main.yml

name: CI test and build

on:
  push:
  pull_request:
    types: [opened]
    branches:
      - main

# env settings for github releases
# docker image push
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  dependencies:
    runs-on: ubuntu-latest
    steps:
      - name: Cancel previous runs
        uses: styfle/cancel-workflow-action@0.11.0
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v3.6.0
        with:
          ref: ${{ github.event.client_payload.branch }}
      - name: Parse .tool-versions
        id: tool-versions
        uses: paulo-ferraz-oliveira/parse-tool-versions@v1
      - name: Sets up an Erlang/OTP environment
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Retrieve cached dependencies
        uses: actions/cache@v3.3.1
        id: mix-cache
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-${{ steps.tool-versions.outputs.erlang }}-${{ steps.tool-versions.outputs.elixir }}-${{ hashFiles('mix.lock') }}
      - name: Install dependencies
        if: steps.mix-cache.outputs.cache-hit != 'true'
        run: |
          mix local.rebar --force
          mix local.hex --force
          mix deps.get
          mix deps.compile
  static_code_analysis:
    needs: dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Cancel previous runs
        uses: styfle/cancel-workflow-action@0.11.0
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v3.6.0
        with:
          ref: ${{ github.event.client_payload.branch }}
      - name: Parse .tool-versions
        id: tool-versions
        uses: paulo-ferraz-oliveira/parse-tool-versions@v1
      - name: Sets up an Erlang/OTP environment
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Retrieve cached dependencies
        uses: actions/cache@v3.3.1
        id: mix-cache
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-${{ steps.tool-versions.outputs.erlang }}-${{ steps.tool-versions.outputs.elixir }}-${{ hashFiles('mix.lock') }}
      - run: mix format --check-formatted
      - run: mix credo || ret=$?; if [ $ret != 2 ]; then exit $ret; fi
      # PLT cache for dialyzer
      # Don't cache PLTs based on mix.lock hash, as Dialyzer can incrementally update even old ones
      # Cache key based on Elixir & Erlang version (also useful when running in matrix)
      - name: Restore PLT cache
        uses: actions/cache/restore@v3
        id: plt_cache
        with:
          key: |
            ${{ runner.os }}-${{ steps.tool-versions.outputs.erlang }}-${{ steps.tool-versions.outputs.elixir }}-plt
          restore-keys: |
            ${{ runner.os }}-${{ steps.tool-versions.outputs.erlang }}-${{ steps.tool-versions.outputs.elixir }}-plt
          path: |
            priv/plts
      # Create PLTs if no cache was found
      - name: Create PLTs
        if: steps.plt_cache.outputs.cache-hit != 'true'
        run: mix dialyzer --plt
      # By default, the GitHub Cache action will only save the cache if all steps in the job succeed,
      # so we separate the cache restore and save steps in case running dialyzer fails.
      - name: Save PLT cache
        uses: actions/cache/save@v3
        if: steps.plt_cache.outputs.cache-hit != 'true'
        id: plt_cache_save
        with:
          key: |
            ${{ runner.os }}-${{ steps.tool-versions.outputs.erlang }}-${{ steps.tool-versions.outputs.elixir }}-plt
          path: |
            priv/plts
      - name: Run dialyzer
        run: mix dialyzer --format github
  test:
    needs: dependencies
    name: Run tests
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:14.2
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: epochtalk_server_test
        ports:
          - 5432:5432
        # Set health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        ports:
          - 6379:6379
        image: redis:7.0.4
        # Set health checks to wait until redis has started
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Cancel previous runs
        uses: styfle/cancel-workflow-action@0.11.0
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v3.6.0
        with:
          ref: ${{ github.event.client_payload.branch }}
      - name: Parse .tool-versions
        id: tool-versions
        uses: paulo-ferraz-oliveira/parse-tool-versions@v1
      - name: Sets up an Erlang/OTP environment
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Retrieve cached dependencies
        uses: actions/cache@v3.3.1
        id: mix-cache
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-${{ steps.tool-versions.outputs.erlang }}-${{ steps.tool-versions.outputs.elixir }}-${{ hashFiles('mix.lock') }}
      - name: Run tests
        run: mix test
        env:
          AWS_REGION: ${{ secrets.AWS_REGION }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  # release:
  #   needs: [test, static_code_analysis]
  #   name: Release
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Checkout
  #       uses: actions/checkout@v3.6.0
  #     - name: Semantic Release
  #       uses: cycjimmy/semantic-release-action@v4.0.0
  #       with:
  #         branches: |
  #           [
  #             'main',
  #             {
  #               name: 'prerelease',
  #               prerelease: true
  #             },
  #           ]
  #       env:
  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  # elixir_docs:
  #   if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/elixir-docs' }}
  #   name: Generate project documentation
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Checkout
  #       uses: actions/checkout@v3.6.0
  #     - name: Sets up an Erlang/OTP environment
  #       uses: erlef/setup-beam@v1
  #       with:
  #         version-file: .tool-versions
  #         version-type: strict
  #     - name: Build docs
  #       uses: lee-dohm/generate-elixir-docs@v1.0.1
  #     - name: Publish to Pages
  #       uses: peaceiris/actions-gh-pages@v3.9.3
  #       with:
  #         deploy_key: ${{ secrets.DOCS_DEPLOY_KEY }}
  #         external_repository: epochtalk/server.epochtalk.github.io
  #         publish_dir: ./doc
  #         publish_branch: gh-pages

  # build and push image to github container registry
  build-and-push-image:
    needs: [static_code_analysis, test]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4.2.1
      - name: Log in to the Container registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@v6.9.0
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      # https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v1.4.3
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true