name: Test, build and publish

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_INCREMENTAL: '0'
  CARGO_PROFILE_DEV_DEBUG: '0'
  CARGO_PROFILE_TEST_DEBUG: '0'
  RUST_BACKTRACE: '1'

jobs:
  verify:
    name: All tests and Linux binary
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Install native test dependencies and make room for 10 GiB tests
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends build-essential pkg-config libssl-dev libicu-dev lua5.4 liblua5.4-dev lua-filesystem lua-expat lua-socket lua-sec openssl
          rust_version=$(python3 -c 'import tomllib; print(tomllib.load(open("rust-toolchain.toml", "rb"))["toolchain"]["channel"])')
          rustup toolchain install "$rust_version" --profile minimal --component rustfmt --component clippy
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - uses: actions/setup-go@v5
        with:
          go-version: '1.24.3'
          cache: false
      - name: Build exact native Prosody reference
        run: bash scripts/ci/prepare-reference.sh "$RUNNER_TEMP/reference"
      - name: Build genuine MinIO
        run: |
          bash scripts/ci/prepare-minio.sh "$RUNNER_TEMP/minio"
          go clean -cache -modcache
          df -h . "$RUNNER_TEMP"
          python3 -c 'import shutil; assert shutil.disk_usage(".").free >= 20 * 2**30, "Need 20 GiB free for actual upload tests"'
      - name: Run every test, native oracle, load and real 10 GiB uploads
        env:
          PROSODY_REFERENCE_SOURCE: ${{ runner.temp }}/reference/prosody-cafd74b9c5ea
          PROSODY_REFERENCE_LUA: lua5.4
          MINIO_BINARY: ${{ runner.temp }}/minio
        run: |
          mkdir -p ci-results
          set -o pipefail
          bash scripts/ci/verify-all.sh 2>&1 | tee ci-results/verify.log
      - name: Package tested binary
        run: |
          mkdir -p dist
          cp target/release/rust-xmpp dist/rust-xmpp
          chmod 0755 dist/rust-xmpp
          dist/rust-xmpp --version
          (cd dist && sha256sum rust-xmpp > SHA256SUMS)
      - name: Save binary
        uses: actions/upload-artifact@v4
        with:
          name: rust-xmpp-linux-amd64
          path: dist/
          if-no-files-found: error
          retention-days: 30
      - name: Save test reports even on failure
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: |
            ci-results/
            /tmp/muc-sm-load.json
            /tmp/xmpp-message-latency.json
            /tmp/personal-message-latency.json
            /tmp/push-latency.json
            /tmp/push-offline-latency.json
            /tmp/bind2-archive-latency.json
          if-no-files-found: warn
          retention-days: 14

  image:
    name: Container smoke test and Gitea publish
    needs: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    # Only the publication job needs registry credentials. PRs still build and test images.
    env:
      GITEA_REGISTRY: ${{ vars.GITEA_REGISTRY }}
      GITEA_IMAGE: ${{ vars.GITEA_IMAGE }}
      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      PUBLISH: ${{ github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || startsWith(github.ref, 'refs/tags/v')) }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v4
        with:
          name: rust-xmpp-linux-amd64
          path: dist
      - name: Verify downloaded executable
        run: |
          (cd dist && sha256sum --check SHA256SUMS)
          chmod 0755 dist/rust-xmpp
      - uses: docker/setup-buildx-action@v3
      - name: Build exact tested binary into runtime image
        uses: docker/build-push-action@v6
        with:
          context: .
          target: ci-runtime
          platforms: linux/amd64
          load: true
          push: false
          tags: rust-xmpp:ci
      - name: Smoke-test runtime image
        run: |
          docker run --rm rust-xmpp:ci --version
          docker run --rm --entrypoint /usr/local/bin/prosodyctl rust-xmpp:ci --version
          id=$(docker create rust-xmpp:ci)
          trap 'docker rm "$id" >/dev/null' EXIT
          docker cp "$id:/usr/local/bin/rust-xmpp" /tmp/container-rust-xmpp
          cmp dist/rust-xmpp /tmp/container-rust-xmpp
      - name: Validate publication configuration
        if: env.PUBLISH == 'true'
        env:
          REGISTRY_USER: ${{ secrets.GITEA_REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.GITEA_REGISTRY_TOKEN }}
        run: python3 scripts/ci/image-tags.py
        id: image
      - name: Login to private Gitea registry
        if: env.PUBLISH == 'true'
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.GITEA_REGISTRY }}
          username: ${{ secrets.GITEA_REGISTRY_USERNAME }}
          password: ${{ secrets.GITEA_REGISTRY_TOKEN }}
      - name: Push the smoke-tested image
        if: env.PUBLISH == 'true'
        env:
          IMAGE_TAGS: ${{ steps.image.outputs.tags }}
        run: |
          while IFS= read -r tag; do
            docker tag rust-xmpp:ci "$tag"
            docker push "$tag"
            printf 'Published `%s`\n' "$tag" >> "$GITHUB_STEP_SUMMARY"
          done <<< "$IMAGE_TAGS"