name: Main CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  RAWMARK_BUILD_CHANNEL: development

permissions:
  contents: read

concurrency:
  group: rawmark-main
  cancel-in-progress: false

jobs:
  check-and-package:
    if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
    runs-on: ubuntu-latest
    timeout-minutes: 55
    env:
      CI_RUN_ID: ${{ gitea.run_id }}
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: https://github.com/actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Check CI behavior and project
        run: |
          env -u RAWMARK_BUILD_CHANNEL python3 -m unittest discover -s scripts/tests -v
          sh scripts/ci-check.sh development
      - name: Package and smoke-test Linux amd64
        run: sh scripts/ci-package.sh development
      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-amd64
          path: downloads/*_linux_amd64.tar.gz
          compression-level: 0
          if-no-files-found: error
          retention-days: 7
      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: checksums
          path: |
            downloads/SHA256SUMS
            downloads/build.json
          if-no-files-found: error
          retention-days: 7

  image:
    needs: check-and-package
    runs-on: docker
    timeout-minutes: 20
    env:
      CI_RUN_ID: ${{ gitea.run_id }}
      CI_RUN_ATTEMPT: ${{ gitea.run_attempt }}
      CI_RESOURCE_LABEL: io.rawmark.ci.run=dev-${{ gitea.run_id }}-${{ gitea.run_attempt }}
      TEMP_IMAGE: rawmark-ci:${{ gitea.sha }}-${{ gitea.run_id }}-${{ gitea.run_attempt }}
      DOCKER_CONFIG: /tmp/rawmark-docker-auth
    defaults:
      run:
        shell: sh
    steps:
      - name: Install CI runtimes
        run: apk add --no-cache nodejs python3
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: https://github.com/actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-amd64
          path: downloads
      - uses: https://github.com/actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: checksums
          path: downloads
      - name: Verify, build and smoke-test the exact binary
        run: |
          set -eu
          python3 scripts/release.py prepare-image
          docker build --provenance=false --build-arg TARGETARCH=amd64 --tag "$TEMP_IMAGE" \
            --label "org.opencontainers.image.revision=${{ gitea.sha }}" \
            --label "org.opencontainers.image.version=$(python3 scripts/release.py version)" \
            -f deploy/Dockerfile.release image
          python3 scripts/smoke-docker.py "$TEMP_IMAGE" --client-container "$(hostname)" \
            --resource-label "$CI_RESOURCE_LABEL"
      - name: Clean this attempt's resources
        if: always()
        run: python3 scripts/ci-cleanup.py "$CI_RESOURCE_LABEL" --client-container "$(hostname)" --image "$TEMP_IMAGE"