main.yml

name: CI
on:
  push:
    branches:
      - main
    # Release flavor is derived from the tag suffix in the deploy job. Convention: prefix tags
    # with "v" (bare X.Y.Z is still accepted for backward compatibility).
    tags:
      - '*.*.*' # stable semver (e.g. v1.2.3): published and marked "Latest"
      - '*-preview' # pre-release (e.g. v1.2.3-preview): published, never "Latest"
      - '*-draft' # draft (e.g. v1.2.3-draft): unpublished for review, never "Latest"
  pull_request:
    branches:
      - main
  workflow_dispatch: # Allow manual trigger

# Least privilege by default; the deploy job elevates it explicitly.
permissions:
  contents: read

# Cancel superseded runs on the same ref, but only for pull requests — never abort an in-flight
# push to main or a tag (which may be mid-release).
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: npm ci
      - name: Lint sources
        run: |
          make lint
          npm run lint

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0 # SonarCloud needs the full history for blame/coverage
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: npm ci
      - name: Execute tests
        run: |
          make test
          make test-integration
          npm test
          make coverage
      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  e2e:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: npm ci
      - name: Install Playwright browser
        run: npx playwright install --with-deps chromium
      - name: Run Playwright non-regression suite
        run: make test-e2e

  security:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      # Audit only the dependencies that ship in the client bundle (dev tooling isn't served), and
      # fail only on high/critical advisories.
      - name: Audit frontend dependencies (npm)
        run: npm audit --omit=dev --audit-level=high
      # govulncheck reports only vulnerabilities actually reachable from the code, so it's low-noise
      # and safe to gate on.
      - name: Scan backend dependencies (govulncheck)
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      # Every run assembles the native image and smoke-tests it (proves the Dockerfile + embedded
      # UI still work). Only tag builds also cross-compile the release binaries + tarball, which the
      # deploy job packages into the multi-arch image and the GitHub release.
      - name: Build image (+ release binaries on tags) and smoke-test
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          targets="build-docker start-docker smoke-docker"
          [[ "$GITHUB_REF" == refs/tags/* ]] && targets="release $targets"
          make VERSION="$VERSION" RELEASE=1 $targets

      - name: Upload release artifacts
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: smocker-dist
          path: |
            build/smocker.tar.gz
            build/smocker-*

  deploy:
    needs: [lint, test, build, e2e, security]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # Elevated only here: push the image to GHCR and publish the GitHub release.
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - id: release_flags
        name: Derive the release flavor from the tag suffix
        env:
          REF: ${{ github.ref_name }}
        run: |
          draft=false
          prerelease=false
          make_latest=true
          if [[ "$REF" == *-draft ]]; then
            draft=true          # unpublished, editable on GitHub before release
            make_latest=false
          elif [[ "$REF" == *-* ]]; then
            prerelease=true      # e.g. -preview / -rc: published but never "Latest"
            make_latest=false
          fi
          {
            echo "draft=$draft"
            echo "prerelease=$prerelease"
            echo "make_latest=$make_latest"
          } >> "$GITHUB_OUTPUT"

      # The pre-built binaries (+ tarball) from the build job; the image is assembled from them.
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: smocker-dist
          path: ./build

      - name: Docker login
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # No QEMU: the image only packages the pre-built binaries (COPY-only target stages).
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Deploy on Docker registry
        env:
          VERSION: ${{ github.ref_name }}
        run: make VERSION="$VERSION" deploy-docker

      - name: Deploy on GitHub releases
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          files: |
            build/smocker.tar.gz
            build/smocker-*
          token: ${{ secrets.GITHUB_TOKEN }}
          draft: ${{ steps.release_flags.outputs.draft }}
          prerelease: ${{ steps.release_flags.outputs.prerelease }}
          make_latest: ${{ steps.release_flags.outputs.make_latest }}