default.yml

name: Default

on:
  push:
    branches:
      - master
  pull_request:
  workflow_call:

jobs:
  clean:
    name: Clean
    runs-on: depot-ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
        id: go

      - name: Install tools
        run: make install

      - name: Assets
        run: make assets

      - name: Docs
        run: make docs

      - name: Porcelain
        run: make porcelain

  build:
    name: Build
    runs-on: depot-ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
        id: go

      - uses: voidzero-dev/setup-vp@v1
        with:
          node-version: "26"
          cache: true

      - run: mkdir dist && touch dist/empty

      - name: Build
        run: make build

  test:
    name: Test
    runs-on: depot-ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
        id: go

      - name: Test
        run: mkdir dist && touch dist/empty && make test

  lint:
    name: Lint
    runs-on: depot-ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
        id: go

      - run: mkdir dist && touch dist/empty

      - name: Lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
        with:
          version: latest
          args: --timeout 5m

      - name: License
        run: make license

  ui:
    name: UI
    permissions:
      contents: read
      actions: write
    runs-on: depot-ubuntu-24.04-arm

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: voidzero-dev/setup-vp@v1
        with:
          node-version: "26"
          cache: true

      - name: Install
        run: make install-ui

      - name: Restore vp task cache
        id: vp-cache
        uses: actions/cache/restore@v6
        with:
          path: node_modules/.vite/task-cache
          key: ${{ runner.os }}-${{ runner.arch }}-vp-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-vp-

      - name: OpenAPI
        # backport release tags may not have the openapi target yet
        run: if grep -q '^openapi' Makefile; then make openapi; fi

      - name: Lint
        run: make lint-ui

      - name: Test
        run: make test-ui

      - name: License
        run: make license-ui

      - name: Build UI
        run: make ui

      - name: Save vp task cache
        # avoid cache thrashing by nightly and pull requests
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        uses: actions/cache/save@v6
        with:
          path: node_modules/.vite/task-cache
          key: ${{ steps.vp-cache.outputs.cache-primary-key }}

      - name: Cache dist
        # only the release and nightly builds consume this, both keyed by the
        # master or tag sha. Pull request entries would never be restored
        if: github.event_name == 'push'
        uses: actions/cache/save@v6
        id: cache-dist
        with:
          path: dist
          key: ${{ runner.os }}-${{ github.sha }}-dist

      - name: Porcelain
        run: |
          test -z "$(git status --porcelain)" || (git status; git diff; false)

  integration:
    name: Integration
    runs-on: depot-ubuntu-24.04-arm-32

    permissions:
      contents: read
      actions: write

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
        id: go

      - uses: voidzero-dev/setup-vp@v1
        with:
          node-version: "26"
          cache: true

      - name: Install
        run: make install-ui

      - name: Restore vp task cache
        # restore only, the UI job owns saving the cache
        uses: actions/cache/restore@v6
        with:
          path: node_modules/.vite/task-cache
          key: ${{ runner.os }}-${{ runner.arch }}-vp-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-vp-

      - name: Build UI
        run: make ui

      - name: Build Go
        run: make build

      - name: Get Playwright version
        id: playwright-version
        run: echo "PLAYWRIGHT_VERSION=$(node -e "console.log(require('./package-lock.json').packages['node_modules/@playwright/test'].version)")" >> $GITHUB_ENV

      - name: Cache Playwright browsers
        uses: actions/cache/restore@v6
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}

      - name: Install Playwright (browsers + deps)
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: vpx playwright install --with-deps chromium
        timeout-minutes: 5

      - name: Save Playwright browsers
        if: github.ref == 'refs/heads/master' && steps.playwright-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v6
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}

      - name: Run tests
        run: vpx playwright test
        timeout-minutes: 20
        env:
          TZ: Europe/Berlin

      - name: Upload Playwright Report
        uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 14

      - name: Upload Playwright Raw Test Results
        uses: actions/upload-artifact@v7
        if: failure()
        with:
          name: playwright-test-results
          path: test-results/
          retention-days: 2

  # fork pull requests cannot use Depot's cache and fall back to the GitHub one,
  # which only master can seed for them. Must not run on a Depot runner, those
  # write to Depot's cache instead
  warm-fork-cache-go:
    name: Warm fork cache (Go)
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    runs-on: ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      # setup-go puts ImageOS in the cache key, and GitHub's arm image reports
      # ubuntu24-arm64 where Depot's reports ubuntu24. Without the override the
      # warmed entry never matches the key a fork run looks for
      - uses: actions/setup-go@v7
        env:
          ImageOS: ubuntu24
        with:
          go-version-file: go.mod
        id: go

      # on a hit setup-go does not save again, so building would populate nothing
      - name: Build
        if: steps.go.outputs.cache-hit != 'true'
        run: mkdir dist && touch dist/empty && make build

  warm-fork-cache-ui:
    name: Warm fork cache (UI)
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    runs-on: ubuntu-24.04-arm

    permissions:
      contents: read
      actions: write

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: voidzero-dev/setup-vp@v1
        with:
          node-version: "26"
          cache: true

      - name: Get Playwright version
        run: echo "PLAYWRIGHT_VERSION=$(node -e "console.log(require('./package-lock.json').packages['node_modules/@playwright/test'].version)")" >> $GITHUB_ENV

      - name: Cache Playwright browsers
        uses: actions/cache@v6
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}

      - name: Install
        run: make install-ui

      - name: Install Playwright (browsers + deps)
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: vpx playwright install --with-deps chromium
        timeout-minutes: 5

      # the UI job saves its task cache on a Depot runner, so forks never see
      # it. Run the same tasks here to seed the GitHub-hosted cache
      - name: Restore vp task cache
        id: vp-cache
        uses: actions/cache/restore@v6
        with:
          path: node_modules/.vite/task-cache
          key: ${{ runner.os }}-${{ runner.arch }}-vp-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-vp-

      - name: Warm vp tasks
        run: make openapi lint-ui test-ui ui

      - name: Save vp task cache
        uses: actions/cache/save@v6
        with:
          path: node_modules/.vite/task-cache
          key: ${{ steps.vp-cache.outputs.cache-primary-key }}