name: schemas

on:
  push:
    branches: [main]
    tags:
      - 'v*'
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      deploy_prod:
        description: 'Deploy to production'
        required: false
        default: 'false'
        type: boolean

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version: 'stable'
      - name: Generate and format check
        run: |
          go install mvdan.cc/gofumpt@latest
          go install golang.org/x/tools/cmd/goimports@latest
          go generate ./...
          git diff --stat --exit-code
      - name: Run tests
        run: go test -race -coverprofile=coverage.txt ./...

  vulnerabilities:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version: 'stable'
      - name: Check vulnerabilities
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

  check-release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: '24'
      - uses: actions/setup-go@v7
        with:
          go-version: 'stable'
      - name: Check goreleaser config
        uses: goreleaser/goreleaser-action@v7
        with:
          version: '~> v2'
          args: check
      - name: Install goreleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          version: '~> v2'
          install-only: true
      # Without the runner's GOCACHEPROG (gobuildcache): goreleaser's parallel
      # go builds contend for its per-entry locks and time out.
      - name: Test release build
        run: env -u GOCACHEPROG goreleaser release --snapshot --clean

  build:
    needs: [check, vulnerabilities, check-release]
    runs-on: ubuntu-latest
    env:
      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
      GITEA_REPOSITORY: ${{ gitea.repository }}
    steps:
      - uses: actions/checkout@v7
      - uses: buildtool/setup-buildtools-action@v1
      - name: Build and push
        run: unset GITEA_TOKEN && build && push

  deploy-prod-frostmoln:
    needs: build
    if: gitea.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    env:
      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
      GITEA_REPOSITORY: ${{ gitea.repository }}
      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
    environment: prod
    steps:
      - uses: actions/checkout@v7
      - uses: buildtool/setup-buildtools-action@v1
      - name: Install fm
        run: |
          sudo install -d -m 0755 /etc/apt/keyrings
          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
          sudo apt-get update && sudo apt-get install -y fm
      - name: Deploy to Frostmoln production
        env:
          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
        # The cluster API is private: the kubeconfig's exec plugin opens an fm
        # tunnel on demand. fm reads the key from its config file, not the env.
        run: |
          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n schemas