AndyTranscribe/.gitea/workflows/ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  REGISTRY: gitea.z00.nu
  # Baked into the Vite client bundle for production WebSockets.
  VITE_REVERB_HOST: reverb.transcribe.z00.nu
  VITE_REVERB_PORT: "443"
  VITE_REVERB_SCHEME: https

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        run: |
          set -euo pipefail
          HOST="${{ gitea.server_url }}"
          HOST="${HOST#https://}"
          HOST="${HOST#http://}"
          git clone --depth 1 \
            "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@${HOST}/${{ gitea.repository }}.git" \
            .
          git fetch --depth 1 origin "${{ gitea.sha }}"
          git checkout --force "${{ gitea.sha }}"

      - name: Install PHP dependencies
        run: composer install --no-interaction --prefer-dist --optimize-autoloader

      - name: Build frontend assets
        run: |
          set -euo pipefail
          docker run --rm \
            -u "$(id -u):$(id -g)" \
            -e HOME=/tmp \
            -e VITE_APP_NAME=AndyTranscribe \
            -e VITE_REVERB_APP_KEY=andytranscribe-key \
            -e "VITE_REVERB_HOST=${VITE_REVERB_HOST}" \
            -e "VITE_REVERB_PORT=${VITE_REVERB_PORT}" \
            -e "VITE_REVERB_SCHEME=${VITE_REVERB_SCHEME}" \
            -v "$PWD:/app" \
            -w /app \
            node:22-alpine \
            sh -c "npm ci && npm run build"

      - name: Run tests
        run: |
          set -euo pipefail
          cp .env.example .env
          php artisan key:generate --force --no-interaction
          php -d memory_limit=512M artisan test --compact

      - name: Validate compose
        run: |
          set -euo pipefail
          APP_IMAGE="${REGISTRY}/$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]'):test" \
          APP_KEY="base64:dGVzdC1hcHAta2V5LWZvci1jaS1jb21wb3NlLXZhbGlkYXRpb24=" \
          docker compose -f docker-compose.yml -f compose.z00.yaml config --quiet

  build-and-push:
    if: gitea.event_name != 'pull_request'
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        run: |
          set -euo pipefail
          HOST="${{ gitea.server_url }}"
          HOST="${HOST#https://}"
          HOST="${HOST#http://}"
          git clone --depth 1 \
            "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@${HOST}/${{ gitea.repository }}.git" \
            .
          git fetch --depth 1 origin "${{ gitea.sha }}"
          git checkout --force "${{ gitea.sha }}"

      - name: Build and push image
        run: |
          set -euo pipefail
          REPO_LC="$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]')"
          TAG_SHA="${REGISTRY}/${REPO_LC}:${{ gitea.sha }}"
          TAG_LATEST="${REGISTRY}/${REPO_LC}:latest"
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${REGISTRY}" -u "${{ gitea.actor }}" --password-stdin
          docker build \
            --build-arg VITE_APP_NAME=AndyTranscribe \
            --build-arg VITE_REVERB_APP_KEY=andytranscribe-key \
            --build-arg "VITE_REVERB_HOST=${VITE_REVERB_HOST}" \
            --build-arg "VITE_REVERB_PORT=${VITE_REVERB_PORT}" \
            --build-arg "VITE_REVERB_SCHEME=${VITE_REVERB_SCHEME}" \
            -t "${TAG_SHA}" \
            -t "${TAG_LATEST}" \
            .
          docker push "${TAG_SHA}"
          docker push "${TAG_LATEST}"

  deploy:
    if: gitea.ref == 'refs/heads/main' && gitea.event_name != 'pull_request'
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        run: |
          set -euo pipefail
          HOST="${{ gitea.server_url }}"
          HOST="${HOST#https://}"
          HOST="${HOST#http://}"
          git clone --depth 1 \
            "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@${HOST}/${{ gitea.repository }}.git" \
            .
          git fetch --depth 1 origin "${{ gitea.sha }}"
          git checkout --force "${{ gitea.sha }}"

      - name: Deploy production
        env:
          DEPLOY_PATHS: ${{ secrets.DEPLOY_PATHS }}
        run: |
          set -euo pipefail
          REPO_LC="$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]')"
          export APP_IMAGE="${REGISTRY}/${REPO_LC}:${{ gitea.sha }}"
          chmod +x scripts/deploy-production.sh
          if [ -z "${DEPLOY_PATHS:-}" ]; then
            echo "DEPLOY_PATHS secret is not set; skipping deploy."
            echo "Built image: ${APP_IMAGE}"
            exit 0
          fi
          ./scripts/deploy-production.sh