ci.yml

name: ci

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:

# Opt every JS-based action into Node 24 ahead of GitHub's 2026-09-16
# Node 20 EOL. The handful of actions we use (checkout@v4, setup-go@v5,
# golangci-lint-action@v7, setup-node@v4, pnpm/action-setup@v4) still
# ship as Node 20 bundles; this flag keeps them on a supported runtime
# without forcing a major-version churn through each action. Remove
# once Node 24 becomes the runner default.
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      - run: go vet ./...
      - run: go test -race -count=1 ./...

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      # golangci-lint-action v7 is the first major that parses the v2
      # config schema declared in .golangci.yml. v6 + v1.x silently
      # fails on `version: "2"`.
      - uses: golangci/golangci-lint-action@v7
        with:
          version: v2.0

  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      - run: go build -o /tmp/api-log ./cmd/api-log

  integration:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run integration test (dev-stack)
        run: bash tests/integration/run.sh

  # Build + push the api-log image on a version tag. The image is the
  # same Dockerfile the dev-stack and demo composes build from; tags map
  # 1:1 with git tags.
  release:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    needs: [test, lint, build, integration]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest
      - uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            VERSION=${{ github.ref_name }}

  # Cross-compile native binaries (linux + darwin + windows × amd64 + arm64,
  # minus windows/arm64) and attach archives + checksums to the GitHub
  # release. See .goreleaser.yml. Runs in parallel with `release` (Docker
  # / GHCR) above; both gate on the same test/lint/build/integration set.
  release-binaries:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    needs: [test, lint, build, integration]
    permissions:
      contents: write    # release upload
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # GoReleaser needs the tag history
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      # Build the release body from CHANGELOG.md so the GitHub release page
      # carries the same content as the file readers/CI have always read.
      # If no matching section exists, fall back to the tag annotation so the
      # release body is never empty (was the v0.1.1/v0.1.2 retro-fix trigger).
      - name: Build release notes from CHANGELOG
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          awk -v v="$version" '
            BEGIN { hit = 0 }
            /^## \[/ {
              if (hit) { exit }
              if ($0 ~ "^## \\[" v "\\]") { hit = 1; next }
            }
            hit { print }
          ' CHANGELOG.md > /tmp/release-notes.md
          if [ ! -s /tmp/release-notes.md ]; then
            echo "WARNING: no [$version] CHANGELOG section; using tag annotation as body" >&2
            git tag -l --format='%(contents)' "$GITHUB_REF_NAME" > /tmp/release-notes.md
          fi
          echo "----- /tmp/release-notes.md preview -----"
          head -30 /tmp/release-notes.md
      - uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --release-notes /tmp/release-notes.md
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}