ci.yml

---
name: CI
on:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"
  pull_request:

permissions:
  contents: read

env:
  IMAGE_NAME: trungdlp/podium
  GHCR_IMAGE_NAME: ghcr.io/teneficgames/podium

jobs:
  verify:
    name: Verify modules and generated code
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache-dependency-path: |
            go.sum
            leaderboard/go.sum
            proto/go.sum
            client/go.sum
      - name: Download and verify dependencies
        run: |
          make setup
          go mod verify
          (cd leaderboard && go mod verify)
          (cd proto && go mod verify)
          (cd client && go mod verify)
      - name: Build
        run: make build
      - name: Verify Protobuf schemas and generated code
        run: |
          make proto-check
          make proto
          git diff --exit-code

  unit-tests:
    name: Unit tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache-dependency-path: |
            go.sum
            leaderboard/go.sum
            proto/go.sum
            client/go.sum
      - name: Test
        run: make test-unit

  integration-podium:
    name: Integration tests (server)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache-dependency-path: |
            go.sum
            leaderboard/go.sum
            proto/go.sum
      - name: Test
        run: make test-podium
      - name: Save test results and coverage
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: integration-podium
          path: |
            podium.coverprofile
            _build/test-results/podium.xml

  integration-leaderboard:
    name: Integration tests (leaderboard)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: leaderboard/go.mod
          cache-dependency-path: leaderboard/go.sum
      - name: Test
        run: make test-leaderboard
      - name: Save test results and coverage
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: integration-leaderboard
          path: |
            leaderboard/leaderboard.coverprofile
            _build/test-results/leaderboard.xml

  redis-compatibility:
    name: Redis compatibility (${{ matrix.redis }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        redis:
          - "6.2"
          - "7.2"
          - "7.4"
          - "8.2"
    services:
      redis:
        image: redis:${{ matrix.redis }}-alpine
        options: '--health-cmd "redis-cli ping" --health-interval 1s --health-timeout 3s --health-retries 10'
        ports:
          - '6379:6379'
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: leaderboard/go.mod
          cache-dependency-path: leaderboard/go.sum
      - name: Test
        env:
          PODIUM_TEST_REDIS_VERSION: ${{ matrix.redis }}
        run: make test-redis-compat

  redis-cluster:
    name: Redis Cluster integration
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Generate Docker Compose configuration
        run: make deployments/docker-compose.yaml
      - name: Start Redis Cluster
        run: make compose-up-dependencies
      - name: Test
        run: >-
          docker compose -f deployments/docker-compose.yaml run --rm --no-deps
          --entrypoint make
          -e PODIUM_REDIS_ADDRS=redis-node-0:6379
          podium-test test-redis-cluster
      - name: Show Redis Cluster logs
        if: failure()
        run: docker compose -f deployments/docker-compose.yaml logs
      - name: Stop Redis Cluster
        if: always()
        run: make compose-down

  integration-client:
    name: Integration tests (client)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: client/go.mod
          cache-dependency-path: |
            proto/go.sum
            client/go.sum
      - name: Test
        run: make test-client
      - name: Save test results and coverage
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: integration-client
          path: |
            client/client.coverprofile
            _build/test-results/client.xml

  coverage:
    name: Integration coverage
    needs:
      - integration-podium
      - integration-leaderboard
      - integration-client
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
      - name: Download server results
        uses: actions/download-artifact@v8
        with:
          name: integration-podium
          path: .
      - name: Download leaderboard results
        uses: actions/download-artifact@v8
        with:
          name: integration-leaderboard
          path: .
      - name: Download client results
        uses: actions/download-artifact@v8
        with:
          name: integration-client
          path: .
      - name: Upload test results to Codecov
        uses: codecov/codecov-action@v7
        with:
          disable_search: true
          fail_ci_if_error: true
          files: ./_build/test-results/*.xml
          report_type: test_results
          use_oidc: true
      - name: Combine and check package coverage
        run: make coverage-check
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          disable_search: true
          fail_ci_if_error: true
          files: ./_build/test-coverage-all.out
          use_oidc: true

  golangci-lint:
    name: golangci-lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache-dependency-path: |
            go.sum
            leaderboard/go.sum
            proto/go.sum
            client/go.sum
      - name: Install golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.12.2
          install-only: true
      - name: Lint
        run: make lint

  govulncheck:
    name: govulncheck (${{ matrix.name }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: server
            workdir: .
            go_sum: go.sum
          - name: leaderboard
            workdir: leaderboard
            go_sum: leaderboard/go.sum
          - name: proto
            workdir: proto
            go_sum: proto/go.sum
          - name: client
            workdir: client
            go_sum: client/go.sum
    steps:
      - uses: actions/checkout@v7
      - name: Scan
        uses: golang/govulncheck-action@v1
        with:
          cache-dependency-path: ${{ matrix.go_sum }}
          go-package: ./...
          go-version-input: 1.26.6
          repo-checkout: false
          work-dir: ${{ matrix.workdir }}

  client-compatibility:
    name: Client compatibility (Go 1.25)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: 1.25.12
          cache-dependency-path: |
            proto/go.sum
            client/go.sum
      - name: Test proto and client
        env:
          GOTOOLCHAIN: local
        run: |
          (cd proto && go test ./...)
          (cd client && go test ./...)

  helm:
    name: Helm chart
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up Helm
        uses: azure/setup-helm@v5
        with:
          version: v3.19.0
      - name: Install helm-unittest
        run: helm plugin install https://github.com/helm-unittest/helm-unittest.git --version 1.0.1
      - name: Test chart
        run: make test-helm

  docker:
    name: Build and publish image
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
    permissions:
      contents: read
      packages: write
    needs:
      - verify
      - unit-tests
      - coverage
      - redis-compatibility
      - redis-cluster
      - golangci-lint
      - govulncheck
      - client-compatibility
      - helm
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to Docker Hub
        if: github.ref == 'refs/heads/main'
        uses: docker/login-action@v4
        with:
          username: trungdlp
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GHCR
        if: github.ref == 'refs/heads/main'
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Validate image build
        if: github.event_name == 'pull_request'
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./build/Dockerfile
          platforms: linux/amd64
          outputs: type=cacheonly
          cache-from: type=gha
          cache-to: type=gha,mode=min

      - name: Build and push image
        if: github.ref == 'refs/heads/main'
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./build/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ env.IMAGE_NAME }}:edge
            ${{ env.GHCR_IMAGE_NAME }}:edge
          build-args: |
            VERSION=edge
          cache-from: type=gha
          cache-to: type=gha,mode=max

  release:
    name: Publish version tags
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
      packages: write
    needs:
      - verify
      - unit-tests
      - coverage
      - redis-compatibility
      - redis-cluster
      - golangci-lint
      - govulncheck
      - client-compatibility
      - helm
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Generate release metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.IMAGE_NAME }}
            ${{ env.GHCR_IMAGE_NAME }}
          flavor: latest=true
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: trungdlp
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and publish release image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./build/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          build-args: |
            VERSION=${{ steps.meta.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Verify release version
        env:
          RELEASE_VERSION: ${{ steps.meta.outputs.version }}
        run: |
          docker_hub_output="$(docker run --rm --entrypoint /podium "$IMAGE_NAME:$RELEASE_VERSION" version)"
          test "$docker_hub_output" = "Podium v$RELEASE_VERSION"
          ghcr_output="$(docker run --rm --entrypoint /podium "$GHCR_IMAGE_NAME:$RELEASE_VERSION" version)"
          test "$ghcr_output" = "Podium v$RELEASE_VERSION"