name: CI
# Runs on every PR and every push to main. The smoke-test job is the actual
# merge gate for this repo — it proves pack -> push -> publish -> apt-get
# works, not just that files parse. See tests/smoke-test.sh.
#
# paths-ignore + bot commits carrying [skip ci] (see release-image.yaml)
# exist to break the automation loop: an image release commits a new
# appVersion to main, which would otherwise re-trigger this workflow, which
# has nothing new to check.
on:
  pull_request: {}
  push:
    branches: [main]
    paths-ignore:
      - 'charts/aptly/Chart.yaml'
      - 'CHANGELOG.md'

concurrency:
  group: ci-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: hadolint (aptly-server)
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: images/aptly-server/Dockerfile
      - name: hadolint (aptly-deb-builder)
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: images/aptly-deb-builder/Dockerfile

      - name: shellcheck
        run: |
          docker run --rm -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x \
            rootfs/usr/local/bin/aptly-* rootfs/usr/local/bin/lib/common.sh tests/smoke-test.sh

      - uses: azure/setup-helm@v4.3.0
        with:
          version: ${{ vars.HELM_VERSION || '3.16.4' }}
      - name: helm lint
        run: helm lint charts/aptly
      - name: helm template (every ci/*.yaml values file, plus defaults)
        run: |
          set -e
          helm template test charts/aptly > /tmp/rendered-defaults.yaml
          for f in charts/aptly/ci/*.yaml; do
            helm template test charts/aptly -f "$f" > "/tmp/rendered-$(basename "$f" .yaml).yaml"
          done
      - name: kubeconform
        run: |
          docker run --rm -v /tmp:/tmp ghcr.io/yannh/kubeconform:latest \
            -summary -strict -kubernetes-version 1.29.0 \
            -schema-location default \
            -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
            /tmp/rendered-*.yaml
      - name: fail-guard regression check (proxy.enabled=false + Ingress/Gateway + non-open preset must abort)
        run: |
          if helm template test charts/aptly --set proxy.enabled=false --set ingress.enabled=true \
               --set ingress.repo.host=x.example.com >/tmp/should-fail.yaml 2>&1; then
            echo "::error::expected `helm template` to fail on proxy.enabled=false + ingress.enabled (fail-guard regression)"; exit 1
          fi
          if helm template test charts/aptly --set proxy.enabled=false --set gateway.enabled=true \
               --set 'gateway.parentRefs[0].name=x' >/tmp/should-fail2.yaml 2>&1; then
            echo "::error::expected `helm template` to fail on proxy.enabled=false + gateway.enabled (fail-guard regression)"; exit 1
          fi

  smoke-test:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - name: Run the end-to-end smoke test
        run: ./tests/smoke-test.sh