name: CI

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

# Publication runs are not canceled by newer checks; pushes serialize per job.
concurrency:
  group: ci-${{ gitea.workflow }}-${{ gitea.ref }}-${{ gitea.event_name != 'pull_request' && vars.PUBLISH_IMAGES == 'true' && gitea.run_id || 'checks' }}
  cancel-in-progress: ${{ gitea.event_name == 'pull_request' || vars.PUBLISH_IMAGES != 'true' }}

defaults:
  run:
    shell: bash

env:
  DEFAULT_BRANCH: ${{ gitea.event.repository.default_branch }}
  PUBLISH_IMAGES: ${{ vars.PUBLISH_IMAGES }}
  REGISTRY_HOST: ${{ vars.REGISTRY_HOST || 'gitlab.bartelluis.de' }}

jobs:
  python-tests:
    runs-on: ${{ vars.AIS_RUNNER_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    env:
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
    steps:
      - uses: https://github.com/actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: https://github.com/actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.13"
      - name: Run Python tests
        run: sh ci/python-tests.sh
      - name: Upload JUnit report
        if: ${{ always() }}
        uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
        with:
          name: python-test-results
          path: reports/pytest.xml
          retention-days: 7
          if-no-files-found: warn

  javascript-check:
    runs-on: ${{ vars.AIS_RUNNER_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 5
    steps:
      - uses: https://github.com/actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24"
          package-manager-cache: false
      - name: Check JavaScript syntax
        run: node --check provisioner/static/app.js

  container-policy:
    runs-on: ${{ vars.AIS_RUNNER_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 5
    outputs:
      publish: ${{ steps.policy.outputs.publish }}
    steps:
      - uses: https://github.com/actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      # Gitea supplies GITHUB_* compatibility variables. Keep ref names out of
      # shell expressions and use the same policy in the container script.
      - name: Select verification or publication
        id: policy
        run: |
          publish=$(sh ci/publish-policy.sh)
          printf 'publish=%s\n' "$publish" >> "$GITHUB_OUTPUT"

  container-verify:
    needs: [python-tests, javascript-check, container-policy]
    if: ${{ needs.container-policy.outputs.publish == 'false' }}
    runs-on: ${{ vars.AIS_RUNNER_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 30
    env:
      DOCKER_BUILDKIT: "1"
    steps:
      - uses: https://github.com/actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - name: Check Docker tools
        run: |
          docker info
          docker buildx version
      - name: Build and smoke-test image
        run: sh ci/container.sh verify
      - uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
        with:
          name: container-build
          path: build.env
          retention-days: 7
          if-no-files-found: error

  container-publish:
    needs: [python-tests, javascript-check, container-policy]
    if: ${{ needs.container-policy.outputs.publish == 'true' }}
    runs-on: ${{ vars.AIS_RUNNER_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 30
    permissions:
      contents: read
    concurrency:
      group: container-publish
      cancel-in-progress: false
    env:
      DOCKER_BUILDKIT: "1"
    steps:
      - uses: https://github.com/actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - name: Check Docker tools
        run: |
          docker info
          docker buildx version
      - name: Build, smoke-test and publish image
        env:
          REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: sh ci/container.sh publish
      - uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
        with:
          name: container-deploy
          path: |
            build.env
            deploy.env
          retention-days: 30
          if-no-files-found: error