ci.yml RawHistoryFolder

1name: CI
2
3on:
4  push:
5    branches: [main]
6  pull_request:
7
8env:
9  # Test the module alone, with the versions in go.mod (never a go.work).
10  GOWORK: "off"
11  GOPRIVATE: bnema.dev/ermite*
12
13jobs:
14  lint:
15    name: Lint
16    runs-on: ubuntu-latest
17    steps:
18      - uses: actions/checkout@v6
19      # Job containers reach Forgejo through the Gordon edge on the host loopback,
20      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
21      - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
22        run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
23      - uses: actions/setup-go@v5
24        with:
25          go-version-file: go.mod
26          cache: true
27      - uses: golangci/golangci-lint-action@v9
28        with:
29          version: v2.14.0
30
31  test:
32    name: Test
33    # ermite needs git >= 2.45; the ubuntu-latest image (Debian bookworm) has 2.39.
34    # The arch label runs archlinux:latest as root, with a current git.
35    runs-on: arch
36    steps:
37      # openssh provides ssh-keygen, which the tests use to check that the squash
38      # commits verify (git verify-commit, ADR 0022). The tests fail without it when CI is set.
39      - name: System packages
40        run: pacman -Syu --noconfirm --needed git gcc openssh
41      - uses: actions/checkout@v6
42      # Job containers reach Forgejo through the Gordon edge on the host loopback,
43      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
44      - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
45        run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
46      - uses: actions/setup-go@v5
47        with:
48          go-version-file: go.mod
49          cache: true
50      - name: Git is at least 2.45
51        run: |
52          git --version
53          v=$(git --version | sed -E 's/^git version ([0-9]+)\.([0-9]+).*/\1 \2/')
54          set -- $v
55          if [ "$1" -lt 2 ] || { [ "$1" -eq 2 ] && [ "$2" -lt 45 ]; }; then
56            echo "git 2.45 or newer is required" >&2
57            exit 1
58          fi
59      - name: Verify tidy
60        run: |
61          go mod tidy
62          git diff --exit-code -- go.mod go.sum
63      - name: Generated templ code is up to date
64        run: scripts/templ-drift.sh
65      - run: go vet ./...
66      - run: go test -race ./...
67      - name: Architecture
68        run: go tool hexcheck -fail-on warn ./...
69
70  proto:
71    name: Protobuf and generated code
72    runs-on: ubuntu-latest
73    steps:
74      - uses: actions/checkout@v6
75        with:
76          # buf breaking compares with the base branch.
77          fetch-depth: 0
78      # Job containers reach Forgejo through the Gordon edge on the host loopback,
79      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
80      - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
81        run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
82      - uses: actions/setup-go@v5
83        with:
84          go-version-file: go.mod
85          cache: true
86      - run: go tool buf lint
87      - name: Breaking changes
88        if: github.event_name == 'pull_request'
89        # Skipped by the script while the base branch has no proto/ directory.
90        run: scripts/buf-breaking.sh "origin/${{ github.base_ref }}"
91      - name: Generated protobuf code is up to date
92        run: |
93          go tool buf generate
94          git diff --exit-code -- gen/
95          test -z "$(git status --porcelain -- gen/)"
96      - name: Generated mocks are up to date
97        run: |
98          go generate ./internal/ports
99          git diff --exit-code -- internal/ports/mocks/
100          test -z "$(git status --porcelain -- internal/ports/mocks/)"
101
102  image:
103    name: Image
104    # Build only, nothing is pushed. The arch job container gets the runner's rootless
105    # Podman socket as /var/run/docker.sock (docker_host in ci-runner/config.yml), so the
106    # docker CLI builds through Podman.
107    runs-on: arch
108    steps:
109      - name: System packages
110        run: pacman -Syu --noconfirm --needed git docker
111      - uses: actions/checkout@v6
112        with:
113          # git describe needs the tags for the image version.
114          fetch-depth: 0
115      # The build runs in Podman on the runner host. With the host network it resolves
116      # git.bnema.dev through the host's /etc/hosts (127.0.0.1, see vps-infra
117      # homelab/igor/ci-runner) and reaches Forgejo on :8088. Podman's Docker API rejects
118      # the classic builder's --add-host encoding, so host networking is used instead.
119      # Acceptable because only trusted branches of this repo trigger CI (no fork PRs).
120      - name: Build the image
121        run: |
122          docker build \
123            --network host \
124            --build-arg GIT_REWRITE_BASE=http://git.bnema.dev:8088/ \
125            --build-arg VERSION="$(git describe --tags --always --dirty)" \
126            -t ermite:ci .
127      - name: Smoke test
128        run: |
129          docker run --rm ermite:ci version | tee /dev/stderr | grep -qF "ermite $(git describe --tags --always --dirty)"
130          docker run --rm --entrypoint git ermite:ci --version