ci.yml

name: CI

on:
  push:
    branches: [ main, master, dev/* ]
  pull_request:
    branches: [ main, master ]

permissions:
  contents: read
  security-events: write

jobs:
  lint:
    name: Code Quality
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: '1.24'

      - name: Cache Go modules
        uses: actions/cache@v6
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Download dependencies
        run: make deps

      - name: Run code quality checks
        run: make lint

  test:
    name: Test
    strategy:
      matrix:
        os: [ ubuntu-latest, macos-latest ]
        go-version: [ '1.24' ]
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: ${{ matrix.go-version }}

      - name: Cache Go modules
        uses: actions/cache@v6
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-${{ matrix.go-version }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.go-version }}-go-

      - name: Download dependencies
        run: make deps

      - name: Run unit tests
        run: make test-unit

      - name: Run race detector tests
        run: make test-race

  integration-test:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: [ lint ]

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: '1.24'

      - name: Cache Go modules
        uses: actions/cache@v6
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Download dependencies
        run: make deps

      - name: Run integration tests
        run: make test-integration

  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    needs: [ test ]

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: '1.24'

      - name: Cache Go modules
        uses: actions/cache@v6
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Download dependencies
        run: make deps

      - name: Run all tests with coverage
        run: make test-coverage

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          flags: unittests
          name: codecov-umbrella

      - name: Upload coverage reports
        uses: actions/upload-artifact@v7
        with:
          name: coverage-reports
          path: coverage/

  build:
    name: Build
    strategy:
      matrix:
        os: [ ubuntu-latest, macos-latest ]
    runs-on: ${{ matrix.os }}
    needs: [ test, integration-test ]

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: '1.24'

      - name: Cache Go modules
        uses: actions/cache@v6
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Download dependencies
        run: make deps

      - name: Build binary
        run: make build

      - name: Test binary help
        shell: bash
        run: |
          ./build/xenforo-to-gh-discussions --help

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: binary-${{ runner.os }}
          path: build/

  vulnerability-scan:
    name: Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: '1.24'

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

  docker-test:
    name: Docker Build Test
    runs-on: ubuntu-latest
    needs: [ build ]

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          load: true
          tags: xenforo-to-gh-discussions:test
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=test
            BUILD_TIME=${{ github.event.head_commit.timestamp }}
            COMMIT_HASH=${{ github.sha }}

      - name: Test Docker image
        run: |
          docker run --rm xenforo-to-gh-discussions:test --help