develop.yml

name: Agregarr Develop

on:
  pull_request:
    branches:
      - '*'
  push:
    branches:
      - develop
      - 'feature/**'
    tags:
      - 'v*'
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - '.gitignore'
      - 'LICENSE'

permissions:
  contents: read

jobs:
  # Runs on every trigger, not just pull requests. Fork work pushes straight to
  # develop, so a PR-only gate is no gate at all.
  test:
    name: Lint, Typecheck & Test
    runs-on: ubuntu-22.04
    container: node:20.19.5-alpine
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install build dependencies
        run: |
          apk add --no-cache \
            python3 make g++ gcc libc6-compat bash \
            build-base cairo-dev pango-dev jpeg-dev giflib-dev pixman-dev
      - name: Install dependencies
        env:
          HUSKY: 0
        run: yarn
      - name: Lint
        run: yarn lint
      - name: Type Check
        run: yarn typecheck
      - name: Formatting
        run: npx prettier --check .
      - name: Test
        run: yarn test
      # On a push the Docker build runs yarn build anyway; only PRs need this.
      - name: Build
        if: github.event_name == 'pull_request'
        run: yarn build

  build_develop:
    name: Build Develop
    if: github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')
    needs: test
    runs-on: ubuntu-22.04
    steps:
      - name: Skip if superseded
        id: skip
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ref="${GITHUB_REF#refs/heads/}"
          latest=$(gh api "repos/$GITHUB_REPOSITORY/commits/$ref" --jq .sha 2>/dev/null || echo "")
          if [ -n "$latest" ] && [ "$latest" != "$GITHUB_SHA" ]; then
            echo "Superseded by ${latest:0:7}, skipping build"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Free disk space
        if: steps.skip.outputs.skip != 'true'
        run: |
          sudo rm -rf /usr/share/dotnet /opt/ghcrunner /usr/local/lib/android /usr/share/swift
      - name: Checkout
        if: steps.skip.outputs.skip != 'true'
        uses: actions/checkout@v4
      - name: Log in to Docker Hub
        if: steps.skip.outputs.skip != 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Set up Docker Buildx
        if: steps.skip.outputs.skip != 'true'
        uses: docker/setup-buildx-action@v3
      - name: Determine Docker tags
        if: steps.skip.outputs.skip != 'true'
        id: tags
        run: |
          if [[ "$GITHUB_REF" == refs/heads/develop ]]; then
            echo "tags=bitr8/agregarr:develop" >> "$GITHUB_OUTPUT"
          else
            SLUG="${GITHUB_REF#refs/heads/feature/}"
            echo "tags=bitr8/agregarr:${SLUG}" >> "$GITHUB_OUTPUT"
          fi
      - name: Fail if the develop version was bumped
        if: steps.skip.outputs.skip != 'true'
        run: |
          v=$(jq -r .version package.json)
          if [ "$v" != "0.1.0" ]; then
            echo "::error::package.json is $v; develop must stay 0.1.0 so builds report develop-<sha>"
            exit 1
          fi
      - name: Build and push
        if: steps.skip.outputs.skip != 'true'
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            COMMIT_TAG=${{ github.sha }}
          tags: ${{ steps.tags.outputs.tags }}

  build_release:
    name: Build ${{ matrix.platform }}
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    needs: test
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-22.04
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /opt/ghcrunner /usr/local/lib/android /usr/share/swift
      - name: Checkout
        uses: actions/checkout@v4
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
      # Explicit rather than relying on the runner image having npm, which
      # differs between the x64 and arm64 runners.
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
      # package.json stays 0.1.0 on develop so those builds self-identify as
      # develop-<sha>; the tag is the only source of a release version.
      - name: Set version from tag
        run: npm version "${GITHUB_REF#refs/tags/v}" --no-git-tag-version --allow-same-version
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ matrix.platform }}
          build-args: |
            COMMIT_TAG=${{ github.sha }}
          outputs: type=image,name=bitr8/agregarr,push-by-digest=true,name-canonical=true,push=true
      # v2.8.0 shipped reporting 2.7.0. Assert on the image, not on the
      # injection step having exited 0. Fails before merge_release moves
      # :latest, so a mismatched build never becomes user-visible.
      - name: Verify the image reports the tag's version
        run: |
          want="${GITHUB_REF#refs/tags/v}"
          got=$(docker run --rm --entrypoint node \
            "bitr8/agregarr@${{ steps.build.outputs.digest }}" \
            -e 'console.log(require("/app/package.json").version)')
          echo "tag=$want image=$got"
          if [ "$want" != "$got" ]; then
            echo "::error::image reports $got but the tag says $want"
            exit 1
          fi
      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"
      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge_release:
    name: Create multi-arch manifest
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-22.04
    needs: build_release
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          pattern: digests-*
          path: /tmp/digests
          merge-multiple: true
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Determine Docker tags
        id: tags
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          # A pre-release (v2.8.1-rc1) gets its own tag and must not move
          # :latest, so the whole release path can be rehearsed on a throwaway.
          if [[ "$VERSION" == *-* ]]; then
            echo "tags=bitr8/agregarr:${VERSION}" >> "$GITHUB_OUTPUT"
          else
            echo "tags=bitr8/agregarr:latest,bitr8/agregarr:${VERSION}" >> "$GITHUB_OUTPUT"
          fi
      - name: Create manifest and push
        working-directory: /tmp/digests
        run: |
          TAGS=$(echo "${{ steps.tags.outputs.tags }}" | tr ',' '\n' | sed 's/^/-t /' | tr '\n' ' ')
          docker buildx imagetools create $TAGS \
            $(printf 'bitr8/agregarr@sha256:%s ' *)
      # Inspect what this run actually pushed. Hardcoding :latest meant a
      # pre-release printed the previous release and looked verified.
      - name: Inspect images
        run: |
          for t in $(echo "${{ steps.tags.outputs.tags }}" | tr ',' ' '); do
            docker buildx imagetools inspect "$t"
          done