name: CI

on:
  push:
    branches: [master]
  pull_request:
  workflow_dispatch:

jobs:
  test:
    name: Lint, PostgreSQL tests, and package
    runs-on: python-ci
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: ci-test-only
          POSTGRES_DB: car_tracker_test
        options: >-
          --health-cmd "pg_isready -U postgres -d car_tracker_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 12
    env:
      # Disposable service only. Never replace this with the homelab database URL.
      TEST_DATABASE_URL: postgresql://postgres:ci-test-only@postgres:5432/car_tracker_test
      UV_NO_PROGRESS: "1"
    steps:
      - name: Check out repository
        uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: https://github.com/astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
        with:
          version: "0.9.3"
          python-version: "3.13"
          enable-cache: false
          add-problem-matchers: false
          # Gitea's job token must not be sent to the GitHub release API.
          github-token: ""

      - name: Install locked dependencies
        run: uv sync --locked --dev

      - name: Lint
        run: uv run --locked ruff check src tests ops/gitops ops/ssh

      - name: Run offline and PostgreSQL integration tests
        run: timeout 10m uv run --locked python -m unittest discover -s tests -v

      - name: Build package
        run: uv build --no-sources

      - name: Check installed wheel and packaged migrations
        run: |
          uv venv /tmp/car-tracker-wheel
          uv pip install --python /tmp/car-tracker-wheel/bin/python --no-deps dist/*.whl
          /tmp/car-tracker-wheel/bin/python -c 'from importlib.resources import files; assert files("car_tracker").joinpath("migrations", "001_silver.sql").is_file(), "SQL migration missing from wheel"'

  publish:
    name: Build and publish tested image
    needs: test
    # PRs and the gitops state branch must never publish images.
    if: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    runs-on: python-ci
    env:
      REGISTRY: gitea.vandeplanque.com
      IMAGE_REPOSITORY: tonio/car-tracker
      IMAGE_SHA: ${{ github.sha }}
      DOCKER_CONFIG: /tmp/car-tracker-docker-auth
    steps:
      - name: Check out tested revision
        uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
          ref: ${{ github.sha }}

      - name: Install Docker client
        run: sh ops/ci/install-docker-cli.sh

      - name: Authenticate to Gitea registry
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          test -n "$REGISTRY_USER" && test -n "$REGISTRY_TOKEN"
          umask 077
          mkdir -p "$DOCKER_CONFIG"
          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" --username "$REGISTRY_USER" --password-stdin

      - name: Build and publish SHA-tagged image
        run: |
          set -eu
          image="$REGISTRY/$IMAGE_REPOSITORY:$IMAGE_SHA"
          # Do not overwrite a previously published SHA tag on a workflow rerun.
          # Digest pinning, not this mutable registry tag, identifies a run image.
          if docker manifest inspect "$image" >/dev/null 2>&1; then
            echo "Image already published: $image"
            exit 0
          fi
          timeout 35m docker build --label "org.opencontainers.image.revision=$IMAGE_SHA" -t "$image" .
          docker run --rm --network none "$image" car-tracker-db --help
          timeout 5m docker push "$image"
          echo "Published: $image"

      - name: Remove job registry credentials
        if: always()
        run: rm -rf /tmp/car-tracker-docker-auth