name: CI
# Restrict to branch pushes: an unfiltered `push` also fires for tag refs,
# including the vendor-release tags the bump script creates via the API.
on:
  push:
    branches:
      - '**'

jobs:
  # Lint gate: runs on the plain Docker-backend runner (not the Gentoo
  # container) and must pass before the build job starts. Mirrors the lint job
  # in the homeserver repo; `just lint` runs markdownlint/shellcheck/yamllint/
  # actionlint over the repo.
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # setup-just fetches its binary from GitHub; on a Gitea runner the default
      # github-token is the *Gitea* token (GitHub rejects it 401), so pass none
      # and use GitHub's unauthenticated API.
      - uses: extractions/setup-just@v4
        with:
          github-token: ""

      - uses: taiki-e/install-action@v2
        env:
          GITHUB_TOKEN: ""
        with:
          tool: shellcheck

      - name: Install markdownlint-cli
        run: npm install -g markdownlint-cli

      # actionlint has no maintained setup-action and uv ships via astral.sh;
      # both installers hit their own release assets (no GitHub token needed).
      - name: Install yamllint + actionlint tooling
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh
          bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) latest /usr/local/bin

      - name: Run linters
        run: just lint

  build:
    needs: lint
    # The label only schedules the job on the (Docker-backend) runner; the steps
    # actually run inside the Gentoo container declared below.
    runs-on: ubuntu-latest
    container:
      image: gentoo/stage3:amd64-openrc
    steps:
      # Bootstrap a portage tree (emerge-webrsync ships its own downloader).
      - name: Sync ::gentoo
        run: emerge-webrsync

      # pkgcore (pkgcheck) only reads /etc/portage/repos.conf, and the binhost
      # needs the Gentoo release keys we don't ship — disable binpkg signature
      # verification (ephemeral CI container) so prebuilt deps like dev-lang/go
      # can be pulled instead of compiled.
      - name: Configure portage
        run: |
          mkdir -p /etc/portage/repos.conf
          printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
            > /etc/portage/repos.conf/gentoo.conf
          sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
          printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
          emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck

      # Place this overlay at /var/db/repos/azy5030 via curl + tar. actions/checkout
      # can't run here: this job uses the gentoo/stage3 container, and the Gitea
      # runner executes JS actions with `node` *inside* that container
      # (`docker exec node …`) — stage3 ships no node, so checkout fails with
      # exit 127. (The lint job uses actions/checkout fine: it has no container:
      # and runs in the runner's default node-capable image.)
      - name: Check out overlay
        env:
          TOKEN: ${{ github.token }}
        run: |
          host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
          url="http://x-access-token:${TOKEN}@${host}/${GITHUB_REPOSITORY}/archive/${GITHUB_REF_NAME}.tar.gz"
          curl -fsSL "$url" -o repo.tar.gz
          mkdir -p /var/db/repos/azy5030
          tar xzf repo.tar.gz -C /var/db/repos/azy5030 --strip-components=1
          printf '[azy5030]\nlocation = /var/db/repos/azy5030\nmasters = gentoo\nauto-sync = false\n' \
            > /etc/portage/repos.conf/azy5030.conf
          mkdir -p /etc/portage/package.accept_keywords
          echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
          # Upstream tracks new Go releases faster than Gentoo stabilises them
          # (the ebuild's BDEPEND follows upstream go.mod), so accept the
          # testing-keyworded dev-lang/go. No stable binpkg exists for it, so
          # this compiles Go from source when a newer one is required.
          echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go

      - name: QA scan
        run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner

      # Full source build: portage fetches the upstream source tarball and the
      # vendor tarball (release asset), verifies them against the committed
      # Manifest, then compiles offline from the vendored modules.
      - name: Emerge gitea-runner
        run: emerge -v --getbinpkg dev-util/gitea-runner

      - name: Verify binary
        run: |
          ver=$(find /var/db/repos/azy5030/dev-util/gitea-runner -name 'gitea-runner-*.ebuild' \
            | sed -E 's#.*/gitea-runner-(.*)\.ebuild#\1#' | sort -V | tail -1)
          gitea-runner --version
          gitea-runner --version | grep -q "v${ver}"