HODA/.gitea/workflows/ci.yml

# HODA CI/CD on Gitea Actions, following the conventions of the other msemes/* repos (FiMa's ci.yml):
#   - the `self-hosted` runner label, which drives the host Docker daemon through the mounted socket
#   - actions mirrored into git.mariosem.es, so the runner never needs public GitHub
#   - checks run inside Docker, so the runner needs no Go toolchain
#
# Every push and pull request: gofmt, go vet and tests (the Dockerfile's check stage), then the image
# build. Pushes to main and v* tags also scan the image with Trivy and push it to the Gitea registry.
#
# Needs the REGISTRY_TOKEN secret (personal access token with write:package), set at user level.
name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

# Serialize main builds so two quick pushes cannot race on :latest; PR runs cancel superseded runs.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read
  packages: write

env:
  REGISTRY: git.mariosem.es
  IMAGE: msemes/hoda

jobs:
  build:
    runs-on: self-hosted
    steps:
      - name: Checkout
        uses: https://git.mariosem.es/actions/checkout@v4

      - name: Metadata
        id: meta
        run: |
          sha="$(git rev-parse --short HEAD)"
          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
          case "${GITHUB_REF}" in
            refs/tags/v*) echo "version=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT" ;;
            *) echo "version=${GITHUB_REF_NAME:-local}-${sha}" >> "$GITHUB_OUTPUT" ;;
          esac

      # gofmt, go vet and go test run in the Dockerfile's check stage; a failure fails the build.
      - name: Format, vet and test
        env:
          DOCKER_BUILDKIT: "1"
        run: docker build --target check .

      - name: Build image
        env:
          DOCKER_BUILDKIT: "1"
        run: |
          tags="-t ${{ env.REGISTRY }}/${{ env.IMAGE }}:sha-${{ steps.meta.outputs.sha }}"
          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            tags="${tags} -t ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest"
          fi
          case "${GITHUB_REF}" in
            refs/tags/v*) tags="${tags} -t ${{ env.REGISTRY }}/${{ env.IMAGE }}:${GITHUB_REF#refs/tags/v}" ;;
          esac
          docker build --platform linux/amd64 \
            --build-arg HODA_VERSION=${{ steps.meta.outputs.version }} \
            --label org.opencontainers.image.revision=${{ github.sha }} \
            ${tags} .

      # Same policy as the other repos: print HIGH and CRITICAL, block the push only on CRITICAL.
      - name: Scan image for known CVEs
        if: github.event_name == 'push'
        run: |
          img=${{ env.REGISTRY }}/${{ env.IMAGE }}:sha-${{ steps.meta.outputs.sha }}
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$HOME/.cache/trivy":/root/.cache/ \
            aquasec/trivy:latest image \
              --severity HIGH,CRITICAL --ignore-unfixed --no-progress "$img" || true
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$HOME/.cache/trivy":/root/.cache/ \
            aquasec/trivy:latest image \
              --exit-code 1 --severity CRITICAL --ignore-unfixed --no-progress "$img"

      - name: Log in to Gitea container registry
        if: github.event_name == 'push'
        uses: https://git.mariosem.es/docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          # Personal access token with write:package; the injected GITEA_TOKEN has no package rights.
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Push image
        if: github.event_name == 'push'
        run: |
          set -e
          retry_push() {
            for attempt in 1 2 3; do
              docker push "$1" && return 0
              [ "$attempt" -lt 3 ] && echo "Push of $1 failed (attempt $attempt/3), retrying in 5s" && sleep 5
            done
            echo "Push of $1 failed after 3 attempts"
            return 1
          }
          base=${{ env.REGISTRY }}/${{ env.IMAGE }}
          retry_push "${base}:sha-${{ steps.meta.outputs.sha }}"
          if [ "${{ github.ref }}" = "refs/heads/main" ]; then retry_push "${base}:latest"; fi
          case "${GITHUB_REF}" in refs/tags/v*) retry_push "${base}:${GITHUB_REF#refs/tags/v}" ;; esac
          # Keep the host tidy: drop the per-commit tag; :latest stays as the layer cache anchor.
          docker rmi "${base}:sha-${{ steps.meta.outputs.sha }}" >/dev/null 2>&1 || true

      - name: Remove pull request image
        if: github.event_name != 'push'
        run: docker rmi "${{ env.REGISTRY }}/${{ env.IMAGE }}:sha-${{ steps.meta.outputs.sha }}" >/dev/null 2>&1 || true