ci.yml

---
name: CI
on:
  push:
    branches:
      - main
    tags:
      - v*
  pull_request:
  schedule:
    - cron: 0 7 1 * *
jobs:
  dependabot:
    name: 🤖 Check dependabot status
    runs-on: ubuntu-latest
    permissions: {}
    if: "!startsWith(github.event.head_commit.message, 'build: update Nix dependency hashes')"
    steps:
      - name: Fetch dependabot metadata
        if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request' }}
        id: metadata
        uses: dependabot/fetch-metadata@v2.2.0
    outputs:
      package-ecosystem: ${{ steps.metadata.outputs.package-ecosystem }}

  build-linux:
    name: 🐧 Build and test on Linux
    runs-on: ubuntu-latest
    needs:
      - dependabot
    if: needs.dependabot.outputs.package-ecosystem != 'npm_and_yarn'
    permissions:
      contents: read
      actions: write
    env:
      CI_AKVORADO_FUNCTIONAL_TESTS: "true"
    steps:
      # Setup
      - uses: docker/setup-buildx-action@v3
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Docker Compose up
        run: docker compose -f docker/docker-compose-dev.yml up --wait --wait-timeout 60 --quiet-pull
      - name: Setup
        uses: ./.github/actions/setup

      # Install dependencies
      - name: Install dependencies
        run: sudo apt-get install -qqy shared-mime-info curl

      # Build and test
      - name: Build
        run: make && ./bin/akvorado version
      - name: Go race tests
        run: make test-race
      - name: Run benchmark tests
        run: make test-bench
      - name: JS tests
        run: make test-js
      - name: Run coverage tests
        run: make test-coverage
      - uses: actions/upload-artifact@v4
        with:
          name: linux-coverage
          if-no-files-found: error
          path: |
            test/go/coverage.xml
            test/js/cobertura-coverage.xml
      - name: Upload binary
        uses: actions/upload-artifact@v4
        with:
          name: binary
          path: bin/akvorado
          if-no-files-found: error
      - name: Docker Compose down
        if: always()
        run: docker compose -f docker/docker-compose-dev.yml down --remove-orphans --timeout 60

  build-macos:
    name: 🍏 Build and test on macOS
    runs-on: macos-14
    needs:
      - dependabot
    if: needs.dependabot.outputs.package-ecosystem != 'npm_and_yarn'
    permissions:
      contents: read
    steps:
      # Setup
      - uses: actions/checkout@v4
      - name: Setup
        uses: ./.github/actions/setup

      # Build and test
      - name: Build
        run: make && ./bin/akvorado version
      - name: Tests
        run: make test-coverage-go
      - uses: actions/upload-artifact@v4
        with:
          name: macos-coverage
          if-no-files-found: error
          path: |
            test/go/coverage.xml
            test/js/cobertura-coverage.xml

  coverage:
    name: 🔍 Upload code coverage
    needs:
      - build-linux
      - build-macos
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@v4
        with:
          name: linux-coverage
          path: test/linux
      - uses: actions/download-artifact@v4
        with:
          name: macos-coverage
          path: test/macos
      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          token: bab8d6d9-e90c-4e37-b156-38a9a4c2108e # not ideal, but limited risk
          files: ./test/linux/go/coverage.xml,./test/linux/js/cobertura-coverage.xml, ./test/macos/go/coverage.xml,./test/macos/js/cobertura-coverage.xml
          flags: unittests
          fail_ci_if_error: true

  build-go:
    name: 🔭 Build Go backend
    runs-on: ubuntu-latest
    strategy:
      matrix:
        go-version: [ '1.21', '1.22' ]
    needs:
      - dependabot
    if: needs.dependabot.outputs.package-ecosystem != 'npm_and_yarn'
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        uses: ./.github/actions/setup
        with:
          go-version: ${{ matrix.go-version }}
      - name: Build
        run: make && ./bin/akvorado version
      - uses: actions/cache/save@v4
        with:
          path: |
            orchestrator/clickhouse/data/udp.csv
            orchestrator/clickhouse/data/tcp.csv
          key: cache-iana-${{ hashFiles('Makefile', 'nix/ianaServiceNamesHash.txt') }}
      - name: Tests
        run: make test

  build-js:
    name: 🔭 Build JS frontend
    runs-on: ubuntu-latest
    needs:
      - dependabot
    if: needs.dependabot.outputs.package-ecosystem != 'go_modules'
    permissions:
      contents: read
    strategy:
      matrix:
        node-version: [16, 18, 20]
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        uses: ./.github/actions/setup
        with:
          setup-go: false
          node-version: ${{ matrix.node-version }}
      - name: Build and test JS frontend
        run: make console/data/frontend test-js

  licenses:
    name: ⚖️ Check licenses
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        uses: ./.github/actions/setup
      - name: License check
        run: make licensecheck

  docker:
    name: 🐋 Build Docker images
    needs:
      - build-linux
      - licenses
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: read
      packages: write
      attestations: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: |
            ghcr.io/${{ github.repository }}
          tags: |
            type=schedule,pattern=main
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile
          platforms: ${{ startsWith(github.ref, 'refs/tags/') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          provenance: mode=max
          cache-from: type=registry,ref=ghcr.io/${{ github.repository }}:main
          cache-to: type=inline

  release:
    name: 🚀 Publish release
    needs:
      - build-linux
      - build-macos
      - build-go
      - build-js
      - docker
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
      actions: read
    steps:
      # Changelog
      - uses: actions/checkout@v4
      - name: Generate changelog
        run: make changelog.md

      # Get binary from build step
      - name: Download binary
        uses: actions/download-artifact@v4
        with:
          name: binary

      # Build tarball for docker compose
      - name: Build Docker Compose "quick start"
        run: |
          sed -i s,akvorado:main,akvorado:${GITHUB_REF_NAME#v}, docker/versions.yml
          tar zcvf docker-compose-quickstart.tar.gz \
            .env docker/* \
            orchestrator/clickhouse/data/docker-entrypoint.sh \
            config/*.yaml

      # Publish release
      - name: Publish release
        uses: softprops/action-gh-release@v2
        with:
          body_path: changelog.md
          draft: true
          fail_on_unmatched_files: true
          files: |
            akvorado
            docker-compose-quickstart.tar.gz