ci.yml

name: CI
on:
  merge_group:
  pull_request:
  push:
    tags:
      - "v*"

concurrency:
  # Only cancel in-progress runs for pull_request events, this prevents cancelling workflows against main or tags
  # A pull_request will reuse the same group thus enabling cancelation, all others receive a unique run_id
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  ci:
    name: CI
    permissions: {}
    # This should be the only action checked as required in the repo settings.
    #
    # This is a meta-job, here to express the conditions we require
    # in order to consider a CI run to be successful.
    if: always()

    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs:
      - lint
      - test
      - bakery
      - bakery-native
      - bakery-pr
      - release
      - zizmor

    steps:
      - uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
        with:
          allowed-skips: bakery-pr, lint
          jobs: ${{ toJSON(needs) }}

  lint:
    name: Lint
    if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version-file: posit-bakery/pyproject.toml
      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
        env:
          SKIP: no-commit-to-branch

  test:
    name: Test
    permissions:
      contents: read
      checks: write
      pull-requests: write
    runs-on: ubuntu-latest-8x
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Setup goss
        uses: ./setup-goss

      - name: Set up Docker
        uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db  # v5.1.0
        with:
          daemon-config: |
            {
              "features": {
                "containerd-snapshotter": true
              }
            }

      - name: Setup QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
        with:
          platforms: linux/amd64,linux/arm64

      - name: Setup docker buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0

      - name: Setup hadolint
        uses: ./setup-hadolint

      - name: Setup wizcli
        uses: ./setup-wizcli

      - name: Setup ORAS CLI
        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3  # v2.0.0

      - name: Add tools/ to path
        run: echo "${GITHUB_WORKSPACE}/tools" >> "$GITHUB_PATH"

      - name: Setup uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
        with:
          python-version-file: "posit-bakery/pyproject.toml"
          enable-cache: false

      - name: Install dependencies
        working-directory: ./posit-bakery
        run: |
          uv sync

      - name: Run pytest
        working-directory: ./posit-bakery
        run: |
          GOSS_PATH=${GITHUB_WORKSPACE}/tools/goss \
          DGOSS_PATH=${GITHUB_WORKSPACE}/tools/dgoss \
          uv run pytest -n auto \
            --dist loadgroup \
            --cov=posit_bakery \
            --cov-report=xml \
            --junit-xml=results.xml \
            test/

      - name: Build
        working-directory: ./posit-bakery
        run: |
          uv build

      - name: Publish results
        # Dependabot and fork PRs get a restricted GITHUB_TOKEN without
        # checks:write. Skip rather than switch to pull_request_target.
        if: >-
          always()
          && github.actor != 'dependabot[bot]'
          && github.event.pull_request.head.repo.fork != true
        uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040  # v2.23.0
        with:
          files: ./posit-bakery/results.xml

  bakery:
    name: Bakery
    permissions:
      contents: read
      packages: write

    uses: "./.github/workflows/bakery-build.yml"
    with:
      version: ${{ github.head_ref || github.ref_name }}
      context: "./posit-bakery/test/resources/with-macros/"
      dev-versions: include

  bakery-native:
    name: Bakery Native Build
    permissions:
      contents: read
      packages: write

    uses: "./.github/workflows/bakery-build-native.yml"
    with:
      version: ${{ github.head_ref || github.ref_name }}
      context: "./posit-bakery/test/resources/multiplatform/"
      dev-versions: include


  bakery-pr:
    name: Bakery PR Build
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      packages: write
    uses: "./.github/workflows/bakery-build-pr.yml"
    with:
      context: "./posit-bakery/test/resources/multiplatform/"
      dev-versions: include

  zizmor:
    name: Zizmor
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e  # v0.5.3

  with-macros-clean-caches:
    name: Clean Caches (with-macros suite)
    permissions:
      contents: read
      packages: write
    needs:
      - bakery
      - bakery-native

    uses: "./.github/workflows/clean.yml"
    with:
      version: ${{ github.head_ref || github.ref_name }}
      context: "./posit-bakery/test/resources/with-macros/"
      remove-dangling-caches: true
      remove-caches-older-than: 14
      clean-temporary-images: false  # TODO: flip to true if this build starts using the native workflow

  multiplatform-clean-caches:
    name: Clean Caches (multiplatform suite)
    permissions:
      contents: read
      packages: write
    needs:
      - bakery
      - bakery-native

    uses: "./.github/workflows/clean.yml"
    with:
      version: ${{ github.head_ref || github.ref_name }}
      context: "./posit-bakery/test/resources/multiplatform/"
      remove-dangling-caches: true
      remove-caches-older-than: 14
      remove-dangling-temporary-images: false
      remove-temporary-images-older-than: 3

  release:
    name: Release/Snapshot
    permissions:
      contents: write
    if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') || github.event_name == 'pull_request' || github.event_name == 'merge_group')
    needs:
      - test
      - bakery
      - bakery-native
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Setup uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
        with:
          python-version-file: "posit-bakery/pyproject.toml"
          enable-cache: false

      - name: Install dependencies
        working-directory: ./posit-bakery
        run: |
          uv sync

      - name: Build
        working-directory: ./posit-bakery
        run: |
          uv build

      - name: Upload snapshot artifacts
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: bakery-snapshot-pr${{ github.event.pull_request.number }}
          path: ./posit-bakery/dist
          retention-days: 7
          overwrite: true

      - name: Create a release draft
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          gh release create "$REF_NAME" \
            --draft \
            --generate-notes \
            --latest
          gh release upload "$REF_NAME" \
            ./posit-bakery/dist/*