ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: ./go.mod

      - name: Create fake PHP and .phar files
        run: |
          # These are needed so that the linter does not complain
          mkdir -p internal/legacy/archives
          touch internal/legacy/archives/platform.phar
          touch internal/legacy/archives/commands-upsun.json internal/legacy/archives/commands-platformsh.json internal/legacy/archives/commands-vendor.json
          touch internal/legacy/archives/php_windows_amd64
          touch internal/legacy/archives/php_linux_amd64
          touch internal/legacy/archives/php_linux_arm64
          touch internal/legacy/archives/php_darwin_amd64
          touch internal/legacy/archives/php_darwin_arm64
          touch internal/config/embedded-config.yaml

      - name: Check go.mod is tidy
        run: go mod tidy -diff

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.14
          args: --timeout=5m

      - name: Run tests
        run: make test-go

      - name: Check goreleaser config
        run: make goreleaser-check

  # Checks that the embedded image registry and Flex config schema match upstream.
  # Fails when upstream publishes changes; run `make update-registry` or `make update-schema` to refresh.
  # Non-blocking, since upstream changes are unrelated to the pull request.
  lint-upstream:
    runs-on: ubuntu-latest
    continue-on-error: true

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: ./go.mod

      - name: Check the embedded image registry is up to date
        run: make check-registry

      - name: Check the embedded Flex config schema is up to date
        if: ${{ !cancelled() }}
        run: make check-schema

      - name: Check the mock API's OpenAPI spec is up to date
        if: ${{ !cancelled() }}
        run: make check-openapi-spec

  legacy-php:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.5'
          extensions: curl, openssl, phar, zlib
          tools: composer:v2

      - name: Get Composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config --global cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache Composer dependencies
        uses: actions/cache@v6
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Install dependencies
        run: make composer-dev

      - name: Lint PHP
        run: make lint-php

      - name: Run PHPUnit tests
        run: make test-php

      - name: Build platform.phar
        run: make internal/legacy/archives/platform.phar

  integration-test:
    runs-on: ubuntu-latest

    # The tests run a CLI built for coverage, and record coverage data and command arguments.
    env:
      TEST_CLI_PATH: ${{ github.workspace }}/dist/coverage/bin/upsun
      GOCOVERDIR: ${{ github.workspace }}/dist/coverage/data
      INTEGRATION_TESTS_ARGS_LOG: ${{ github.workspace }}/dist/coverage/args.log

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: ./go.mod

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.5'
          extensions: curl, openssl, phar, zlib
          tools: composer:v2

      - name: Get Composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config --global cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache Composer dependencies
        uses: actions/cache@v6
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Download PHP binary
        run: make php

      - name: Build platform.phar
        run: make phar

      - name: Build CLI
        id: build
        run: make coverage-cli

      - name: Install shells for completion tests
        run: sudo apt-get update && sudo apt-get install -y bash-completion zsh fish

      - name: Run integration tests
        run: cd integration-tests && go test -count=1 ./...

      - name: Report coverage
        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
        run: make -s coverage-report >> "$GITHUB_STEP_SUMMARY"

  # Runs the integration tests with legacy auth, the default for users.
  # TODO: remove once legacy auth is no longer used.
  integration-test-legacy-auth:
    runs-on: ubuntu-latest

    env:
      TEST_CLI_PATH: ${{ github.workspace }}/dist/legacy-auth/upsun
      TEST_CLI_GO_AUTH: '0'

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: ./go.mod

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.5'
          extensions: curl, openssl, phar, zlib
          tools: composer:v2

      - name: Build CLI
        run: |
          make php phar
          CGO_ENABLED=0 go build -o "$TEST_CLI_PATH" ./cmd/platform

      - name: Run integration tests
        run: cd integration-tests && go test -count=1 ./...

  # Runs the integration tests with the legacy source on the system PHP, for PHP line coverage.
  integration-test-php-coverage:
    runs-on: ubuntu-latest

    env:
      TEST_CLI_PATH: ${{ github.workspace }}/dist/php-coverage/bin/upsun
      TEST_CLI_PHAR_PATH: ${{ github.workspace }}/legacy/bin/platform
      PHP_COVERAGE_DIR: ${{ github.workspace }}/dist/php-coverage/data

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: ./go.mod

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.5'
          extensions: curl, openssl, phar, zlib
          coverage: pcov
          tools: composer:v2

      - name: Get Composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config --global cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache Composer dependencies
        uses: actions/cache@v6
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Build CLI
        id: build
        run: make php-coverage-cli

      - name: Run integration tests
        run: cd integration-tests && go test -count=1 ./...

      - name: Report coverage
        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
        run: make -s php-coverage-report >> "$GITHUB_STEP_SUMMARY"

      - name: Upload HTML report
        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
        uses: actions/upload-artifact@v7
        with:
          name: php-coverage-html
          path: dist/php-coverage/html

  # Builds the CLI for all platforms, for integration tests on macOS and Windows, and for reviewers to test.
  build-cross:
    runs-on: ubuntu-latest

    outputs:
      linux-amd64: ${{ steps.upload-linux-amd64.outputs.artifact-url }}
      linux-arm64: ${{ steps.upload-linux-arm64.outputs.artifact-url }}
      darwin-amd64: ${{ steps.upload-darwin-amd64.outputs.artifact-url }}
      darwin-arm64: ${{ steps.upload-darwin-arm64.outputs.artifact-url }}
      windows-amd64: ${{ steps.upload-windows-amd64.outputs.artifact-url }}

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: ./go.mod

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.5'
          extensions: curl, openssl, phar, zlib
          tools: composer:v2

      - name: Get Composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config --global cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache Composer dependencies
        uses: actions/cache@v6
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Build platform.phar
        run: make phar

      # 0.0.0 versions are dev builds, which do not check for updates.
      - name: Build CLIs
        env:
          PR: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          version=0.0.0-${PR:+pr}${PR:-$GITHUB_REF_NAME}+${SHA:0:7}
          php_version=$(sed -n 's/^PHP_VERSION = //p' Makefile)
          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64; do
            goos=${target%/*} goarch=${target#*/}
            make php GOOS=$goos GOARCH=$goarch
            ext=; [ $goos = windows ] && ext=.exe
            CGO_ENABLED=0 GOOS=$goos GOARCH=$goarch go build \
              -ldflags "-X github.com/upsun/cli/internal/config.Version=$version -X github.com/upsun/cli/internal/legacy.PHPVersion=$php_version" \
              -o dist/cross/$goos-$goarch/upsun$ext ./cmd/platform
          done

      - name: Upload CLI (linux-amd64)
        id: upload-linux-amd64
        uses: actions/upload-artifact@v7
        with:
          name: cli-linux-amd64
          path: dist/cross/linux-amd64/
          retention-days: 7

      - name: Upload CLI (linux-arm64)
        id: upload-linux-arm64
        uses: actions/upload-artifact@v7
        with:
          name: cli-linux-arm64
          path: dist/cross/linux-arm64/
          retention-days: 7

      - name: Upload CLI (darwin-amd64)
        id: upload-darwin-amd64
        uses: actions/upload-artifact@v7
        with:
          name: cli-darwin-amd64
          path: dist/cross/darwin-amd64/
          retention-days: 7

      - name: Upload CLI (darwin-arm64)
        id: upload-darwin-arm64
        uses: actions/upload-artifact@v7
        with:
          name: cli-darwin-arm64
          path: dist/cross/darwin-arm64/
          retention-days: 7

      - name: Upload CLI (windows-amd64)
        id: upload-windows-amd64
        uses: actions/upload-artifact@v7
        with:
          name: cli-windows-amd64
          path: dist/cross/windows-amd64/
          retention-days: 7

  # Comments on pull requests with the CLI builds, except from forks, as their code is untrusted.
  comment-builds:
    needs: build-cross
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
    runs-on: ubuntu-latest

    permissions:
      pull-requests: write

    # Runs for one push at a time, so that there is only one comment.
    concurrency:
      group: comment-builds-${{ github.event.pull_request.number }}

    steps:
      - name: Create or update the comment
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PR: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          RUN_ID: ${{ github.run_id }}
          URLS: ${{ toJSON(needs.build-cross.outputs) }}
        run: |
          marker='<!-- cli-pr-builds -->'
          {
            echo "$marker"
            echo "### CLI builds"
            echo
            echo "Built from $SHA (merged into the base branch). Downloads need a GitHub login, and expire after 7 days."
            echo
            echo '| Platform | Download |'
            echo '| --- | --- |'
            for name in linux-amd64 linux-arm64 darwin-amd64 darwin-arm64 windows-amd64; do
              echo "| $name | [cli-$name]($(echo "$URLS" | jq -r --arg n "$name" '.[$n]')) |"
            done
            echo
            echo 'Or download one with the [GitHub CLI](https://cli.github.com/), e.g.:'
            echo
            echo '```sh'
            echo "gh run download $RUN_ID -R $REPO -n cli-linux-amd64"
            echo 'chmod +x upsun'
            echo './upsun --version'
            echo '```'
            echo
            echo 'On macOS, if you downloaded it with a browser, remove the quarantine attribute before running it: `xattr -d com.apple.quarantine upsun`.'
          } > body.md
          # A run for an older push may finish later: it must not replace the comment.
          head=$(gh api "repos/$REPO/pulls/$PR" --jq .head.sha)
          if [ "$head" != "$SHA" ]; then
            echo "The pull request has a newer commit."
            exit 0
          fi
          ids=$(gh api --paginate "repos/$REPO/issues/$PR/comments" \
            --jq ".[] | select(.user.login == \"github-actions[bot]\" and (.body | startswith(\"$marker\"))) | .id")
          id=${ids%%$'\n'*}
          if [ -n "$id" ]; then
            gh api -X PATCH "repos/$REPO/issues/comments/$id" -F body=@body.md >/dev/null
          else
            gh api -X POST "repos/$REPO/issues/$PR/comments" -F body=@body.md >/dev/null
          fi

  integration-test-cross:
    needs: build-cross
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            artifact: cli-darwin-arm64
            executable: upsun
          - os: windows-latest
            artifact: cli-windows-amd64
            executable: upsun.exe
    runs-on: ${{ matrix.os }}

    env:
      TEST_CLI_PATH: ${{ github.workspace }}/dist/cross/${{ matrix.executable }}

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: ./go.mod

      - name: Download CLI
        uses: actions/download-artifact@v8
        with:
          name: ${{ matrix.artifact }}
          path: dist/cross

      # Artifacts do not keep file permissions.
      - name: Make the CLI executable
        if: runner.os != 'Windows'
        run: chmod +x "$TEST_CLI_PATH"

      - name: Run integration tests
        shell: bash
        run: cd integration-tests && go test -count=1 -timeout 30m ./...

  # Runs Go tests that need Windows: which certificates the embedded PHP trusts, and the auth channel.
  windows-cert-store:
    runs-on: windows-latest

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: ./go.mod

      - name: Download the embedded PHP
        shell: bash
        run: |
          # Line endings may be converted on checkout.
          var() { tr -d '\r' < Makefile | sed -n "s/^$1 = //p"; }
          php_version=$(var PHP_VERSION)
          asset="php-$php_version-windows-amd64.exe"
          php_sha256=$(tr -d '\r' < internal/legacy/php_sha256sums.txt | awk -v a="$asset" '$2 == a { print $1 }')
          mkdir -p internal/legacy/archives
          curl -fSL "https://github.com/upsun/cli-php-builds/releases/download/php-$php_version-$(var PHP_BUILD)/$asset" \
            -o internal/legacy/archives/php_windows.exe
          echo "$php_sha256  internal/legacy/archives/php_windows.exe" | sha256sum -c -
          # Only needed so that the package builds.
          touch internal/legacy/archives/platform.phar
          touch internal/legacy/archives/commands-upsun.json internal/legacy/archives/commands-platformsh.json

      - name: Run Windows tests
        shell: bash
        env:
          CLI_TEST_MODIFY_CERT_STORE: '1'
        run: |
          go test -v -count=1 -timeout 3m -run TestWindows ./internal/legacy/
          go test -v -count=1 -timeout 3m ./internal/authchannel/