name: CI

on:
  push:
    branches: [main]
    tags: ['*']
  pull_request:
    branches: [main]

permissions: {}

# This makes `-o pipefail` the default behavior for `run:` steps.
defaults:
  run:
    shell: bash

jobs:
  unit-tests:
    runs-on: ubuntu-latest
    container: quay.io/fedora/fedora:latest # zizmor: ignore[unpinned-images]
    permissions:
      contents: read
    steps:
      - name: Install tools
        run: dnf install -y cargo clippy rustfmt just ShellCheck nodejs-npm openssl-devel git jq
      - name: Configure git
        run: git config --global --add safe.directory '*'
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install markdownlint
        run: npm install -g markdownlint-cli
        # do this first to avoid building implicitly bumping the lockfile
      - name: Verify Cargo.lock and README.md are in sync
        run: just versioncheck
      - name: Build
        run: just build
      - name: Check
        run: just checkall

  e2e-tests:
    needs: unit-tests
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: e2e-tests (fedora, amd64)
            runner: ubuntu-24.04
            arch: amd64
            push: true
          - name: e2e-tests (fedora, arm64)
            runner: ubuntu-24.04-arm
            arch: arm64
            push: true
          - name: e2e-tests (ubi9)
            runner: ubuntu-24.04
            base: registry.access.redhat.com/ubi9/ubi:latest
            tests: self
          - name: e2e-tests (ubi10)
            runner: ubuntu-24.04
            base: registry.access.redhat.com/ubi10/ubi:latest
            tests: self
    name: ${{ matrix.name }}
    permissions:
      contents: read
      packages: write # Required to push image to ghcr.io
    container:
      image: quay.io/fedora/fedora:latest # zizmor: ignore[unpinned-images]
      options: --privileged --cgroupns=host -v /var/lib/containers -v /var/tmp -v /tmp
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install tools
        run: dnf install -y just buildah podman skopeo jq diffutils
      - name: Build image
        env:
          BASE_IMAGE: ${{ matrix.base || '' }}
        run: |
          if [ -n "${BASE_IMAGE}" ]; then
            just buildimg -- --build-arg=BASE="${BASE_IMAGE}"
          else
            just buildimg
          fi
      - name: Run tests
        env:
          TESTS: ${{ matrix.tests }}
        run: |
          just test ${TESTS}
      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ matrix.name }}
          path: tests/e2e/results/
      - name: Push to ghcr.io
        if: github.event_name == 'push' && matrix.push
        env:
          ARCH: ${{ matrix.arch }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          podman login -u "${GITHUB_ACTOR}" -p "${GH_TOKEN}" ghcr.io
          podman push chunkah "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}-${ARCH}"

  manifest:
    needs: e2e-tests
    if: github.event_name == 'push'
    runs-on: ubuntu-24.04
    permissions:
      packages: write # Required to push image to ghcr.io
      id-token: write # Required to get ID token to sign image using Cosign
    steps:
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: Create and push manifest
        id: push-manifest
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          podman login -u "${GITHUB_ACTOR}" -p "${GH_TOKEN}" ghcr.io
          podman manifest create "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \
            "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}-amd64" \
            "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}-arm64"
          podman manifest push --digestfile=/tmp/manifest-digest \
            "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}"
          echo "digest=$(cat /tmp/manifest-digest)" >> "${GITHUB_OUTPUT}"
          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            TAG="${GITHUB_REF#refs/tags/}"
          else
            TAG='latest'
          fi
          podman tag "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \
            "ghcr.io/${GITHUB_REPOSITORY}:${TAG}"
          podman manifest push "ghcr.io/${GITHUB_REPOSITORY}:${TAG}"
      - name: Sign ghcr.io image
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MANIFEST_DIGEST: ${{ steps.push-manifest.outputs.digest }}
        run: |
          cosign login ghcr.io -u "${GITHUB_ACTOR}" -p "${GH_TOKEN}"
          cosign sign --yes --recursive \
            "ghcr.io/${GITHUB_REPOSITORY}@${MANIFEST_DIGEST}"

  release:
    needs: manifest
    if: github.event_name == 'push'
    runs-on: ubuntu-24.04
    permissions:
      packages: write # Required to clean up old images from ghcr.io
      id-token: write # Required to get ID token to sign image using Cosign
    steps:
      - name: Install skopeo
        run: |
          sudo apt-get update
          sudo apt-get install -y skopeo

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Push to quay.io
        id: push-quay
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          QUAY_AUTH: ${{ secrets.QUAY_AUTH }}
        run: |
          set -euo pipefail
          mkdir -p ~/.docker
          echo "${QUAY_AUTH}" > ~/.docker/config.json
          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            TAG="${GITHUB_REF#refs/tags/}"
            skopeo copy --all --digestfile=/tmp/quay-digest \
              --src-creds="${GITHUB_ACTOR}:${GH_TOKEN}" \
              "docker://ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \
              "docker://quay.io/coreos/chunkah:${TAG}"
            skopeo copy --all --src-creds="${GITHUB_ACTOR}:${GH_TOKEN}" \
              "docker://ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \
              'docker://quay.io/coreos/chunkah:latest'
          else
            skopeo copy --all --digestfile=/tmp/quay-digest \
              --src-creds="${GITHUB_ACTOR}:${GH_TOKEN}" \
              "docker://ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \
              'docker://quay.io/coreos/chunkah:dev'
          fi
          echo "digest=$(cat /tmp/quay-digest)" >> "${GITHUB_OUTPUT}"

      - name: Sign quay.io image
        env:
          QUAY_DIGEST: ${{ steps.push-quay.outputs.digest }}
        run: |
          cosign sign --yes --recursive "quay.io/coreos/chunkah@${QUAY_DIGEST}"

      - name: Cleanup old images
        uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
        with:
          package-name: chunkah
          package-type: container
          min-versions-to-keep: 20
          ignore-versions: '^v.*$'