ci.yml

name: CI
on:
  push:
    branches:
      - main
    paths:
      - "geocode.go"
      - "geocode_test.go"
      - "go.mod"
      - "go.sum"
      - "Dockerfile"
      - "**/*.go"
      - ".github/workflows/ci.yml"
  pull_request:
    branches:
      - main
    paths:
      - "geocode.go"
      - "geocode_test.go"
      - "go.mod"
      - "go.sum"
      - "Dockerfile"
      - "**/*.go"
      - ".github/workflows/ci.yml"
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  OWNER: ${{ github.repository_owner }}
  REPO_NAME: ${{ github.event.repository.name }}

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        go: ["1.21", "1.22", "1.23", "1.24"]
    name: Go ${{ matrix.go }} version
    steps:
    - name: Check out repository code
      uses: actions/checkout@v6
    - name: Setup go
      uses: actions/setup-go@v6
      with:
        go-version: ${{ matrix.go }}
    - name: Codecov Test Run
      working-directory: .
      run: |
        go get
        go test -v -race -coverprofile=coverage.txt -covermode=atomic
    - name: Codecov Test Upload
      uses: codecov/codecov-action@v5

  build:
    runs-on: ubuntu-latest
    needs: [test]
    steps:
    - name: Check out repository code
      uses: actions/checkout@v6
    - name: Set Tag Name
      run: |
        echo "TAG=${{ github.head_ref || github.ref_name }}" >> $GITHUB_ENV
        echo "DATE=v$(echo `date +'%Y.%m'`)" >> $GITHUB_ENV
    - name: Login to DockerHub
      uses: docker/login-action@v3
      if: success()
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ env.OWNER }}
        password: ${{ github.token }}
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
      with:
        platforms: all
    - name: Set up Docker Buildx
      id: buildx
      if: success()
      uses: docker/setup-buildx-action@v3
      env:
        DOCKER_BUILDKIT: 1
    - name: Build and push Docker image - (MAIN)
      uses: docker/build-push-action@v6
      if: success()
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: .
        file: ./Dockerfile
        platforms: linux/amd64
        build-args: |
          BUILD_ID=${{ env.DATE }}
        pull: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}
    - name: Build and push Docker image - (DATE)
      uses: docker/build-push-action@v6
      if: ${{ contains(github.ref, 'main') }}
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: .
        file: ./Dockerfile
        platforms: linux/amd64
        build-args: |
          BUILD_ID=${{ env.DATE }}
        pull: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.DATE }}
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      if: success()
      with:
        image-ref: ghcr.io/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}
        format: 'template'
        template: '@/contrib/sarif.tpl'
        output: 'trivy-results.sarif'
    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v4
      if: success()
      with:
        sarif_file: 'trivy-results.sarif'

  k8s-test:
    runs-on: ubuntu-latest
    needs: [build]
    if: ${{ ! contains(github.ref, 'main') }}
    steps:
      - name: Create k8s Kind Cluster
        uses: helm/kind-action@v1.13.0
      - name: Checkout
        uses: actions/checkout@v6
      - name: Run K8s test
        run: |
          kubectl cluster-info
          export NS=`cat deployment/kustomization.yml  | grep namespace | awk '{ print $2 }'`
          if [ -z "$NS" ]; then
            export NS='data'
          fi
          kubectl create namespace $NS
          kubectl kustomize deployment/ | kubectl apply -f -
          kubectl get all -A

  auto-approve:
    runs-on: ubuntu-latest
    needs: [test, build, k8s-test]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Auto Approve PR
      uses: actions/github-script@v8
      with:
       script: |
        github.rest.pulls.createReview({
          owner: context.repo.owner,
          repo: context.repo.repo,
          pull_number: context.issue.number,
          event: "APPROVE"
        })

  auto-preview:
    runs-on: ubuntu-latest
    needs: [auto-approve]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Add Preview Label
      uses: actions/github-script@v8
      with:
        script: |
          github.rest.issues.addLabels({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            labels: ['preview']
          })

  # auto-merge:
  #   runs-on: ubuntu-latest
  #   needs: [auto-approve]
  #   if: ${{ github.event_name == 'pull_request' }}
  #   env:
  #     PR_NUMBER: ${{ github.event.number }}
  #   steps:
  #   - name: Check out repository code
  #     uses: actions/checkout@v6
  #   - name: Auto Merge PR
  #     uses: actions/github-script@v8
  #     with:
  #       github-token: ${{ github.token }}
  #       script: |
  #         await github.rest.pulls.merge({
  #           merge_method: 'squash',
  #           owner: context.repo.owner,
  #           pull_number: process.env.PR_NUMBER,
  #           repo: context.repo.repo
  #         });