# Generated by `starci compile` from wrapping-actions.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - Passes are remembered in this repository's Actions cache, which GitHub
#    scopes by branch and evicts when old. starci's own store has neither
#    limit.

name: CI

on:
  push:
    branches: ['**']
    tags: ['**']
  pull_request:
  workflow_dispatch:

jobs:
  web-test:
    name: "web test"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /web
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-web-test-7dd2f9c3a1ad596c-${{ hashFiles('web', 'web/**') }}
      - name: "Cache: npm-22"
        if: steps.passed.outputs.cache-hit != 'true'
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-cache/npm-22
          key: starci-cache-npm-22-${{ github.run_id }}
          restore-keys: starci-cache-npm-22-
      - name: "web test"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            npm ci && npm test
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            -v "$RUNNER_TEMP/starci-cache/npm-22:/root/.npm" \
            node:22-bookworm-slim sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"

  api-test:
    name: "api test"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-api-test-9155297462b3efdc-${{ hashFiles('**', '!.git/**') }}
      - name: "Cache: pip-3-13"
        if: steps.passed.outputs.cache-hit != 'true'
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-cache/pip-3-13
          key: starci-cache-pip-3-13-${{ github.run_id }}
          restore-keys: starci-cache-pip-3-13-
      - name: "api test"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            pip install -e . && pytest -q
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            -v "$RUNNER_TEMP/starci-cache/pip-3-13:/root/.cache/pip" \
            python:3.13-slim sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"

  trivy:
    name: "trivy"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: "trivy"
        env:
          STARCI_RUN: |-
            trivy fs --scanners vuln,secret --severity CRITICAL --exit-code 1 .
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            aquasec/trivy:latest sh -c "$STARCI_RUN"

  hadolint:
    name: "hadolint"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /Dockerfile
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-hadolint-b258bb38da604f59-${{ hashFiles('Dockerfile', 'Dockerfile/**') }}
      - name: "hadolint"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            hadolint --failure-threshold warning Dockerfile
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            hadolint/hadolint:latest-debian sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"

  image:
    name: "image"
    runs-on: ubuntu-latest
    needs: [web-test, api-test, trivy, hadolint]
    steps:
      - uses: actions/checkout@v4
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-image-11ad3ee921a33f98-${{ hashFiles('**', '!.git/**') }}
      - name: "image"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            docker build -t app:ci --build-arg NODE_VERSION=22 -f Dockerfile .
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            docker:27-cli sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"