# EVERY PUSH AND EVERY PULL REQUEST: THE REPOSITORY'S OWN CHECKS.
#
# This runs code nobody has reviewed yet. It is given no secret, it only
# ever runs on the ekklesia-ci runner, which holds no credential that
# reaches the update server or a classroom, and nothing it builds is kept
# as something that could be installed. See docs/releasing.md.
#
# The steps are the repository's own scripts. A test added to tests/ is
# run here with nothing in this file to change.
name: CI

on:
  push:
    branches: ['**']
  pull_request:

jobs:
  checks:
    name: checks
    runs-on: ekklesia-ci
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Sources, the manual, every test, and the change's hygiene
        env:
          PR_BASE: ${{ github.event.pull_request.base.sha }}
          PUSH_BEFORE: ${{ github.event.before }}
        run: |
          # What the change is compared with: the pull request's base, or
          # what the branch was before this push, or where it left master.
          base="${PR_BASE:-$PUSH_BEFORE}"
          if [ -z "$base" ] || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
            base="$(git merge-base HEAD origin/master 2>/dev/null || git rev-list --max-parents=0 HEAD | tail -n 1)"
          fi
          CHECK_LOG_DIR="$RUNNER_TEMP/checks" tools/check.sh --base "$base"

      - name: Summary
        if: always()
        run: cat "$RUNNER_TEMP/checks/summary.md" 2>/dev/null || echo "no summary was written"

      - name: Keep every check's full output
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: check-logs
          path: ${{ runner.temp }}/checks

  package:
    name: package and container gate
    needs: checks
    runs-on: ekklesia-ci
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Build the package this commit describes
        run: |
          version="$(cat VERSION)"
          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)" tools/build-release.sh "$version"
          deb="dist/ekklesia-classroom_${version}_amd64.deb"
          # It is the package it says it is, and building it changed nothing
          # in the tree but, perhaps, the manual's revision date.
          test "$(dpkg-deb --field "$deb" Package)" = ekklesia-classroom
          test "$(dpkg-deb --field "$deb" Version)" = "$version"
          test -z "$(git status --porcelain --untracked-files=no -- . ':(exclude)docs/manual/build')"
          mkdir -p "$RUNNER_TEMP/package"
          { dpkg-deb --info "$deb"; echo; dpkg-deb --contents "$deb"; } > "$RUNNER_TEMP/package/contents.txt"
          sha256sum "$deb" > "$RUNNER_TEMP/package/sha256.txt"

      - name: Install it on Debian Trixie, fresh and over what the rooms run
        run: |
          version="$(cat VERSION)"
          # --ci: an upgrade from a release that is not older than this
          # commit's VERSION (master between releases) is recorded as
          # skipped, not failed. A release build is never --ci.
          RELEASE_GATE_REPORT="$RUNNER_TEMP/package/gate-report.txt" \
            tools/release-gate.sh --ci "dist/ekklesia-classroom_${version}_amd64.deb"

      - name: Keep the package's contents and the gate report (not the package)
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: package-report
          path: ${{ runner.temp }}/package