FOSSBilling/.github/workflows/ci.yml

name: CI

permissions:
  contents: read

on:
  push:
  pull_request:
    branches: main
    types: [opened, reopened, synchronize, labeled, unlabeled]
  pull_request_target:
    branches: main
    types: [opened, reopened, synchronize]

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && (github.event.action == 'labeled' || github.event.action == 'unlabeled') && 'labels' || 'run' }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  merge-hold:
    name: 'Check for Merge Hold'
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: 'Check merge-hold label'
        run: |
          if [[ "${{ contains(github.event.pull_request.labels.*.name, 'merge-hold') }}" == 'true' ]]; then
            echo "Pull request labeled 'merge-hold'"
            echo "The pull request cannot be merged until the 'merge-hold' label is removed."
            exit 1
          fi

          echo "Pull request not labeled 'merge-hold'"
          echo "The pull request can be merged as no 'merge-hold' label is set."

  labeler:
    name: 'Pull Request Labeler'
    permissions:
      contents: read
      pull-requests: write
    if: ${{ github.event_name == 'pull_request_target' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6
        with:
          repo-token: '${{ secrets.GITHUB_TOKEN }}'
          sync-labels: true

  release-drafter:
    name: 'Release Drafter'
    permissions:
      contents: write
      pull-requests: read
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: release-drafter/release-drafter@693d20e7c1ce1a81d3a41962f85914253b518449 # v7
        with:
          config-name: release-drafter.yml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  spellcheck:
    name: 'Spellcheck'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: ${{ (github.event_name == 'pull_request' && github.event.action != 'labeled' && github.event.action != 'unlabeled' && github.event.pull_request.base.repo.id != github.event.pull_request.head.repo.id) || github.event_name == 'push' }}
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: 'Perform Spellcheck'
        uses: streetsidesoftware/cspell-action@de2a73e963e7443969755b648a1008f77033c5b2 # v8
        with:
          incremental_files_only: true

  php-build-test-pr:
    name: 'PHP Build and Test'
    # Keep PR and push callers separate because job permissions cannot be conditional.
    permissions:
      contents: read
    needs: [ spellcheck ]
    if: ${{ github.event_name == 'pull_request' && github.event.action != 'labeled' && github.event.action != 'unlabeled' && github.event.pull_request.base.repo.id != github.event.pull_request.head.repo.id }}
    uses: ./.github/workflows/php-build-test.yml
    with:
      write-cache: false

  php-build-test-push:
    name: 'PHP Build and Test'
    permissions:
      contents: read
      packages: write
    needs: [ spellcheck ]
    if: ${{ github.event_name == 'push' }}
    uses: ./.github/workflows/php-build-test.yml
    with:
      write-cache: true

  live-tests-pr:
    name: 'Live Tests'
    permissions:
      contents: read
    needs: [ php-build-test-pr ]
    if: ${{ github.event_name == 'pull_request' && github.event.action != 'labeled' && github.event.action != 'unlabeled' && github.event.pull_request.base.repo.id != github.event.pull_request.head.repo.id }}
    uses: ./.github/workflows/live-tests.yml

  live-tests-push:
    name: 'Live Tests'
    permissions:
      contents: read
    needs: [ php-build-test-push ]
    if: ${{ github.event_name == 'push' }}
    uses: ./.github/workflows/live-tests.yml

  browser-tests-pr:
    name: 'Browser Tests'
    permissions:
      contents: read
    needs: [ php-build-test-pr ]
    if: ${{ github.event_name == 'pull_request' && github.event.action != 'labeled' && github.event.action != 'unlabeled' && github.event.pull_request.base.repo.id != github.event.pull_request.head.repo.id }}
    uses: ./.github/workflows/browser-tests.yml

  browser-tests-push:
    name: 'Browser Tests'
    permissions:
      contents: read
    needs: [ php-build-test-push ]
    if: ${{ github.event_name == 'push' }}
    uses: ./.github/workflows/browser-tests.yml

  preview-build-pr:
    name: 'Create Preview Build'
    permissions:
      contents: read
    needs: [ live-tests-pr, browser-tests-pr ]
    if: ${{ github.event_name == 'pull_request' && github.event.action != 'labeled' && github.event.action != 'unlabeled' && github.event.pull_request.base.repo.id != github.event.pull_request.head.repo.id }}
    uses: ./.github/workflows/preview-build.yml
    with:
      write-cache: false

  preview-build-push:
    name: 'Create Preview Build'
    permissions:
      contents: read
      packages: write
    needs: [ live-tests-push, browser-tests-push ]
    if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}
    uses: ./.github/workflows/preview-build.yml
    with:
      write-cache: true

  preview-docker:
    name: 'Build and Push Preview Docker Image'
    permissions:
      contents: read
      packages: write
    needs: [ live-tests-push, browser-tests-push ]
    if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
    uses: ./.github/workflows/docker-build.yml
    secrets:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
    with:
      target: runtime
      cache-scope: cache-preview
      extract-release-tree: true
      release-tree-artifact-name: preview-build
      meta-images: fossbilling/fossbilling
      meta-tags: |
        type=raw,value=preview
      meta-flavor: |
        latest=false
      build-args: |
        FOSSBILLING_VERSION=${{ github.sha }}
        FOSSBILLING_VERSION_TRUNCATE=7
        SENTRY_DSN=${{ vars.SENTRY_DSN }}

  upload-preview:
    name: 'Upload Preview Release'
    needs: [ preview-build-pr, preview-build-push, preview-docker ]
    if: ${{ !cancelled() && (needs['preview-build-pr'].result == 'success' || needs['preview-build-push'].result == 'success' || needs['preview-docker'].result == 'success') }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: 'Download Preview Release Archive'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: preview-build
          path: '/tmp'

      - name: 'Extract Preview Release Archive'
        run: |
          mkdir ./src
          tar -xf /tmp/build.tar -C ./src
          rm -f ./src/provenance.json

      - name: 'Create Downloadable Preview'
        run: zip -qr ../FOSSBilling-preview.zip .
        working-directory: ./src/

      - name: 'Move Downloadable Preview for Upload'
        run: |
          mkdir ./dist
          mv ./FOSSBilling-preview.zip ./dist

      - name: 'Upload Downloadable Preview to S3'
        if: ${{ github.ref == 'refs/heads/main' }}
        uses: jakejarvis/s3-sync-action@7ed8b112447abb09f1da74f3466e4194fc7a6311 # master
        with:
          args: '--acl public-read --follow-symlinks'
        env:
          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_S3_ENDPOINT: ${{ secrets.AWS_S3_ENDPOINT }}
          AWS_REGION: 'auto'
          SOURCE_DIR: './dist'

      - name: 'Upload Downloadable Preview to GitHub'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          if-no-files-found: 'error'
          name: 'FOSSBilling Preview'
          path: './src/*'
          retention-days: 14