build.yml

name: Build and test application
on:
  push:
    branches:
      - main
      - next
    tags: [v*]
  pull_request:
    paths:
      - ".env.dist"
      - "bin/**"
      - "deploy/**"
      - "docker-compose*.yml"
      - "kustomization.yaml"
      - "Makefile"
      - "target/**"
      - "test/**"
concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true
env:
  ADDITIONAL_DOCKER_IMAGES: "mysql:lts axllent/mailpit:v1.27 redis:8-alpine"
jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        include:
          - context: target/mda
            image: mailserver-mda
          - context: target/mta
            image: mailserver-mta
          - context: target/filter
            image: mailserver-filter
          - context: target/web
            image: mailserver-web
          - context: target/ssl
            image: mailserver-ssl
          - context: target/unbound
            image: mailserver-unbound
          - context: test/bats
            image: mailserver-test
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
      - name: Set up QEMU
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Log in to Container Registry (ghcr.io)
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Log in to Container Registry (docker.io)
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
        with:
          username: ${{ vars.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Cache Docker layers
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ${{ runner.temp }}/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ matrix.image }}-${{ github.ref }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-${{ matrix.image }}-${{ github.ref }}-
            ${{ runner.os }}-buildx-${{ matrix.image }}-
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
        with:
          images: |
            ghcr.io/jeboehm/${{ matrix.image }}
            jeboehm/${{ matrix.image }}
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha
      - name: Build and push Docker image
        if: ${{ github.event_name != 'pull_request' }}
        id: build-and-push
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: ${{ matrix.context }}
          platforms: linux/amd64,linux/arm64
          push: ${{ matrix.image != 'mailserver-test' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=local,src=${{ runner.temp }}/.buildx-cache
          cache-to: type=local,dest=${{ runner.temp }}/.buildx-cache-new,mode=max
      - name: Build Docker image
        if: ${{ github.event_name == 'pull_request' }}
        id: build-and-save
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: ${{ matrix.context }}
          push: false
          tags: jeboehm/${{ matrix.image }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=local,src=${{ runner.temp }}/.buildx-cache
          cache-to: type=local,dest=${{ runner.temp }}/.buildx-cache-new,mode=max
          outputs: type=docker,dest=${{ runner.temp }}/${{ matrix.image }}.tar
      - # Temp fix
        # https://github.com/docker/build-push-action/issues/252
        # https://github.com/moby/buildkit/issues/1896
        name: Move cache
        run: |
          rm -rf ${{ runner.temp }}/.buildx-cache
          mv ${{ runner.temp }}/.buildx-cache-new ${{ runner.temp }}/.buildx-cache
      - name: Generate artifact attestation (ghcr.io)
        if: ${{ github.event_name != 'pull_request' && matrix.image != 'mailserver-test' }}
        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
        with:
          subject-name: ghcr.io/jeboehm/${{ matrix.image }}
          subject-digest: ${{ steps.build-and-push.outputs.digest }}
          push-to-registry: true
      - name: Generate artifact attestation (docker.io)
        if: ${{ github.event_name != 'pull_request' && matrix.image != 'mailserver-test' }}
        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
        with:
          subject-name: index.docker.io/jeboehm/${{ matrix.image }}
          subject-digest: ${{ steps.build-and-push.outputs.digest }}
          push-to-registry: true
      - name: Upload Docker image to artifacts
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: docker-image-${{ matrix.image }}
          path: ${{ runner.temp }}/${{ matrix.image }}.tar
          retention-days: 1
  test_docker_matrix:
    needs: build
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        TEST_CASE:
          - default
          - relayhost
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
      - name: Download Docker image artifacts
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
        with:
          path: images
          pattern: docker-image-*
          merge-multiple: true
      - name: Docker load downloaded image artifacts
        run: |
          for image in $(ls images/); do
            docker load --input images/${image}
          done
      - name: Cache Docker images
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        id: docker-images-cache
        with:
          path: /tmp/docker-images
          key: docker-images-additional
      - name: Load or pull Docker images
        run: |
          mkdir -p /tmp/docker-images
          read -a IMAGES <<< "${{ env.ADDITIONAL_DOCKER_IMAGES }}"
          for IMAGE in "${IMAGES[@]}"; do
            # Convert image name to filename-safe format
            FILENAME=$(echo "$IMAGE" | tr '/:' '-').tar
            CACHE_PATH="/tmp/docker-images/$FILENAME"
            if [ -f "$CACHE_PATH" ]; then
              echo "Loading $IMAGE from cache"
              docker load --input "$CACHE_PATH"
            else
              echo "Pulling $IMAGE from registry"
              docker pull "$IMAGE"
              echo "Saving $IMAGE for caching"
              docker save "$IMAGE" -o "$CACHE_PATH"
            fi
          done
      - name: Prepare environment
        run: |
          make .env
          cat .env .github/test-matrix/${{ matrix.TEST_CASE }}.env > .env.tmp
          awk -F= '{seen[$1]=$0} END {for (key in seen) print seen[key]}' .env.tmp > .env
          rm .env.tmp
      - name: Output environment
        run: cat .env
      - name: Start components
        run: make up
      - name: Load database fixtures
        run: make fixtures
      - name: Run tests
        run: bin/test.sh run --rm test
      - name: Collect logs
        if: failure()
        run: |
          make logs
          docker ps -a
  test_kubernetes_matrix:
    needs: build
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    env:
      CLUSTER_NAME: kind
      POPEYE_VERSION: v0.22.1
    strategy:
      matrix:
        TEST_CASE:
          - default
          - relayhost
          - proxy
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
      - name: Setup Kind
        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1
        with:
          cluster_name: ${{ env.CLUSTER_NAME }}
      - name: Install Popeye
        run: |
          curl -LO https://github.com/derailed/popeye/releases/download/${{ env.POPEYE_VERSION }}/popeye_linux_amd64.deb
          sudo dpkg -i popeye_linux_amd64.deb
      - name: Use kubectl context
        run: |
          kind get clusters
          kubectl config use-context kind-${{ env.CLUSTER_NAME }}
      - name: Restore cached Docker images
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        id: docker-images-cache
        with:
          path: /tmp/docker-images
          key: docker-images-additional
      - name: Load cached Docker images
        if: steps.docker-images-cache.outputs.cache-hit == 'true'
        run: |
          read -a IMAGES <<< "${{ env.ADDITIONAL_DOCKER_IMAGES }}"
          for IMAGE in "${IMAGES[@]}"; do
            FILENAME=$(echo "$IMAGE" | tr '/:' '-').tar
            CACHE_PATH="/tmp/docker-images/$FILENAME"
            if [ -f "$CACHE_PATH" ]; then
              echo "Loading $IMAGE from cache into kind cluster"
              kind load image-archive "$CACHE_PATH"
            fi
          done
      - name: Download docker image artifacts
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
        with:
          path: images
          pattern: docker-image-*
          merge-multiple: true
      - name: Load downloaded docker images
        run: |
          for image in $(ls images/); do
            kind load image-archive images/${image}
          done
      - name: Prepare environment
        run: |
          make .env
          cat .env .github/test-matrix/${{ matrix.TEST_CASE }}.env > .env.tmp
          awk -F= '{seen[$1]=$0} END {for (key in seen) print seen[key]}' .env.tmp > .env
          rm .env.tmp
      - name: Prepare tls certs
        run: make kubernetes-tls
      - name: Deploy Kubernetes resources
        run: make kubernetes-deploy-helper kubernetes-up
      - name: Wait for all pods to be ready
        run: make kubernetes-wait
      - name: Run tests
        run: make kubernetes-test
      - name: Run Popeye
        run: make popeye-score
      - name: Get pod status on failure
        if: failure()
        run: |
          make kubernetes-logs
          kubectl get pods -o wide