ci.yaml

# SPDX-FileCopyrightText: 2026 Institute for Automation of Complex Power Systems, RWTH Aachen University
# SPDX-License-Identifier: Apache-2.0

name: CI

on:
  push:
    branches: [master]
    tags: ["v*"]
  pull_request:
  pull_request_target:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  setup:
    name: Setup Variables
    # Forks get a read-only GITHUB_TOKEN, so they run via pull_request_target.
    if: >-
      github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
      || github.event_name == 'pull_request'
      && github.event.pull_request.head.repo.full_name == github.repository
      || github.event_name == 'pull_request_target'
      && github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest
    environment: ${{ github.event_name == 'pull_request_target' && 'fork-pr' || 'internal' }}
    outputs:
      docker_image: ${{ steps.image.outputs.docker_image }}
      ref: ${{ steps.ref.outputs.ref }}
      ref_name: ${{ steps.ref.outputs.ref_name }}
    steps:
      - name: Compute image name for the current repository
        id: image
        env:
          OWNER: ${{ github.repository_owner }}
        run: echo "docker_image=ghcr.io/${OWNER,,}/villas/node" >> "$GITHUB_OUTPUT"

      # Under pull_request_target GITHUB_SHA and GITHUB_REF_NAME point at the base branch.
      - name: Resolve the revision under test
        id: ref
        env:
          REF: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
          REF_NAME: ${{ github.event_name == 'pull_request_target' && format('{0}/merge', github.event.pull_request.number) || github.ref_name }}
        run: |
          echo "ref=$REF" >> "$GITHUB_OUTPUT"
          echo "ref_name=$REF_NAME" >> "$GITHUB_OUTPUT"

  checks:
    name: Run Checks
    needs: [setup]
    secrets: inherit
    uses: ./.github/workflows/checks.yaml
    with:
      ref: ${{ needs.setup.outputs.ref }}

  paper:
    name: Build Paper Draft
    needs: [setup]
    secrets: inherit
    uses: ./.github/workflows/paper.yaml
    with:
      ref: ${{ needs.setup.outputs.ref }}

  nix:
    name: Build with Nix
    needs: [setup]
    secrets: inherit
    uses: ./.github/workflows/nix.yaml
    with:
      ref: ${{ needs.setup.outputs.ref }}

  prepare:
    name: Prepare Docker Images
    needs: [setup]
    secrets: inherit
    uses: ./.github/workflows/prepare.yaml
    with:
      docker_image: ${{ needs.setup.outputs.docker_image }}
      ref: ${{ needs.setup.outputs.ref }}
      ref_name: ${{ needs.setup.outputs.ref_name }}

  build:
    name: Build from Source
    needs: [setup, prepare]
    secrets: inherit
    uses: ./.github/workflows/build.yaml
    with:
      docker_image: ${{ needs.setup.outputs.docker_image }}
      ref: ${{ needs.setup.outputs.ref }}

  test:
    name: Run Tests
    needs: [setup, build]
    secrets: inherit
    uses: ./.github/workflows/test.yaml
    with:
      docker_image: ${{ needs.setup.outputs.docker_image }}
      ref: ${{ needs.setup.outputs.ref }}

  packaging-docker:
    name: Build Docker Images
    needs: [setup, test, prepare]
    secrets: inherit
    uses: ./.github/workflows/packaging-docker.yaml
    with:
      docker_image: ${{ needs.setup.outputs.docker_image }}
      ref: ${{ needs.setup.outputs.ref }}
      ref_name: ${{ needs.setup.outputs.ref_name }}

  packaging-nix:
    name: Bundle Artifacts with Nix
    needs: [setup, nix]
    secrets: inherit
    uses: ./.github/workflows/packaging-nix.yaml
    with:
      docker_image: ${{ needs.setup.outputs.docker_image }}
      ref: ${{ needs.setup.outputs.ref }}
      ref_name: ${{ needs.setup.outputs.ref_name }}

  deploy:
    name: Deploy Docker Images
    needs: [setup, packaging-docker]
    secrets: inherit
    uses: ./.github/workflows/deploy.yaml
    with:
      docker_image: ${{ needs.setup.outputs.docker_image }}
      ref: ${{ needs.setup.outputs.ref }}
      ref_name: ${{ needs.setup.outputs.ref_name }}
      is_version_tag: ${{ startsWith(github.ref, 'refs/tags/v') }}

  deploy-nix:
    name: Deploy Nix Artifacts
    needs: [setup, packaging-nix]
    secrets: inherit
    uses: ./.github/workflows/deploy-nix.yaml
    with:
      docker_image: ${{ needs.setup.outputs.docker_image }}
      ref_name: ${{ needs.setup.outputs.ref_name }}
      is_version_tag: ${{ startsWith(github.ref, 'refs/tags/v') }}

  all:
    # Only the real run may claim the required check name. Mirrors setup.
    name: >-
      ${{ (github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
      || github.event_name == 'pull_request'
      && github.event.pull_request.head.repo.full_name == github.repository
      || github.event_name == 'pull_request_target'
      && github.event.pull_request.head.repo.full_name != github.repository)
      && 'All prerequisites completed' || 'CI not applicable' }}
    # A skipped required check counts as passing.
    if: always()
    needs:
      - setup
      - checks
      - paper
      - nix
      - prepare
      - build
      - test
      - packaging-docker
      - packaging-nix
      - deploy
      - deploy-nix
    runs-on: ubuntu-latest
    steps:
      - name: Dependency barrier
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: exit 1