arr/.gitea/workflows/ci.yml

name: ci

on:
  push:
    branches:
      - main
  pull_request:

env:
  CARGO_TERM_COLOR: always
  # Debug symbols are the bulk of the target/ cache and nothing here reads them.
  CARGO_PROFILE_DEV_DEBUG: "0"

jobs:
  rust:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build deps
        run: |
          # ffmpeg is here for ffprobe: arr-probe's tests run it against the
          # committed fixture clips (DESIGN.md §12).
          apt-get update
          apt-get install -y --no-install-recommends \
            git curl ca-certificates build-essential pkg-config \
            ffmpeg

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Toolchain
        run: |
          if ! command -v cargo >/dev/null; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
              | sh -s -- -y --profile minimal --no-modify-path
          fi
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Gate tools
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          # Prebuilt binaries — `cargo install` from source costs minutes.
          command -v cargo-nextest >/dev/null || \
            curl -LsSf https://get.nexte.st/latest/linux \
              | tar zxf - -C "$HOME/.cargo/bin"
          command -v cargo-machete >/dev/null || \
            cargo install cargo-machete --locked

      - name: fmt
        run: cargo fmt --all -- --check

      - name: clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: unused deps
        run: cargo machete

      - name: test
        run: cargo nextest run --workspace --exclude arr-e2e

  web:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Skip when the frontend does not exist yet
        id: probe
        run: |
          if [ -f web/package.json ]; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "present=false" >> "$GITHUB_OUTPUT"
            echo "web/ not present yet (issue #6), skipping"
          fi

      - name: Node and pnpm
        if: steps.probe.outputs.present == 'true'
        run: |
          apt-get update
          apt-get install -y --no-install-recommends curl ca-certificates
          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
          apt-get install -y --no-install-recommends nodejs
          corepack enable
          # Prepare the exact version package.json pins; corepack refuses to
          # run a mismatched version under a packageManager pin.
          corepack prepare "$(node -p "require('./web/package.json').packageManager")" --activate

      - name: Cache pnpm store
        if: steps.probe.outputs.present == 'true'
        uses: actions/cache@v4
        with:
          path: ~/.local/share/pnpm/store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('web/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: install
        if: steps.probe.outputs.present == 'true'
        run: pnpm -C web install --frozen-lockfile

      - name: biome
        if: steps.probe.outputs.present == 'true'
        run: pnpm -C web exec biome ci .

      - name: typecheck
        if: steps.probe.outputs.present == 'true'
        run: pnpm -C web exec tsc -b --noEmit

      - name: design tokens
        if: steps.probe.outputs.present == 'true'
        run: pnpm -C web run check-tokens

  # Build the production image here rather than on the Dokploy host: the gate
  # above has to pass first, the layer cache lives in the registry instead of
  # being thrown away every deploy, and Dokploy's job shrinks to a pull.
  #
  # This job is also the deploy trigger. The Gitea push webhook fires the
  # instant the commit lands, long before the image exists, so autoDeploy on
  # the Dokploy application must stay off — the deploy is the last step here.
  image:
    needs: [rust, web]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    env:
      IMAGE: git.naps.pt/yolo/arr
      DOKPLOY_APP_ID: uEaWG5JDpVIrJloG5rMAP
    steps:
      - uses: actions/checkout@v4

      - name: Docker CLI and buildx
        run: |
          apt-get update
          apt-get install -y --no-install-recommends ca-certificates curl gnupg
          . /etc/os-release
          install -m 0755 -d /etc/apt/keyrings
          curl -fsSL "https://download.docker.com/linux/$ID/gpg" \
            -o /etc/apt/keyrings/docker.asc
          chmod a+r /etc/apt/keyrings/docker.asc
          echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc]" \
               "https://download.docker.com/linux/$ID $VERSION_CODENAME stable" \
            > /etc/apt/sources.list.d/docker.list
          apt-get update
          apt-get install -y --no-install-recommends docker-ce-cli docker-buildx-plugin
          docker version

      - name: Registry login
        run: |
          printf '%s' "${{ secrets.REGISTRY_TOKEN }}" \
            | docker login git.naps.pt -u "${{ secrets.REGISTRY_USER }}" --password-stdin

      - name: Buildx builder
        # The default docker driver cannot export a cache. docker-container can.
        run: docker buildx create --name arr --driver docker-container --use

      - name: Build and push
        run: |
          docker buildx build \
            --tag "$IMAGE:sha-$GITHUB_SHA" \
            --tag "$IMAGE:main" \
            --cache-from "type=registry,ref=$IMAGE:buildcache" \
            --cache-to "type=registry,ref=$IMAGE:buildcache,mode=max" \
            --push .

      - name: Deploy
        # Pinned to the commit sha, not :main — swarm does not reliably re-pull
        # an unchanged tag name, and an older sha is the rollback.
        run: |
          # The package is public (org yolo is public), so Dokploy pulls with
          # no credentials and the registry fields stay null.
          curl -fsS -X POST https://dokploy.n62.casa/api/application.update \
            -H "x-api-key: ${{ secrets.DOKPLOY_API_KEY }}" \
            -H 'content-type: application/json' \
            -d "{\"applicationId\":\"$DOKPLOY_APP_ID\",\"dockerImage\":\"$IMAGE:sha-$GITHUB_SHA\"}"
          curl -fsS -X POST https://dokploy.n62.casa/api/application.deploy \
            -H "x-api-key: ${{ secrets.DOKPLOY_API_KEY }}" \
            -H 'content-type: application/json' \
            -d "{\"applicationId\":\"$DOKPLOY_APP_ID\",\"title\":\"ci ${GITHUB_SHA:0:8}\"}"