ci.yaml

name: CI
run-name: ${{ (github.event_name == 'workflow_dispatch' && format('manual{0} {1}', ':', github.sha)) || '' }}
on:
  workflow_dispatch:
  push:
    branches: [main]
    paths-ignore: [".vscode/**", "docs/**", "**/README.md", "LICENSE.md", ".github/**.md"]
  merge_group:
  pull_request:
    branches: [main]
    # Note - Ignore is not commit specific, if any file in the PR is outside of this list, workflow will run, see https://github.com/orgs/community/discussions/25161#discussioncomment-3246673
    paths-ignore: [".vscode/**", "docs/**", "**/README.md", "LICENSE.md", ".github/**.md"]

# Automatically cancel in-progress actions on the same branch except for main
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  build:
    name: Build and test
    runs-on: ubuntu-latest
    outputs:
      gitsha: ${{ steps.setDockerSHAs.outputs.gitsha }}
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # We need to fetch all branches and commits so that Nx affected has a base to compare against.
          fetch-depth: 0

      - name: Derive appropriate SHAs for base and head for `nx affected` commands
        id: setNxSHAs
        uses: nrwl/nx-set-shas@v4

      - name: Ensure tracking against main
        run: git branch --track main origin/main
        if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}

      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version-file: ".nvmrc"
          cache: "npm"

      - name: Setup go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.work
          cache-dependency-path: |
            apps/*/go.sum
            go.work.sum

      - name: Install NPM dependencies
        run: npm ci

      - name: Build and test
        env:
          UESIO_DEV: "true"
        run: npx nx affected -t build test --configuration=ci --parallel=5

      - name: Prep for docker image
        id: setDockerSHAs
        env:
          UESIO_DEV: "true"
        run: |
          # We lint/test/build affected but in order to build image, we need to ensure everything
          # is built.  Build anything that hasn't been built yet (takes advantage of nx cache
          # for anything already built from above)
          npx nx run-many -t build --all
          echo "GITSHA=`echo $(echo ${{ steps.setNxSHAs.outputs.head }} | cut -c1-8).${{ github.run_number }}.${{ github.run_attempt }}`" >> "$GITHUB_OUTPUT"

      - name: Set up docker buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          tags: |
            type=raw,value=${{ steps.setDockerSHAs.outputs.gitsha }}
            type=ref,event=branch
            type=ref,event=pr
          labels: |
            org.opencontainers.image.version=${{ steps.setDockerSHAs.outputs.gitsha }}

      - name: Cache for docker
        id: cache
        uses: actions/cache@v4
        with:
          path: |
            go-build-cache
          key: ${{ runner.os }}-docker-cache-${{ hashFiles('apps/**/go.sum', 'go.work.sum') }}

      - name: Inject cache into docker
        uses: reproducible-containers/buildkit-cache-dance@v3
        with:
          cache-map: |
            {
              "go-build-cache": "/root/.cache/go-build"
            }
          skip-extraction: ${{ steps.cache.outputs.cache-hit }}

      - name: Build and export to docker
        uses: docker/build-push-action@v6
        with:
          context: .
          cache-from: type=gha
          cache-to: type=gha,mode=max
          load: true
          file: ./apps/platform/Dockerfile
          build-args: |
            GITSHA=${{ steps.setDockerSHAs.outputs.gitsha }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: |
            type=docker
            type=docker,dest=${{ runner.temp }}/uesio-image.tar

      - name: Upload docker image artifact
        uses: actions/upload-artifact@v4
        with:
          name: uesio-image
          path: ${{ runner.temp }}/uesio-image.tar

      - name: Integration and e2e tests
        env:
          GITSHA: ${{ steps.setDockerSHAs.outputs.gitsha }}
        run: |
          ./scripts/seed-etc-hosts.sh

          # Start up the Uesio app, and dependencies, in Docker
          # then run all Integration and E2E tests against the app
          npm run tests-ci

  check:
    name: Check format and lint
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # We need to fetch all branches and commits so that Nx affected has a base to compare against.
          fetch-depth: 0

      - name: Derive appropriate SHAs for base and head for `nx affected` commands
        id: setNxSHAs
        uses: nrwl/nx-set-shas@v4

      - name: Ensure tracking against main
        run: git branch --track main origin/main
        if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}

      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version-file: ".nvmrc"
          cache: "npm"

      - name: Setup go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.work
          cache-dependency-path: |
            apps/*/go.sum
            go.work.sum

      - name: Install NPM dependencies
        run: npm ci

      - name: Check formatting
        env:
          UESIO_DEV: "true"
        run: npx nx format:check --verbose

      - name: Lint
        env:
          UESIO_DEV: "true"
        run: npx nx affected -t lint --configuration=ci --parallel=5

  typecheck:
    name: Check types
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # We need to fetch all branches and commits so that Nx affected has a base to compare against.
          fetch-depth: 0

      - name: Derive appropriate SHAs for base and head for `nx affected` commands
        id: setNxSHAs
        uses: nrwl/nx-set-shas@v4

      - name: Ensure tracking against main
        run: git branch --track main origin/main
        if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}

      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version-file: ".nvmrc"
          cache: "npm"

      - name: Install NPM dependencies
        run: npm ci

      - name: Typecheck
        env:
          UESIO_DEV: "true"
        run: npx nx affected -t typecheck --configuration=ci --parallel=5

  update-dev-branch:
    name: Update Dev environment to latest image
    if: github.ref_name == 'main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest
    needs: [build, check, typecheck]
    timeout-minutes: 3
    permissions:
      id-token: write # This is required for requesting a OIDC JWT for AWS
    steps:
      - name: Checkout TheCloudMasters/uesio-infra
        uses: actions/checkout@v4
        with:
          repository: TheCloudMasters/uesio-infra
          token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains your personal Github access token
          fetch-depth: 1

      - name: Download docker image artifact
        uses: actions/download-artifact@v4
        with:
          name: uesio-image
          path: ${{ runner.temp }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ECR_ROLE_DEV }}
          role-session-name: ecrpush
          aws-region: ${{ secrets.AWS_REGION_DEV }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Push image to ECR
        id: pushImageToECR
        env:
          LOCAL_IMAGE_TAG: ${{ needs.build.outputs.gitsha }}
          REGISTRY_IMAGE_TAG: ${{ steps.login-ecr.outputs.registry }}/uesio:${{ needs.build.outputs.gitsha }}
        run: |
          echo "LOCAL_IMAGE_TAG=${LOCAL_IMAGE_TAG}" >> "$GITHUB_OUTPUT"
          echo "REGISTRY_IMAGE_TAG=${REGISTRY_IMAGE_TAG}" >> "$GITHUB_OUTPUT"
          docker load --input ${{ runner.temp }}/uesio-image.tar
          docker tag $LOCAL_IMAGE_TAG $REGISTRY_IMAGE_TAG
          docker image push $REGISTRY_IMAGE_TAG

      - name: Update docker container image tag for dev
        env:
          LOCAL_IMAGE_TAG: ${{ steps.pushImageToECR.outputs.LOCAL_IMAGE_TAG }}
          REGISTRY_IMAGE_TAG: ${{ steps.pushImageToECR.outputs.REGISTRY_IMAGE_TAG }}
          appTaskDefPath: ./aws/dev/ecs/task_definitions/uesio_web.json
          workerTaskDefPath: ./aws/dev/ecs/task_definitions/uesio_worker.json
        run: |
          echo "Docker image SHA updated to $LOCAL_IMAGE_TAG"
          jq --arg img "$REGISTRY_IMAGE_TAG" '.containerDefinitions[0].image = $img' $appTaskDefPath > tmp1.json
          jq --arg img "$REGISTRY_IMAGE_TAG" '.containerDefinitions[0].image = $img' $workerTaskDefPath > tmp2.json
          mv tmp1.json $appTaskDefPath
          mv tmp2.json $workerTaskDefPath
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add $appTaskDefPath $workerTaskDefPath
          git commit -m "ci: Auto-update dev image to $LOCAL_IMAGE_TAG"
          git push