          report-paths: "auto:test,auto:coverage"
          output-format: "summary,markdown"

      - name: 📊 Add coverage PR comment
        if: always() && github.event_name == 'pull_request' && steps.parse-coverage-reports.outputs.markdown
        uses: hoverkraft-tech/ci-github-common/actions/create-or-update-comment@03a5a2a3626b03434b19b79cdd2e141bea410bae # 0.34.1
        with:
          title: "Code Coverage Report"
          body: ${{ steps.parse-coverage-reports.outputs.markdown }}