cunicu/.forgejo/workflows/build.yaml

# SPDX-FileCopyrightText: 2023-2025 Steffen Vogel <post@steffenvogel.de>
# SPDX-License-Identifier: Apache-2.0

# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/github-workflow.json
---
name: Build

on:
  push:
    branches:
    - main
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  nix-update:
    name: Update Nix hashes
    runs-on: ubuntu-latest

    outputs:
      tag-current: ${{ steps.tags.outputs.current }}
      tag-next: ${{ steps.tags.outputs.next }}
      changed: ${{ steps.nix-update-hashes.outputs.changed }}

    steps:
    - name: Checkout
      uses: https://code.forgejo.org/actions/checkout@v5
      with:
        ref: ${{ github.event.pull_request.head.ref }}
        fetch-depth: 0
        token: ${{ secrets.PAT }}

    - name: Setup Nix
      uses: cachix/install-nix-action@v31
      with:
        nix_path: nixpkgs=channel:nixos-unstable

    - name: Setup Nix cache
      uses: cachix/cachix-action@v16
      with:
        name: cunicu
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

    - name: Setup Git
      run: |
        git config --global user.name 'github-actions[bot]'
        git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'

    - name: Get current and next tag
      id: tags
      run: |
        nix develop .#ci --command sh <<'EOF' | tee "$GITHUB_OUTPUT"
          # We always increment the patch version to ensure hashes of Nix derivations are updated
          # by our Forgejo actions tag workflow which runs nix-update
          echo next=$(svu next)
          echo current=$(svu current)
        EOF

    - name: Update version and vendor hashes in Nix derivation
      id: nix-update-hashes
      run: |
        nix develop .#ci --command sh <<'EOF'
            VERSION="${{ steps.tags.outputs.next || steps.tags.outputs.current }}"

            nix-update --flake gocov-merger
            nix-update --flake --version ${VERSION} cunicu
            nix-update --flake --version ${VERSION} scripts
            nix-update --flake --version ${VERSION} --subpackage yarnOfflineCache website
        EOF

        git diff --quiet || echo "changed=true" >> "$GITHUB_OUTPUT"

    - name: Commit changes
      id: git-commit
      if: steps.nix-update-hashes.outputs.changed == 'true'
      run: |
        LAST_AUTHOR=$(git log -1 --pretty=format:"%ae")
        RENOVATE_AUTHOR="29139614+renovate[bot]@users.noreply.github.com"

        if [ "${LAST_AUTHOR}" = "${RENOVATE_AUTHOR}" ]; then
          git commit --all --amend --no-edit
          git push --force
        else
          git commit --all --signoff --message "fix(nix): Update version and hashes"
          git push
        fi

  build:
    name: Build for ${{ matrix.target_os }} on ${{ matrix.target_arch }}${{ matrix.target_arch == 'arm' && format('-v{0}', matrix.arm) || ''}}${{ matrix.target_arch == 'mips' && format('-{0}', matrix.mips) || ''}}
    if: needs.nix-update.outputs.changed != 'true' # Skip build if we just pushed. We wait for the workflow to be retriggered.
    runs-on: ${{ matrix.runner || 'ubuntu-24.04' }}
    needs:
    - nix-update

    strategy:
      fail-fast: false
      matrix:
        include:
        - target_os: linux
          target_arch: amd64
          host_os: linux
          host_arch: amd64
          runner: ubuntu-24.04

        - target_os: linux
          target_arch: arm64
          host_os: linux
          host_arch: amd64
          runner: ubuntu-24.04

        - target_os: linux
          target_arch: arm
          host_os: linux
          host_arch: amd64
          arm: "7"
          runner: ubuntu-24.04

        # TODO: FreeBSD builds require cgo and FreeBSD
        #       system headers.

        # - target_os: freebsd
        #   target_arch: amd64
        #   host_os: linux
        #   host_arch: amd64
        #   runner: ubuntu-24.04

        # - target_os: freebsd
        #   target_arch: arm64
        #   host_os: linux
        #   host_arch: amd64
        #   runner: ubuntu-24.04

        # - target_os: freebsd
        #   target_arch: arm
        #   host_os: linux
        #   host_arch: amd64
        #   arm: "7"
        #   runner: ubuntu-24.04

        - target_os: darwin
          target_arch: arm64
          host_os: darwin
          host_arch: arm64
          runner: macos-latest

        - target_os: darwin
          target_arch: amd64
          host_os: darwin
          host_arch: arm64
          runner: macos-latest

        - target_os: windows
          target_arch: arm64
          host_os: windows
          host_arch: amd64
          runner: windows-latest

        - target_os: windows
          target_arch: amd64
          host_os: windows
          host_arch: amd64
          runner: windows-latest

        - target_os: linux
          target_arch: mips
          host_os: linux
          host_arch: amd64
          mips: softfloat
          runner: ubuntu-24.04

        - target_os: linux
          target_arch: mips
          host_os: linux
          host_arch: amd64
          mips: hardfloat
          runner: ubuntu-24.04

    env:
      GOOS: ${{ matrix.target_os }}
      GOARCH: ${{ matrix.target_arch }}
      GOARM: ${{ matrix.arm || '' }}

    steps:
    - name: Checkout
      uses: https://code.forgejo.org/actions/checkout@v5

    - name: Install dependencies
      if: ${{ matrix.host_os == 'linux' }}
      run: sudo apt-get install -y
            coturn
            protobuf-compiler
            make
            libpcap-dev

    - name: Install dependencies
      if: ${{ matrix.host_os == 'darwin' }}
      run: brew install
            protobuf
            make
            libpcap

    - name: Install dependencies
      if: ${{ matrix.host_os == 'windows' }}
      run: choco install
            protoc
            make

    - name: Setup Go
      uses: https://code.forgejo.org/actions/setup-go@v5
      with:
        go-version-file: go.mod
        check-latest: true

    - name: Install build and test dependencies
      env:
        GOOS: ${{ matrix.host_os }}
        GOARCH: ${{ matrix.host_arch }}
      run: make install-deps

    - name: Run cunīcu build
      run: make cunicu

    - name: Lint
      if: ${{ matrix.host_os != 'windows' }}
      run: make lint

    - name: Run tests
      if: ${{ matrix.target_arch == matrix.host_arch && matrix.target_os == matrix.host_os && matrix.host_os != 'windows' }}
      run: sudo --preserve-env env "PATH=$PATH" make tests
      env:
        # Pass token via environment variable to avoid GitHub API rate-limit
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Run tests for Windows # which has no sudo
      if: ${{ matrix.target_arch == matrix.host_arch && matrix.target_os == matrix.host_os && matrix.host_os == 'windows' }}
      run: make tests GINKGO_OPTS="--label-filter=!broken-on-windows"

    - name: Run end-to-end tests
      if: ${{ matrix.target_arch == matrix.host_arch && matrix.target_os == matrix.host_os && matrix.host_os == 'linux' }}
      run: sudo --preserve-env env "PATH=$PATH" make tests-e2e

    - name: Upload logs an packet captures as artifacts
      if: ${{ always() && matrix.target_arch == matrix.host_arch && matrix.target_os == matrix.host_os && matrix.host_os == 'linux' }}
      uses: https://code.forgejo.org/actions/upload-artifact@v4
      with:
        name: test-logs-${{ matrix.target_os }}-${{ matrix.target_arch }}
        path: test/e2e/logs/

    - name: Create merged coverage profile
      if: ${{ matrix.target_os == 'linux' && matrix.target_arch == 'amd64' }}
      run: |
        make coverprofile_merged.out

    - name: Report test coverage to Codecov
      if: ${{ matrix.target_os == 'linux' && matrix.target_arch == 'amd64' }}
      uses: codecov/codecov-action@v5
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        files: coverprofile_merged.out


  website:
    needs:
    - build
    uses: ./.github/workflows/website.yaml

  tag:
    name: Tag
    needs:
    - nix-update
    - build
    - website

    if: github.ref == 'refs/heads/main' && github.event_name == 'push' && needs.nix-update.outputs.tag-next != needs.nix-update.outputs.tag-current
    environment: release
    runs-on: ubuntu-latest

    steps:
    - name: Checkout
      uses: https://code.forgejo.org/actions/checkout@v5
      with:
        fetch-depth: 0
        token: ${{ secrets.PAT }}

    - name: Setup Git
      run: |
        git config --global user.name 'github-actions[bot]'
        git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'

    - name: Tag new release
      id: git-tag
      if: steps.tags.outputs.current != steps.tags.outputs.next
      run: |
        git tag ${{ needs.nix-update.outputs.tag-next }}
        git push origin tag ${{ needs.nix-update.outputs.tag-next }}