build.yml

name: ci

on:
  pull_request:
  push:
    branches:
      - main
    tags:
      - 'v*'

env:
  REGISTRY_IMAGE: ghcr.io/ether/etherpad-go

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            arch: amd64
          - os: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.os }}
    services:
      postgres:
        image: postgres:alpine
        env:
          POSTGRES_USER: test_user
          POSTGRES_PASSWORD: test_password
          POSTGRES_DB: test_db
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U test_user -d test_db"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 12
      mysql:
        image: mysql:9.6
        env:
          MYSQL_PASSWORD: test_password
          MYSQL_ROOT_PASSWORD: test_password
          MYSQL_USER: test_user
          MYSQL_DATABASE: test_db
        ports:
          - 3306:3306
        options: >-
          --health-cmd "mysqladmin ping -h 127.0.0.1 -uroot -ptest_password --silent"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 20
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: 1.25
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
      - name: Install pnpm
        run: npm install -g pnpm@latest
      - name: Install pnpm dependencies
        run: pnpm install --frozen-lockfile
      - name: Build UI
        run:  node build.js
        working-directory: ./ui
      - name: Install dependencies
        run: go mod download
      - name: Install templ
        run: go install github.com/a-h/templ/cmd/templ@latest
      - name: Generate templ
        run: templ generate
      - name: Build admin
        run: pnpm build
        working-directory: ./admin
      - name: Build app
        run: go build -o etherpad-go
      - name: Prepare built assets
        run: |
          mkdir -p built-assets/js/admin
          mkdir -p built-assets/js/timeslider/assets
          mkdir -p built-assets/js/pad/assets
          mkdir -p built-assets/js/welcome/assets
          mkdir -p built-assets/css/build
          cp -r assets/js/admin/* built-assets/js/admin/
          cp assets/js/timeslider/assets/timeslider.js built-assets/js/timeslider/assets/
          cp assets/js/pad/assets/pad.js built-assets/js/pad/assets/
          cp assets/js/welcome/assets/welcome.js built-assets/js/welcome/assets/
          cp -r assets/css/build/* built-assets/css/build/
      - name: Upload assets
        if: matrix.arch == 'amd64'
        uses: actions/upload-artifact@v7
        with:
          name: built-assets
          path: built-assets/
          retention-days: 1
      - name: Run tests with coverage
        env:
          EP_CI: "true"
          EP_TEST_POSTGRES_HOST: "127.0.0.1"
          EP_TEST_POSTGRES_PORT: "5432"
          EP_TEST_MYSQL_HOST: "127.0.0.1"
          EP_TEST_MYSQL_PORT: "3306"
        run: go test -p 1 -v -coverpkg=./... -coverprofile=coverage.out ./...
      - name: Setup SonarQube
        if: (github.actor == 'samtv12345' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && matrix.arch == 'amd64'
        uses: warchant/setup-sonar-scanner@v10
      - name: Run SonarQube Scanner
        if: (github.actor == 'samtv12345' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && matrix.arch == 'amd64'
        continue-on-error: true
        run: sonar-scanner
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
          PROJECT_KEY: etherpad-go

      - name: SonarQube Quality Gate Check
        if: (github.actor == 'samtv12345' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && matrix.arch == 'amd64'
        continue-on-error: true
        uses: sonarsource/sonarqube-quality-gate-action@master
        with:
          scanMetadataReportFile: .scannerwork/report-task.txt
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
        timeout-minutes: 5

  playwright:
    needs:
      - test
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            arch: amd64
          - os: ubuntu-24.04-arm
            arch: arm64
          - os: macos-latest
            arch: amd64
          - os: windows-latest
            arch: amd64
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: 1.25
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
      - name: Install pnpm
        run: npm install -g pnpm@latest
      - name: Install pnpm dependencies
        run: pnpm install --frozen-lockfile
      - name: Build UI
        run: node build.js
        working-directory: ./ui
      - name: Install Go dependencies
        run: go mod download
      - name: Install templ
        run: go install github.com/a-h/templ/cmd/templ@latest
      - name: Generate templ
        run: templ generate
      - name: Build admin
        run: pnpm build
        working-directory: ./admin
      - name: Build app
        run: go build -o etherpad-go
      - name: Install Playwright browsers
        run: pnpm exec playwright install --with-deps
        working-directory: ./playwright
      - name: Run Playwright tests
        run: pnpm test
        working-directory: ./playwright
        env:
          CI: true
        timeout-minutes: 30
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report-${{ matrix.os }}-${{ matrix.arch }}
          path: playwright/playwright-report/
          retention-days: 7

  build:
    needs:
      - test
      - playwright
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runs-on: ubuntu-latest
          - platform: linux/arm64
            runs-on: ubuntu-24.04-arm
    runs-on: ${{ matrix.runs-on }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-tags: 'true'
          fetch-depth: '0'
      - name: Download assets
        uses: actions/download-artifact@v8
        with:
          name: built-assets
          path: assets/
      - name: Prepare
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY_IMAGE }}

      - name: Login to Github Container Registry
        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.build
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ env.REGISTRY_IMAGE }}
          outputs: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'type=image,push-by-digest=true,name-canonical=true,push=true' || 'type=image,push=false' }}

      - name: Export digest
        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
    needs:
      - build
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-tags: 'true'
          fetch-depth: '0'
      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Login to Github Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY_IMAGE }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}

      - name: Set image tag for main branch
        if: github.ref == 'refs/heads/main'
        run: echo "IMAGE_TAG=develop" >> $GITHUB_ENV

      - name: Set image tag for release tag
        if: startsWith(github.ref, 'refs/tags/')
        run: echo "IMAGE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          DIGEST_FLAGS=$(for f in *; do printf '%s@sha256:%s ' "$REGISTRY_IMAGE" "$f"; done)
          docker buildx imagetools create -t $REGISTRY_IMAGE:$IMAGE_TAG $DIGEST_FLAGS

      - name: Download amd64 digest for ArgoCD
        if: github.ref == 'refs/heads/main'
        uses: actions/download-artifact@v8
        with:
          name: digests-linux-amd64
          path: ${{ runner.temp }}/amd64-digest

      - name: Get amd64 image digest
        if: github.ref == 'refs/heads/main'
        run: |
          AMD64_DIGEST=$(ls ${{ runner.temp }}/amd64-digest | head -n1)
          echo "IMAGE_DIGEST=sha256:${AMD64_DIGEST}" >> $GITHUB_ENV

      - name: Checkout ether-charts
        if: github.ref == 'refs/heads/main'
        uses: actions/checkout@v6
        with:
          path: ether-charts
          repository: ether/ether-charts
          token: ${{ secrets.ETHER_CHART_TOKEN }}

      - name: Change argocd tag
        if: github.ref == 'refs/heads/main'
        run: |
          cd ether-charts
          sed -i "s|tag: .*|tag: \"${{ env.IMAGE_DIGEST }}\"|g" ./values-go-dev.yaml
          git config --global user.name 'github-actions'
          git config --global user.email 'noreply@github.com'
          git add .
          git commit -m "chore: bump etherpad-go image to ${{ env.IMAGE_DIGEST }}"
          git push origin main

      - name: Download amd64 digest for ArgoCD (release)
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/download-artifact@v8
        with:
          name: digests-linux-amd64
          path: ${{ runner.temp }}/amd64-digest

      - name: Get amd64 image digest (release)
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          AMD64_DIGEST=$(ls ${{ runner.temp }}/amd64-digest | head -n1)
          echo "IMAGE_DIGEST=sha256:${AMD64_DIGEST}" >> $GITHUB_ENV

      - name: Checkout ether-charts (release)
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/checkout@v6
        with:
          path: ether-charts
          repository: ether/ether-charts
          token: ${{ secrets.ETHER_CHART_TOKEN }}

      - name: Change argocd prod tag
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          cd ether-charts
          sed -i "s|tag: .*|tag: \"${{ env.IMAGE_DIGEST }}\"|g" ./values-go-prod.yaml
          git config --global user.name 'github-actions'
          git config --global user.email 'noreply@github.com'
          git add .
          git commit -m "chore: bump etherpad-go prod image to ${{ env.IMAGE_DIGEST }}"
          git push origin main

  release:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    needs:
      - test
      - playwright
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: linux
            goarch: amd64
            suffix: linux-amd64
          - goos: linux
            goarch: arm64
            suffix: linux-arm64
          - goos: darwin
            goarch: amd64
            suffix: darwin-amd64
          - goos: darwin
            goarch: arm64
            suffix: darwin-arm64
          - goos: windows
            goarch: amd64
            suffix: windows-amd64.exe
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: 1.25

      - name: Download assets
        uses: actions/download-artifact@v8
        with:
          name: built-assets
          path: assets/

      - name: Install templ
        run: go install github.com/a-h/templ/cmd/templ@latest

      - name: Generate templ
        run: templ generate

      - name: Build binary
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 0
        run: |
          go build -ldflags="-s -w" -o etherpad-go-${{ matrix.suffix }}

      - name: Upload binary artifact
        uses: actions/upload-artifact@v7
        with:
          name: binary-${{ matrix.suffix }}
          path: etherpad-go-${{ matrix.suffix }}
          retention-days: 1

  create-release:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    needs:
      - release
      - merge
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download all binaries
        uses: actions/download-artifact@v8
        with:
          path: binaries/
          pattern: binary-*
          merge-multiple: true

      - name: Create Release
        uses: softprops/action-gh-release@v3
        with:
          files: binaries/*
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}