ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - "**"
    tags:
      - "v*"

permissions:
  contents: read

env:
  IMAGE_NAME: ghcr.io/${{ github.repository }}
  RELAY_IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/stream-ingress

jobs:
  test:
    name: Go tests
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Run go vet
        run: go vet ./...

      - name: Run tests
        run: go test -covermode=atomic -coverprofile=coverage.out ./...

      - name: Summarize coverage
        run: |
          {
            echo "### Go coverage"
            echo '```text'
            go tool cover -func=coverage.out
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload coverage artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: go-coverage
          path: coverage.out
          if-no-files-found: error

  postgres-integration:
    name: PostgreSQL metadata tests
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:18-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88
        env:
          POSTGRES_DB: proofline_test
          POSTGRES_USER: proofline
          POSTGRES_PASSWORD: proofline
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U proofline -d proofline_test"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Run PostgreSQL metadata integration tests
        env:
          SAFE_POSTGRES_TEST_DSN: postgres://proofline:proofline@127.0.0.1:5432/proofline_test?sslmode=disable
        run: go test ./internal/postgresdb -count=1

  govulncheck:
    name: Go vulnerability scan
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Run govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...

  build-binary:
    name: Build Linux binary
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Build binary
        run: |
          mkdir -p dist
          CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o dist/proofline-server-linux-amd64 ./cmd/api

      - name: Smoke-test binary startup
        env:
          SAFE_MAIN_BIND_ADDRS: 127.0.0.1:18080
          SAFE_ADMIN_BIND_ADDRS: 127.0.0.1:18081
          SAFE_AUTH_BOOTSTRAP_SECRET: ci-smoke-bootstrap-secret
        run: |
          set -euo pipefail

          data_dir="$RUNNER_TEMP/proofline-binary-smoke-data"
          log_file="$RUNNER_TEMP/proofline-binary-smoke.log"
          rm -rf "$data_dir"
          mkdir -p "$data_dir"

          SAFE_DATA_DIR="$data_dir" \
          SAFE_DB_PATH="$data_dir/safety.db" \
          ./dist/proofline-server-linux-amd64 >"$log_file" 2>&1 &
          server_pid="$!"

          cleanup() {
            kill "$server_pid" 2>/dev/null || true
            wait "$server_pid" 2>/dev/null || true
          }
          trap cleanup EXIT

          for _ in {1..30}; do
            if curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18080/static/styles.css" &&
              curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18081/admin/static/styles.css"; then
              exit 0
            fi
            if ! kill -0 "$server_pid" 2>/dev/null; then
              cat "$log_file"
              exit 1
            fi
            sleep 1
          done

          cat "$log_file"
          exit 1

      - name: Upload binary artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: proofline-server-linux-amd64
          path: dist/proofline-server-linux-amd64
          if-no-files-found: error

  attest-binary:
    name: Attest Linux binary
    runs-on: ubuntu-latest
    needs:
      - build-binary
      - govulncheck
    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - name: Download binary artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: proofline-server-linux-amd64
          path: dist

      - name: Generate binary artifact attestation
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
        with:
          subject-path: dist/proofline-server-linux-amd64

  upload-release-binary:
    name: Upload release binary
    runs-on: ubuntu-latest
    needs: attest-binary
    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
    permissions:
      contents: write
    steps:
      - name: Download binary artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: proofline-server-linux-amd64
          path: dist

      - name: Create release if missing and upload binary
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          prerelease_args=()
          if [[ "$TAG_NAME" == *"-rc."* || "$TAG_NAME" == *"-rc" || "$TAG_NAME" == *"-alpha" || "$TAG_NAME" == *"-beta" ]]; then
            prerelease_args+=(--prerelease --latest=false)
          fi

          if ! gh release view "$TAG_NAME" --repo "$REPO" >/dev/null 2>&1; then
            gh release create "$TAG_NAME" \
              --repo "$REPO" \
              --verify-tag \
              --title "$TAG_NAME" \
              --notes "Automated release shell for $TAG_NAME. Maintainers should review and replace these notes before relying on this release." \
              "${prerelease_args[@]}"
          fi

          gh release upload "$TAG_NAME" dist/proofline-server-linux-amd64 --repo "$REPO"

  docker:
    name: Build Docker image
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Normalize Docker image name
        id: image-name
        run: |
          image_name="$(printf '%s' "$IMAGE_NAME" | tr '[:upper:]' '[:lower:]')"
          echo "value=$image_name" >> "$GITHUB_OUTPUT"

      - name: Generate Docker metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ steps.image-name.outputs.value }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-

      - name: Build Docker image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: ./Dockerfile
          push: false
          load: true
          tags: |
            proofline-server:ci-smoke
            ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Smoke-test Docker image startup
        run: |
          set -euo pipefail

          volume_name="proofline-ci-smoke-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-0}"
          docker volume create "$volume_name" >/dev/null

          cleanup() {
            if [ -n "${container_id:-}" ]; then
              docker rm -f "$container_id" >/dev/null 2>&1 || true
            fi
            docker volume rm "$volume_name" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT

          container_id="$(docker run --detach \
            --env SAFE_AUTH_BOOTSTRAP_SECRET=ci-smoke-bootstrap-secret \
            --publish 127.0.0.1:18082:8080 \
            --publish 127.0.0.1:18083:8081 \
            --volume "$volume_name:/var/lib/proofline" \
            proofline-server:ci-smoke)"

          for _ in {1..30}; do
            if curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18082/static/styles.css" &&
              curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18083/admin/static/styles.css"; then
              exit 0
            fi
            if ! docker container inspect "$container_id" --format '{{.State.Running}}' 2>/dev/null | grep -q true; then
              docker logs "$container_id"
              exit 1
            fi
            sleep 1
          done

          docker logs "$container_id"
          exit 1

  docker-relay:
    name: Build stream-ingress Docker image
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Normalize stream-ingress image name
        id: image-name
        run: |
          image_name="$(printf '%s' "$RELAY_IMAGE_NAME" | tr '[:upper:]' '[:lower:]')"
          echo "value=$image_name" >> "$GITHUB_OUTPUT"

      - name: Generate stream-ingress Docker metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ steps.image-name.outputs.value }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-

      - name: Build stream-ingress Docker image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: ./Dockerfile.ingress
          push: false
          load: true
          tags: |
            proofline-stream-ingress:ci-smoke
            ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Smoke-test stream-ingress Docker image startup
        run: |
          set -euo pipefail

          volume_name="proofline-ingress-ci-smoke-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-0}"
          docker volume create "$volume_name" >/dev/null

          cleanup() {
            if [ -n "${container_id:-}" ]; then
              docker rm -f "$container_id" >/dev/null 2>&1 || true
            fi
            docker volume rm "$volume_name" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT

          container_id="$(docker run --detach \
            --env SAFE_STREAM_INGRESS_READY=true \
            --env SAFE_STREAM_INGRESS_RELAY_ID=ci-relay \
            --env SAFE_STREAM_INGRESS_REGION=ci \
            --env SAFE_STREAM_INGRESS_CORE_BASE_URL=http://127.0.0.1:8080 \
            --env SAFE_STREAM_INGRESS_CORE_SERVICE_AUTH_TOKEN=ci-local-relay-service-token-12345 \
            --publish 127.0.0.1:18090:8090 \
            --volume "$volume_name:/var/lib/proofline-stream-ingress" \
            proofline-stream-ingress:ci-smoke)"

          for _ in {1..30}; do
            if curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18090/health/live" &&
              curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18090/health/ready"; then
              for path in /admin /admin/api/accounts /v1/incidents /i/viewer-token /metrics; do
                status="$(curl --silent --show-error --output /dev/null --write-out "%{http_code}" "http://127.0.0.1:18090${path}")"
                if [ "$status" != "404" ]; then
                  echo "stream-ingress route ${path} returned HTTP ${status}, want 404" >&2
                  exit 1
                fi
              done
              exit 0
            fi
            if ! docker container inspect "$container_id" --format '{{.State.Running}}' 2>/dev/null | grep -q true; then
              docker logs "$container_id"
              exit 1
            fi
            sleep 1
          done

          docker logs "$container_id"
          exit 1

  docker-publish:
    name: Publish Docker image
    runs-on: ubuntu-latest
    needs:
      - test
      - govulncheck
      - docker
      - docker-relay
    if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/tags/v')) }}
    permissions:
      contents: read
      id-token: write
      attestations: write
      packages: write
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Normalize Docker image name
        id: image-name
        run: |
          image_name="$(printf '%s' "$IMAGE_NAME" | tr '[:upper:]' '[:lower:]')"
          echo "value=$image_name" >> "$GITHUB_OUTPUT"

      - name: Generate Docker metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ steps.image-name.outputs.value }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and publish Docker image
        id: build-and-publish
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Generate Docker image attestation
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
        with:
          subject-name: ${{ steps.image-name.outputs.value }}
          subject-digest: ${{ steps.build-and-publish.outputs.digest }}
          push-to-registry: true
          create-storage-record: false

      - name: Normalize stream-ingress image name
        id: relay-image-name
        run: |
          image_name="$(printf '%s' "$RELAY_IMAGE_NAME" | tr '[:upper:]' '[:lower:]')"
          echo "value=$image_name" >> "$GITHUB_OUTPUT"

      - name: Generate stream-ingress Docker metadata
        id: relay-meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ steps.relay-image-name.outputs.value }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-

      - name: Build and publish stream-ingress Docker image
        id: relay-build-and-publish
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: ./Dockerfile.ingress
          push: true
          tags: ${{ steps.relay-meta.outputs.tags }}
          labels: ${{ steps.relay-meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Generate stream-ingress Docker image attestation
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
        with:
          subject-name: ${{ steps.relay-image-name.outputs.value }}
          subject-digest: ${{ steps.relay-build-and-publish.outputs.digest }}
          push-to-registry: true
          create-storage-record: false