ci.yml

name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  ci:
    runs-on: self-hosted
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check Go installation
        id: check-go
        run: |
          if command -v go &> /dev/null; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Go already installed: $(go version)"
            # Ensure Go is in PATH
            GO_BIN_DIR=$(dirname $(command -v go))
            echo "${GO_BIN_DIR}" >> $GITHUB_PATH
            # Also add GOPATH/bin
            echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "Go not found"
          fi

      - name: Set up Go
        if: steps.check-go.outputs.exists != 'true'
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Check Task installation
        id: check-task
        run: |
          if command -v task &> /dev/null; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Task already installed: $(task --version)"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "Task not found"
          fi

      - name: Set up Task
        if: steps.check-task.outputs.exists != 'true'
        uses: go-task/setup-task@v1

      - name: Setup BuildKit cache
        run: task setup:cache

      - name: Check Docker Buildx
        id: check-buildx
        run: |
          if command -v docker &> /dev/null && docker buildx version &> /dev/null; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Docker Buildx already available: $(docker buildx version)"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "Docker Buildx not found"
          fi

      - name: Set up Docker Buildx
        if: steps.check-buildx.outputs.exists != 'true'
        uses: docker/setup-buildx-action@v3
        with:
          driver: docker-container
          use: true
          name: spinbox-builder
          driver-opts: |
            image=moby/buildkit:latest
            network=host
          buildkitd-flags: --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
          buildkitd-config-inline: |
            [worker.oci]
              max-parallelism = 4
            [worker.containerd]
              gc = true
              gckeepstorage = 50000000000
              [[worker.containerd.gcpolicy]]
                keepBytes = 50000000000
                keepDuration = 1209600
                filters = [ "type==source.local", "type==exec.cachemount", "type==source.git.checkout"]

      - name: Verify go.mod/go.sum
        run: task verify:vendor

      - name: Build shim
        run: task build:shim

      - name: Build vminitd
        run: task build:vminitd

      - name: Check golangci-lint installation
        id: check-golangci-lint
        run: |
          if command -v golangci-lint &> /dev/null; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "golangci-lint already installed: $(golangci-lint --version)"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "golangci-lint not found"
          fi

      - name: Install golangci-lint
        if: steps.check-golangci-lint.outputs.exists != 'true'
        run: |
          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin latest
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

      - name: Lint
        run: task lint

      - name: Validate
        run: task validate

      - name: Run tests with coverage
        run: |
          CGO_ENABLED=1 go test -v -short -timeout 120s -race -coverprofile=${{ github.workspace }}/coverage.txt -covermode=atomic -coverpkg=./internal/... ./...

      - name: Verify coverage file
        run: |
          echo "=== Coverage file info ==="
          ls -la ${{ github.workspace }}/coverage.txt
          echo "=== Coverage file size ==="
          wc -l ${{ github.workspace }}/coverage.txt
          echo "=== Coverage file head ==="
          head -20 ${{ github.workspace }}/coverage.txt

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ${{ github.workspace }}/coverage.txt
          fail_ci_if_error: false
          verbose: true

      - name: Cleanup BuildKit cache
        if: always()
        run: |
          # BuildKit GC policy handles automatic cleanup based on gckeepstorage setting
          # Only manually clean very old local cache exports (60 days)
          find /var/lib/spinbox-buildkit-cache -type f -mtime +60 -delete || true
          echo "BuildKit cache cleanup complete (local cache files older than 60 days removed)"

  integration:
    runs-on: self-hosted
    needs: ci
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check Go installation
        id: check-go
        run: |
          if command -v go &> /dev/null; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Go already installed: $(go version)"
            # Ensure Go is in PATH
            GO_BIN_DIR=$(dirname $(command -v go))
            echo "${GO_BIN_DIR}" >> $GITHUB_PATH
            # Also add GOPATH/bin
            echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "Go not found"
          fi

      - name: Set up Go
        if: steps.check-go.outputs.exists != 'true'
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Check Task installation
        id: check-task
        run: |
          if command -v task &> /dev/null; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Task already installed: $(task --version)"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "Task not found"
          fi

      - name: Set up Task
        if: steps.check-task.outputs.exists != 'true'
        uses: go-task/setup-task@v1

      - name: Setup BuildKit cache
        run: task setup:cache

      - name: Check Docker Buildx
        id: check-buildx
        run: |
          if command -v docker &> /dev/null && docker buildx version &> /dev/null; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Docker Buildx already available: $(docker buildx version)"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "Docker Buildx not found"
          fi

      - name: Set up Docker Buildx
        if: steps.check-buildx.outputs.exists != 'true'
        uses: docker/setup-buildx-action@v3
        with:
          driver: docker-container
          use: true
          name: spinbox-builder
          driver-opts: |
            image=moby/buildkit:latest
            network=host
          buildkitd-flags: --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
          buildkitd-config-inline: |
            [worker.oci]
              max-parallelism = 4
            [worker.containerd]
              gc = true
              gckeepstorage = 50000000000
              [[worker.containerd.gcpolicy]]
                keepBytes = 50000000000
                keepDuration = 1209600
                filters = [ "type==source.local", "type==exec.cachemount", "type==source.git.checkout"]

      - name: Run integration test
        env:
          VERSION: ci-${{ github.run_id }}
          CLEANUP: "1"
        run: task integration

      - name: Cleanup BuildKit cache
        if: always()
        run: |
          # BuildKit GC policy handles automatic cleanup based on gckeepstorage setting
          # Only manually clean very old local cache exports (60 days)
          find /var/lib/spinbox-buildkit-cache -type f -mtime +60 -delete || true
          echo "BuildKit cache cleanup complete (local cache files older than 60 days removed)"