towerops-agent/.github/workflows/ci.yml

# GitHub Actions CI/CD Configuration for Towerops Agent
# Builds and publishes Docker image to GitHub Container Registry

name: CI

on:
  push:
    branches:
      - main
      - '**'
    tags:
      - 'v*'
  pull_request:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -C link-arg=-fuse-ld=lld

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.91"
          components: rustfmt, clippy

      - name: Cache apt packages
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: protobuf-compiler lld
          version: 1.0

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: "rust-cache"
          cache-on-failure: true
          cache-all-crates: true

      - name: Check
        run: cargo check --release

      - name: Format check
        run: cargo fmt -- --check

      - name: Test
        run: cargo test

      # Temporarily disabled:
      # - name: Clippy
      #   run: cargo clippy -- -D warnings

  build-branch:
    name: Build (Branch)
    needs: test
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract branch name
        id: branch
        run: |
          BRANCH_NAME=${GITHUB_REF#refs/heads/}
          # Sanitize branch name for Docker tag (replace / with -)
          SAFE_BRANCH=$(echo "$BRANCH_NAME" | sed 's/\//-/g')
          echo "name=$SAFE_BRANCH" >> $GITHUB_OUTPUT

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          provenance: false
          build-args: |
            BUILDKIT_INLINE_CACHE=1
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.branch.outputs.name }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}
          cache-from: |
            type=gha,scope=build-branch
            type=gha,scope=build-main
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          cache-to: type=gha,scope=build-branch,mode=max

  release:
    name: Release (Multi-arch)
    needs: test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Needed for git describe

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate version info
        id: version
        run: |
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            # Tag push - extract version from tag
            TAG=${GITHUB_REF#refs/tags/}
            VERSION=${TAG#v}
            echo "is_tag=true" >> $GITHUB_OUTPUT
            echo "tag=$TAG" >> $GITHUB_OUTPUT
          else
            # Main branch push - use git describe
            VERSION=$(git describe --tags --always --dirty=-modified | sed 's/^v//')
            echo "is_tag=false" >> $GITHUB_OUTPUT
          fi
          TIMESTAMP=$(date +%Y%m%d-%H%M%S)
          SHORT_SHA=${GITHUB_SHA::7}
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "timestamp=$TIMESTAMP" >> $GITHUB_OUTPUT
          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
          echo "Building version $VERSION"

      - name: Build and push (multi-arch)
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          build-args: |
            VERSION=${{ steps.version.outputs.version }}
            BUILDKIT_INLINE_CACHE=1
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ steps.version.outputs.short_sha }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.timestamp }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
          cache-from: |
            type=gha,scope=release
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          cache-to: |
            type=gha,scope=release,mode=max
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max

      - name: Summary
        run: |
          echo "### Released version: ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "Multi-architecture build (amd64, arm64)" >> $GITHUB_STEP_SUMMARY
          echo "Tags pushed:" >> $GITHUB_STEP_SUMMARY
          echo "- \`latest\`" >> $GITHUB_STEP_SUMMARY
          echo "- \`${{ steps.version.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- \`sha-${{ steps.version.outputs.short_sha }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- \`${{ steps.version.outputs.timestamp }}\`" >> $GITHUB_STEP_SUMMARY