name: ci

on:
  push:
    branches: [main]
    # Release tags run the whole workflow, not only the image job that gates on it. A tag
    # is the one build nobody is watching, so it is the last place to take the tests on
    # trust.
    tags: ['v*']
  pull_request:
    branches: [main]

# Actions are pinned to commit SHAs, not tags: a tag can be moved to point at new code,
# which would let a compromised action run with this workflow's permissions.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  CI: true

jobs:
  build:
    name: build and test
    runs-on: [linux]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json
          cache: true
          cache-dependency-path: '**/packages.lock.json'

      # Locked mode fails if packages.lock.json does not match the project files, so a
      # dependency cannot change without the lock file change being reviewed.
      - name: restore
        run: dotnet restore DodoSSH.slnx --locked-mode

      - name: verify formatting
        run: dotnet format DodoSSH.slnx --verify-no-changes --no-restore

      - name: build
        run: dotnet build DodoSSH.slnx --no-restore --configuration Release

      - name: test
        run: dotnet test DodoSSH.slnx --no-build --configuration Release

      # This includes the end-to-end suite, which starts PostgreSQL, Keycloak and an OpenSSH
      # server through Testcontainers and runs the API as a child process — so it needs a
      # Docker daemon and gets one here. That is why the tests run on ubuntu rather than
      # macOS, whose runners have no daemon at all. Expect the Keycloak image pull to
      # dominate a cold run.
  android:
    name: android head
    runs-on: [linux]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json
          cache: true
          cache-dependency-path: '**/packages.lock.json'

      # A job of its own, because DodoSSH.Client.Android is deliberately not in DodoSSH.slnx.
      # Adding it there would make the android workload and a full Android SDK a prerequisite of
      # `dotnet build DodoSSH.slnx` for everyone — including the build job above, which needs
      # neither and would grow several minutes for a head it does not compile.
      #
      # The cost of keeping it out is that nothing in the main job would notice this head
      # breaking, which for a project sharing view models with the desktop one is a matter of
      # when rather than whether. This job is that notice.
      - name: install the android workload
        run: dotnet workload install android --skip-sign-check

      # API 36 specifically, and it is not a preference: Avalonia.Controls.WebView ships only a
      # net10.0-android36.0 assembly, so anything lower cannot resolve it and the head loses its
      # terminal. See docs/android-port.md.
      - name: install the android sdk platform
        run: |
          echo "y" | "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" \
            "platforms;android-36" "build-tools;36.0.0"

      - name: restore
        run: dotnet restore src/DodoSSH.Client.Android/DodoSSH.Client.Android.csproj --locked-mode

      - name: build
        run: >
          dotnet build src/DodoSSH.Client.Android/DodoSSH.Client.Android.csproj
          --no-restore --configuration Release

      # Packaging rather than only compiling, because the two failures this head is most exposed to
      # are both link-time: a native library with no android ABI, and a managed assembly that
      # resolves for net10.0 but has nothing to dex. Neither shows up in a compile.
      - name: package
        run: >
          dotnet build src/DodoSSH.Client.Android/DodoSSH.Client.Android.csproj
          --no-restore --configuration Release
          -t:SignAndroidPackage -p:RuntimeIdentifier=android-arm64

  image:
    name: api image
    # Gated on the tests rather than parallel with them, which costs a few minutes of wall
    # clock on every main commit and buys the thing worth having: no image reaches the
    # registry from a commit whose tests were red. An image is not a build artefact anyone
    # inspects — it is the thing that gets deployed.
    needs: [build]
    runs-on: [linux]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # No docker/* actions here, deliberately. The build is single-architecture, so it
      # needs the daemon this runner already has for the Testcontainers suites and nothing
      # else — no buildx plugin, no QEMU, and no third-party action whose SHA has to be
      # audited and re-pinned. Adding linux/arm64 later is where that trade changes.
      - name: work out the tags
        id: tags
        env:
          REGISTRY: registry-docker.dodotech.cloud
          IMAGE: dodotech/dodossh-api
        run: |
          set -euo pipefail
          repo="$REGISTRY/$IMAGE"
          short="$(git rev-parse --short HEAD)"

          # sha- prefixed, because a bare hex tag is ambiguous with a digest to both a human
          # and a fair amount of tooling. This one is on every build and never moves, which
          # makes it the only tag safe to pin a deployment to.
          tags="$repo:sha-$short"
          version="$short"

          case "$GITHUB_REF" in
            refs/tags/v*)
              v="${GITHUB_REF#refs/tags/v}"
              version="$v"
              tags="$tags $repo:$v"
              # The moving major.minor tag and :latest, but only for a release proper.
              # v1.3.0-rc1 sorts after v1.2.9 and would otherwise take :latest with it,
              # which is how a release candidate ends up on somebody's server.
              case "$v" in
                *-*) ;;
                *)
                  tags="$tags $repo:${v%.*}"
                  tags="$tags $repo:latest"
                  ;;
              esac
              ;;
            refs/heads/main)
              tags="$tags $repo:main"
              version="main-$short"
              ;;
          esac

          echo "tags=$tags" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
          echo "Tagging: $tags"

      # Every value from a step output or the event goes through env rather than being
      # interpolated into the script text. A git tag may contain a semicolon, and
      # `${{ }}` is a textual substitution performed before the shell ever sees the line —
      # so an interpolated tag name is a command the workflow agreed to run.
      - name: build the image
        env:
          TAGS: ${{ steps.tags.outputs.tags }}
          VERSION: ${{ steps.tags.outputs.version }}
          REVISION: ${{ github.sha }}
          CREATED: ${{ steps.tags.outputs.created }}
        run: |
          set -euo pipefail
          args=()
          for tag in $TAGS; do
            args+=(--tag "$tag")
          done
          # --pull rather than whatever the runner happens to have cached: the base images
          # are floating tags, and a runner that has held aspnet:10.0-noble-chiseled for a
          # month is a month of unapplied CVE fixes shipping in every image built on it.
          docker build \
            --pull \
            --file src/DodoSSH.Api/Dockerfile \
            --build-arg "VERSION=$VERSION" \
            --build-arg "REVISION=$REVISION" \
            --build-arg "CREATED=$CREATED" \
            "${args[@]}" \
            .

      # Everything above runs on a pull request too. Building a fork's Dockerfile is safe —
      # nothing is pushed and no credential is in scope — and it means a change that breaks
      # the image fails on the PR rather than on main. Only these last two steps are held
      # back, and the condition is on the event rather than on the branch so that a PR
      # targeting main cannot reach them.
      - name: log in to the registry
        if: github.event_name != 'pull_request'
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          printf '%s' "$REGISTRY_PASSWORD" \
            | docker login registry-docker.dodotech.cloud \
                --username "$REGISTRY_USERNAME" --password-stdin

      - name: push
        if: github.event_name != 'pull_request'
        env:
          TAGS: ${{ steps.tags.outputs.tags }}
        run: |
          set -euo pipefail
          for tag in $TAGS; do
            docker push "$tag"
          done

      # The daemon is shared with every other job on this runner, and a credential left in
      # ~/.docker/config.json outlives the job that created it. always(), so a failed push
      # does not leave it behind.
      - name: log out
        if: always() && github.event_name != 'pull_request'
        run: docker logout registry-docker.dodotech.cloud