ci.yml

# See https://docs.github.com/en/actions/reference/

on: [push]

name: ci

env:
  go-version: 1.25.x
  golangci-version: v2.8.0
  gotestsum-version: v1.13.0
  task-version: v3.40.0

jobs:
  all:
    runs-on: ubuntu-latest
    steps:
      - name: Install Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.go-version }}
      - name: Install Task
        run: go install github.com/go-task/task/v3/cmd/task@${{ env.task-version }}
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          # By default, actions/checkout will persist the GITHUB_TOKEN, so that further
          # steps in the job can perform authenticated git commands (that is: WRITE to
          # the repo). Following the Principle of least privilege, we disable this as long
          # as we don't need it.
          persist-credentials: false
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: ${{ env.golangci-version }}
      - run: task build
      - run: go install gotest.tools/gotestsum@${{ env.gotestsum-version }}
      - run: task test:all
        env:
          COGITO_TEST_OAUTH_TOKEN: ${{ secrets.COGITO_TEST_OAUTH_TOKEN }}
          COGITO_TEST_GCHAT_HOOK: ${{ secrets.COGITO_TEST_GCHAT_HOOK }}
          COGITO_TEST_GH_APP_PRIVATE_KEY: |
            ${{ secrets.COGITO_TEST_GH_APP_PRIVATE_KEY }}
      - run: task docker:build
      - run: task docker:smoke
      - run: task docker:login
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
      - run: task docker:push
      - run: task docker:maybe-push-release
      - run: task ci:teardown
        # ALWAYS run this step, also if any previous step failed.
        if: always()