ci.yml

name: ci
on:
  push:
    branches: ["main"]
    tags:
      - "*"
  pull_request:
    branches: ["main"]
jobs:
  tests:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16.4-alpine
        ports:
          - "5432:5432"
        env:
          POSTGRES_DB: opengas_test
          POSTGRES_USER: opengas
          POSTGRES_PASSWORD: opengas
    env:
      RAILS_ENV: test
      DATABASE_URL: "postgres://opengas:opengas@localhost:5432/opengas_test"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Install Ruby and gems
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3.4
          bundler-cache: true
      - name: Set up database schema
        run: bin/rails db:schema:load
      - name: Run tests
        run: bin/rails test

  system-tests:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16.4-alpine
        ports:
          - "5432:5432"
        env:
          POSTGRES_DB: opengas_test
          POSTGRES_USER: opengas
          POSTGRES_PASSWORD: opengas
    env:
      RAILS_ENV: test
      DATABASE_URL: "postgres://opengas:opengas@localhost:5432/opengas_test"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Install Ruby and gems
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3.4
          bundler-cache: true
      - name: Set up database schema
        run: bin/rails db:schema:load
      - name: Run tests
        run: bin/rails test:system

  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Install Ruby and gems
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3.4
          bundler-cache: true
      - name: Security audit dependencies
        run: bundle exec bundler-audit --update
      - name: Security audit
        run: bundle exec bundle audit
      - name: Security audit application code
        run: bin/brakeman -q -w2
      - name: Lint Ruby files
        run: bin/rubocop --parallel

  build:
    needs: [tests, system-tests, lint]
    if: ${{ github.ref_type == 'tag' }}
    runs-on: ubuntu-latest

    env:
      DOCKER_BUILDKIT: 1

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3.4
          bundler-cache: true
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: baldarn
          password: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
      - name: Build image
        uses: docker/build-push-action@v6
        with:
          context: .
          builder: ${{ steps.buildx.outputs.name }}
          push: true
          labels: |
            "service=open-gas"
          tags: |
            baldarn/open-gas:latest
            baldarn/open-gas:${{ github.ref_name }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    needs: [build]
    runs-on: ubuntu-latest
    concurrency:
      group: deploy
      cancel-in-progress: true

    env:
      RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
      KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
      SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
      APP_VERSION: ${{ github.ref_name }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3.4
          bundler-cache: true
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
      - name: Env push command
        run: bundle exec kamal env push
      - name: Deploy command
        run: bundle exec kamal deploy --skip-push --version ${{ github.ref_name }}