orchard/.github/workflows/main.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
    tags:
      - '*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: Install golangci-lint
        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
      - name: Lint
        run: golangci-lint run

  test:
    name: Test (Linux)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: Install Vetu
        run: |
          sudo apt-get update && sudo apt-get -y install apt-transport-https ca-certificates
          echo "deb [trusted=yes] https://apt.fury.io/cirruslabs/ /" | sudo tee /etc/apt/sources.list.d/cirruslabs.list
          sudo apt-get update && sudo apt-get -y install vetu          
      - name: Pre-pull default Vetu image for use in tests
        run: |
          vetu pull ghcr.io/cirruslabs/ubuntu-runner-amd64:latest          
      - name: Run tests
        run: go test -v -count=1 ./...

  release_binaries_dry_run:
    name: Release Binaries (Dry Run)
    if: github.event_name != 'pull_request' && github.ref_type != 'tag'
    needs:
      - lint
      - test
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
      GITHUB_TOKEN: ${{ github.token }}
      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
      MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
      MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
      MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
      MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
      MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: Install GoReleaser
        run: |
          echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
          sudo apt update
          sudo apt -y install goreleaser-pro          
      - name: Build snapshot
        run: goreleaser release --skip=publish --snapshot --clean --verbose
      - name: Upload binaries
        uses: actions/upload-artifact@v4
        with:
          name: orchard-binaries-dry-run
          path: dist/orchard_*/orchard*
          if-no-files-found: ignore

  release_binaries:
    name: Release Binaries
    if: github.ref_type == 'tag'
    needs:
      - lint
      - test
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: write
    env:
      FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
      GITHUB_TOKEN: ${{ github.token }}
      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
      MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
      MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
      MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
      MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
      MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: Install GoReleaser
        run: |
          echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
          sudo apt update
          sudo apt -y install goreleaser-pro          
      - name: Release
        run: goreleaser

  release_docker_image:
    name: Release Docker Image
    if: github.ref_type == 'tag'
    needs:
      - lint
      - test
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v5
      - name: Log in to GHCR
        run: echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
        env:
          GITHUB_TOKEN: ${{ github.token }}
      - name: Configure buildx
        run: |
          docker buildx create --name multibuilder
          docker buildx use multibuilder
          docker buildx inspect --bootstrap          
      - name: Build and push image
        run: |
          docker buildx build --push --platform linux/amd64,linux/arm64 \
            --tag "ghcr.io/cirruslabs/orchard:${GITHUB_REF_NAME}" \
            --tag ghcr.io/cirruslabs/orchard:latest \
            .