incr/.forgejo/workflows/ci.yml

name: CI

on:
  push:
    branches: ['release/*']
  pull_request:
    branches: [main, 'release/*']

jobs:
  ci:
    runs-on: docker
    container:
      image: forge.lvl0.xyz/lvl0/incr-ci:php8.3-3

    # No service container: on this runner a job container cannot reach one
    # (the service starts fine but lands on a different network). Tests run
    # against sqlite in memory instead — see .env.testing.
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v4

      - name: Cache Composer dependencies
        uses: https://data.forgejo.org/actions/cache@v4
        with:
          path: ~/.cache/composer
          key: composer-${{ hashFiles('composer.lock') }}
          restore-keys: composer-

      - name: Install PHP dependencies
        run: composer install --no-interaction --prefer-dist --no-progress

      - name: Prepare environment
        run: cp .env.testing .env

      - name: Lint
        run: vendor/bin/pint --test

      - name: Static analysis
        run: vendor/bin/phpstan analyse --memory-limit=1G --no-progress --error-format=github

      - name: Tests
        run: php artisan test --coverage-clover coverage.xml --coverage-text

      - name: Parse coverage
        if: github.event_name == 'pull_request'
        id: coverage
        run: |
          COVERAGE=$(php -r '
            $xml = simplexml_load_file("coverage.xml");
            if ($xml === false || !isset($xml->project->metrics)) {
              echo "0";
              exit;
            }
            $metrics = $xml->project->metrics;
            $statements = (int) $metrics["statements"];
            $covered = (int) $metrics["coveredstatements"];
            echo $statements > 0 ? round(($covered / $statements) * 100, 2) : 0;
          ')
          echo "percentage=$COVERAGE" >> "$GITHUB_OUTPUT"

      - name: Comment coverage on PR
        if: github.event_name == 'pull_request'
        continue-on-error: true
        env:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          COVERAGE: ${{ steps.coverage.outputs.percentage }}
          REPO: ${{ github.repository }}
          SERVER_URL: ${{ github.server_url }}
          COMMIT_SHA: ${{ github.sha }}
        run: |
          API_URL="${SERVER_URL}/api/v1/repos/${REPO}/issues/${PR_NUMBER}/comments"
          MARKER="<!-- incr-ci-coverage-report -->"

          BODY="${MARKER}
          ## Code Coverage Report

          | Metric | Value |
          |--------|-------|
          | **Line Coverage** | ${COVERAGE}% |

          _Updated by CI — commit ${COMMIT_SHA}_"

          EXISTING=$(curl -sf -H "Authorization: token ${FORGEJO_TOKEN}" \
            "${API_URL}?limit=50" | \
            php -r '
              $comments = json_decode(file_get_contents("php://stdin"), true);
              if (!is_array($comments)) exit;
              foreach ($comments as $c) {
                if (str_contains($c["body"], "<!-- incr-ci-coverage-report -->")) {
                  echo $c["id"];
                  exit;
                }
              }
            ' || true)

          if [ -n "$EXISTING" ]; then
            curl -sf -X PATCH \
              -H "Authorization: token ${FORGEJO_TOKEN}" \
              -H "Content-Type: application/json" \
              -d "$(php -r 'echo json_encode(["body" => $argv[1]]);' "$BODY")" \
              "${SERVER_URL}/api/v1/repos/${REPO}/issues/comments/${EXISTING}" > /dev/null
          else
            curl -sf -X POST \
              -H "Authorization: token ${FORGEJO_TOKEN}" \
              -H "Content-Type: application/json" \
              -d "$(php -r 'echo json_encode(["body" => $argv[1]]);' "$BODY")" \
              "${API_URL}" > /dev/null
          fi

  build:
    runs-on: docker
    container:
      # Vite 8 needs node >= 22.12, so the CI image's bookworm nodejs is too old
      # for this job and it gets its own image.
      image: node:22-bookworm-slim

    steps:
      # checkout@v4 without git falls back to a REST API tarball download that
      # Forgejo does not serve (404); without ca-certificates git cannot verify
      # the forge's TLS certificate ("CAfile: none").
      - name: Install git
        run: apt-get update && apt-get install -y --no-install-recommends git ca-certificates

      - uses: https://data.forgejo.org/actions/checkout@v4

      - name: Install JS dependencies
        run: npm ci

      - name: Build assets
        run: npm run build