ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  hadolint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Lint Dockerfile
        run: docker run --rm -i hadolint/hadolint < Dockerfile

  ruby:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Run RuboCop
        run: bundle exec rubocop -F

      - name: Verify Yard documentation
        run: bundle exec yard doc --fail-on-warning --no-output

      - name: Run RSpec
        run: bundle exec rspec

      - name: Upload coverage report
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage-report
          path: coverage/
          retention-days: 30

  openapi:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          cache: true
          cache_dependency_path: frontend/pnpm-lock.yaml
          package_json_file: frontend/package.json

      - name: Setup Node.js for OpenAPI lint tooling
        uses: actions/setup-node@v6
        with:
          node-version-file: ".tool-versions"

      - name: Install frontend dependencies for OpenAPI client verification
        run: pnpm install --frozen-lockfile
        working-directory: frontend

      - name: Verify generated OpenAPI spec and client are up to date
        run: make openapi-verify

      - name: Lint OpenAPI contract
        run: make openapi-lint

  frontend:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          cache: true
          cache_dependency_path: frontend/pnpm-lock.yaml
          package_json_file: frontend/package.json

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".tool-versions"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Typecheck frontend
        run: pnpm run typecheck

      - name: Lint CSS with Stylelint
        run: pnpm exec stylelint "**/*.css"

      - name: Check formatting
        run: pnpm run format:check

      - name: Audit dependencies
        run: pnpm audit --audit-level=moderate

      - name: Run frontend tests
        run: pnpm run test:ci

      - name: Install Playwright Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Run frontend smoke test
        run: pnpm run test:e2e

  docker-build-smoke-image:
    needs:
      - hadolint
      - ruby
      - openapi
      - frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Build Docker smoke image
        run: docker build -t html2rss/web -f Dockerfile .

      - name: Export Docker smoke image
        run: docker save html2rss/web -o /tmp/html2rss-web-smoke-image.tar

      - name: Upload Docker smoke image
        uses: actions/upload-artifact@v7
        with:
          name: docker-smoke-image
          path: /tmp/html2rss-web-smoke-image.tar
          retention-days: 1

  docker-test:
    needs:
      - docker-build-smoke-image
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        smoke_auto_source_enabled: ["false", "true"]
    steps:
      - uses: actions/checkout@v6

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Download Docker smoke image
        uses: actions/download-artifact@v8
        with:
          name: docker-smoke-image
          path: /tmp

      - name: Load Docker smoke image
        run: docker load -i /tmp/html2rss-web-smoke-image.tar

      - name: Run Docker smoke test
        env:
          DOCKER_SMOKE_SKIP_BUILD: "true"
          SMOKE_AUTO_SOURCE_ENABLED: ${{ matrix.smoke_auto_source_enabled }}
        run: bundle exec rake

  docker-publish:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs:
      - docker-test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    env:
      IMAGE_NAME: html2rss/web
      TAG_SHA: ${{ github.sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          cache: true
          cache_dependency_path: frontend/pnpm-lock.yaml
          package_json_file: frontend/package.json

      - name: Setup Node.js for Docker build
        uses: actions/setup-node@v6
        with:
          node-version-file: ".tool-versions"

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile
        working-directory: frontend

      - name: Build frontend static assets
        run: pnpm run build
        working-directory: frontend

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Get Git commit timestamps
        run: echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.IMAGE_NAME }}

      - name: Log in to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Cache Docker layers
        uses: actions/cache@v5
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        env:
          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
        with:
          context: .
          push: true
          tags: |
            html2rss/web:latest
            html2rss/web:${{ github.sha }}
            ${{ steps.meta.outputs.tags }}
          platforms: linux/amd64,linux/arm64
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new
          provenance: true
          sbom: true
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.created=${{ github.event.head_commit.timestamp }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.title=html2rss-web
            org.opencontainers.image.description=Generates RSS feeds of any website & serves to the web!
            org.opencontainers.image.sbom=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts

      - name: Move updated cache into place
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache