cairn/.forgejo/workflows/deploy.yml

name: Deploy

on:
  push:
    branches: [main]

concurrency:
  group: deploy-main
  cancel-in-progress: false

jobs:
  test:
    name: Run Tests
    runs-on: x86_64-linux
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.1"
      - run: go mod download
      - run: go test -v -race -coverprofile=coverage.out ./...
      - run: go tool cover -func=coverage.out

  lint:
    name: Lint
    runs-on: x86_64-linux
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.1"
      - run: go vet ./...
      - name: Check formatting
        run: |
          if [ -n "$(gofmt -l .)" ]; then
            echo "Go files are not formatted:"
            gofmt -l .
            exit 1
          fi          
      - name: Check go.mod tidy
        run: |
          go mod tidy
          if [ -n "$(git diff --name-only go.mod go.sum)" ]; then
            echo "go.mod or go.sum is not tidy. Run 'go mod tidy' and commit the changes."
            git diff go.mod go.sum
            exit 1
          fi          
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v7
        with:
          version: latest
      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest
      - name: Run govulncheck
        run: govulncheck ./...

  deploy:
    needs: [test, lint]
    runs-on: debian-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26.1"

      - name: Compute next version
        run: |
          LATEST_TAG=$(git tag --list 'v*' --sort=-v:refname | head -n1)
          if [ -z "${LATEST_TAG}" ]; then
            NEXT="v0.1.0"
          else
            # Bump patch: v0.1.2 -> v0.1.3
            PREFIX="${LATEST_TAG%.*}"
            PATCH="${LATEST_TAG##*.}"
            NEXT="${PREFIX}.$((PATCH + 1))"
          fi
          echo "VERSION=${NEXT}" >> "$GITHUB_ENV"
          echo "Next version: ${NEXT}"          

      - name: Build server binary
        run: CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o ./bin/cairn-server ./cmd/cairn-server

      - name: Cross-compile CLI
        run: |
          LDFLAGS="-w -s -X main.version=${VERSION}"
          build() {
            CGO_ENABLED=0 GOOS="$1" GOARCH="$2" \
              go build -ldflags="${LDFLAGS}" -o "./bin/cairn-$3" ./cmd/cairn
          }
          build linux  amd64 x86_64-linux
          build linux  arm64 aarch64-linux
          build darwin amd64 x86_64-macos
          build darwin arm64 aarch64-macos
          cp ./bin/cairn-x86_64-linux ./bin/cairn          

      - name: Install Docker CLI
        run: |
          apt-get update && apt-get install -y curl
          curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
            | tar xz --strip-components=1 -C /usr/local/bin docker/docker          

      - name: Wait for Docker
        run: |
          timeout=30
          elapsed=0
          while ! docker info >/dev/null 2>&1; do
            [ $elapsed -ge $timeout ] && echo "Docker not ready" && exit 1
            sleep 2
            elapsed=$((elapsed + 2))
          done          

      - name: Build image
        run: |
          REGISTRY="registry.ts.mattnite.net"
          docker build -t "${REGISTRY}/cairn:${GITHUB_SHA}" -t "${REGISTRY}/cairn:latest" .          

      - name: Push image
        run: |
          REGISTRY="registry.ts.mattnite.net"
          docker push "${REGISTRY}/cairn:${GITHUB_SHA}"
          docker push "${REGISTRY}/cairn:latest"          

      - name: Create git tag
        run: |
          git tag "${VERSION}"
          git push origin "${VERSION}"          

      - name: Publish CLI to package registry
        run: |
          PKG="${GITHUB_SERVER_URL}/api/packages/${GITHUB_REPOSITORY_OWNER}/generic/cairn"
          AUTH="Authorization: token ${{ secrets.PACKAGES_TOKEN }}"
          for file in ./bin/cairn-*; do
            filename="$(basename "${file}")"
            curl -fsSL -X PUT -H "${AUTH}" --upload-file "${file}" "${PKG}/${VERSION}/${filename}"
          done
          # Overwrite "latest": delete old files then upload
          for file in ./bin/cairn-*; do
            filename="$(basename "${file}")"
            curl -sS -X DELETE -H "${AUTH}" "${PKG}/latest/${filename}" || true
            curl -fsSL -X PUT -H "${AUTH}" --upload-file "${file}" "${PKG}/latest/${filename}"
          done          

      - name: Update infra
        uses: https://git.ts.mattnite.net/mattnite/infra/actions/update-image@main
        with:
          updates: |
            cairn ${{ github.sha }} cairn/cairn.hcl            
          forgejo_token: ${{ secrets.INFRA_API_TOKEN }}