ci.yml

---

name: CI

on:
  pull_request:

env:
  CI_TAG: ghcr.io/${{ github.repository_owner }}/access-guard:pr-${{ github.event.number }}
  RUNTIME_CACHE_TAG: ghcr.io/${{ github.repository_owner }}/access-guard:runtime-cache
  DEV_CACHE_TAG: ghcr.io/${{ github.repository_owner }}/access-guard:dev-cache

jobs:
  source-hash:
    name: Get source hash
    uses: flaeppe/access-guard/.github/workflows/source_hash.yml@master

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: "3.9"
      - uses: pre-commit/action@v2.0.3

  build:
    runs-on: ubuntu-latest
    needs: source-hash
    steps:
      - uses: actions/checkout@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
        with:
          version: v0.6.3
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push runtime image
        uses: docker/build-push-action@v2
        with:
          file: ./Dockerfile-base
          cache-from: type=registry,ref=${{ env.RUNTIME_CACHE_TAG }}
          context: .
          push: true
          tags: |
            ghcr.io/${{ github.repository_owner }}/access-guard:${{ needs.source-hash.outputs.source_hash }}
      - name: Build and push CI image
        uses: docker/build-push-action@v2
        with:
          cache-from: type=registry,ref=${{ env.DEV_CACHE_TAG }}
          target: dev
          context: .
          push: true
          build-args: BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/access-guard:${{ needs.source-hash.outputs.source_hash }}
          tags: ${{ env.CI_TAG }}

  static-typing:
    name: Static Typing
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v2
      - name: MyPy cache
        uses: actions/cache@v2
        with:
          path: .mypy_cache
          key: ${{ runner.os }}-mypy
          restore-keys: |
            ${{ runner.os }}-mypy
      - name: Fix permission issue on .mypy_cache
        run: |
          mkdir -p .mypy_cache
          chmod -R 777 .mypy_cache
      - name: Run MyPy
        run: |
          IMAGE_TAG=${{ env.CI_TAG }} docker-compose -f docker-compose.ci.yml run sut mypy --config-file pyproject.toml

  test:
    name: Test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v2
      - name: Create coverage directory
        run: |
          mkdir -p coverage
          sudo chown -R 7331:7331 coverage
      - name: Run tests
        run: |
          IMAGE_TAG=${{ env.CI_TAG }} docker-compose -f docker-compose.ci.yml run sut
      - name: Report coverage
        if: github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'reopened' || github.event.action == 'synchronize')
        uses: 5monkeys/cobertura-action@master
        with:
          path: coverage/coverage.xml
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          minimum_coverage: 100
          fail_below_threshold: true
          link_missing_lines: true
          show_missing: true
          show_line: true
          show_branch: true