ci.yml RawHistoryFolder

1name: CI
2
3on:
4  push:
5    branches: [main]
6  pull_request:
7
8env:
9  # Test the module alone, with the versions in go.mod (never a go.work).
10  GOWORK: "off"
11  GOPRIVATE: bnema.dev/ermite*
12
13jobs:
14  lint:
15    name: Lint
16    runs-on: ubuntu-latest
17    steps:
18      - uses: actions/checkout@v6
19      # Job containers reach Forgejo through the Gordon edge on the host loopback,
20      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
21      - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
22        run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
23      - uses: actions/setup-go@v5
24        with:
25          go-version-file: go.mod
26          cache: true
27      - uses: golangci/golangci-lint-action@v9
28        with:
29          version: v2.14.0
30
31  test:
32    name: Test
33    # ermite needs git >= 2.45; the ubuntu-latest image (Debian bookworm) has 2.39.
34    # The arch label runs archlinux:latest as root, with a current git.
35    runs-on: arch
36    steps:
37      # openssh provides ssh-keygen, which the tests use to check that the squash
38      # commits verify (git verify-commit, ADR 0022). The tests fail without it when CI is set.
39      # nodejs runs the tests of the file finder (internal/adapters/web/jstest).
40      - name: System packages
41        run: pacman -Syu --noconfirm --needed git gcc openssh nodejs
42      - uses: actions/checkout@v6
43      # Job containers reach Forgejo through the Gordon edge on the host loopback,
44      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
45      - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
46        run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
47      - uses: actions/setup-go@v5
48        with:
49          go-version-file: go.mod
50          cache: true
51      - name: Git is at least 2.45
52        run: |
53          git --version
54          v=$(git --version | sed -E 's/^git version ([0-9]+)\.([0-9]+).*/\1 \2/')
55          set -- $v
56          if [ "$1" -lt 2 ] || { [ "$1" -eq 2 ] && [ "$2" -lt 45 ]; }; then
57            echo "git 2.45 or newer is required" >&2
58            exit 1
59          fi
60      - name: Verify tidy
61        run: |
62          go mod tidy
63          git diff --exit-code -- go.mod go.sum
64      - name: Generated templ code is up to date
65        run: scripts/templ-drift.sh
66      - run: go vet ./...
67      - run: go test -race ./...
68      - name: Architecture
69        run: go tool hexcheck -fail-on warn ./...
70      # The core of the file finder (static/js/files.js) runs in Node.
71      - name: JavaScript tests
72        run: node --test 'internal/adapters/web/jstest/*.test.mjs'
73
74  proto:
75    name: Protobuf and generated code
76    runs-on: ubuntu-latest
77    steps:
78      - uses: actions/checkout@v6
79        with:
80          # buf breaking compares with the base branch.
81          fetch-depth: 0
82      # Job containers reach Forgejo through the Gordon edge on the host loopback,
83      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
84      - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
85        run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
86      - uses: actions/setup-go@v5
87        with:
88          go-version-file: go.mod
89          cache: true
90      - run: go tool buf lint
91      - name: Breaking changes
92        if: github.event_name == 'pull_request'
93        # Skipped by the script while the base branch has no proto/ directory.
94        run: scripts/buf-breaking.sh "origin/${{ github.base_ref }}"
95      - name: Generated protobuf code is up to date
96        run: |
97          go tool buf generate
98          git diff --exit-code -- gen/
99          test -z "$(git status --porcelain -- gen/)"
100      - name: Generated mocks are up to date
101        run: |
102          go generate ./internal/ports
103          git diff --exit-code -- internal/ports/mocks/
104          test -z "$(git status --porcelain -- internal/ports/mocks/)"
105
106  image:
107    name: Image
108    # Build only, nothing is pushed. The arch job container gets the runner's rootless
109    # Podman socket as /var/run/docker.sock (docker_host in ci-runner/config.yml), so the
110    # docker CLI builds through Podman.
111    runs-on: arch
112    steps:
113      - name: System packages
114        run: pacman -Syu --noconfirm --needed git docker
115      - uses: actions/checkout@v6
116        with:
117          # git describe needs the tags for the image version.
118          fetch-depth: 0
119      # The build runs in Podman on the runner host. With the host network it resolves
120      # git.bnema.dev through the host's /etc/hosts (127.0.0.1, see vps-infra
121      # homelab/igor/ci-runner) and reaches Forgejo on :8088. Podman's Docker API rejects
122      # the classic builder's --add-host encoding, so host networking is used instead.
123      # Acceptable because only trusted branches of this repo trigger CI (no fork PRs).
124      - name: Build the image
125        run: |
126          docker build \
127            --network host \
128            --build-arg GIT_REWRITE_BASE=http://git.bnema.dev:8088/ \
129            --build-arg VERSION="$(git describe --tags --always --dirty)" \
130            -t ermite:ci .
131      - name: Smoke test
132        run: |
133          docker run --rm ermite:ci version | tee /dev/stderr | grep -qF "ermite $(git describe --tags --always --dirty)"
134          docker run --rm --entrypoint git ermite:ci --version