chore: remove forgejo workflows and refresh TODO #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: python:3.13-slim | |
| services: | |
| postgres: | |
| image: postgres:17 | |
| env: | |
| POSTGRES_USER: wiregui | |
| POSTGRES_PASSWORD: wiregui | |
| POSTGRES_DB: wiregui | |
| options: >- | |
| --health-cmd "pg_isready -U wiregui" | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| valkey: | |
| image: valkey/valkey:8 | |
| options: >- | |
| --health-cmd "valkey-cli ping" | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| mock-oidc: | |
| image: ghcr.io/navikt/mock-oauth2-server:2.1.10 | |
| ports: | |
| - 9000:9000 | |
| env: | |
| SERVER_PORT: "9000" | |
| JSON_CONFIG: > | |
| { | |
| "interactiveLogin": true, | |
| "httpServer": "NettyWrapper", | |
| "tokenCallbacks": [ | |
| { | |
| "issuerId": "test-idp", | |
| "tokenExpiry": 3600, | |
| "requestMappings": [ | |
| { | |
| "requestParam": "scope", | |
| "match": "*", | |
| "claims": { | |
| "sub": "$${claim:sub}", | |
| "email": "$${claim:sub}@test.local", | |
| "name": "Test User" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| env: | |
| CI: "true" | |
| WG_DATABASE_URL: postgresql+asyncpg://wiregui:wiregui@postgres/wiregui | |
| WG_REDIS_URL: redis://valkey:6379/0 | |
| MOCK_OIDC_HOST: mock-oidc | |
| steps: | |
| - name: Install system dependencies | |
| run: | | |
| apt-get update && apt-get install -y --no-install-recommends \ | |
| git wireguard-tools pkg-config libxml2-dev libxmlsec1-dev libxmlsec1-openssl | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Install uv | |
| run: pip install uv | |
| - name: Install dependencies | |
| run: uv sync | |
| - name: Install Playwright browsers | |
| run: uv run playwright install --with-deps chromium | |
| - name: Run unit tests | |
| run: uv run pytest tests/ --ignore=tests/e2e -v --tb=short | |
| - name: Run E2E tests | |
| run: | | |
| uv run alembic upgrade head | |
| uv run pytest tests/e2e/ -v --tb=short | |
| release: | |
| needs: test | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| new_tag: ${{ steps.version.outputs.new_tag }} | |
| new_version: ${{ steps.version.outputs.new_version }} | |
| skip: ${{ steps.version.outputs.skip }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Configure git | |
| run: | | |
| git config user.name "GitHub Actions" | |
| git config user.email "noreply@github.com" | |
| - name: Determine version bump | |
| id: version | |
| shell: bash | |
| run: | | |
| LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0") | |
| echo "latest_tag=${LATEST_TAG}" >> "$GITHUB_OUTPUT" | |
| CURRENT="${LATEST_TAG#v}" | |
| IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT" | |
| COMMITS=$(git log "${LATEST_TAG}..HEAD" --pretty=format:"%s" 2>/dev/null || git log --pretty=format:"%s") | |
| BUMP="none" | |
| while IFS= read -r msg; do | |
| case "$msg" in | |
| *"BREAKING CHANGE"*|*"!:"*) | |
| BUMP="major" | |
| break | |
| ;; | |
| feat:*|feat\(*) | |
| [ "$BUMP" != "major" ] && BUMP="minor" | |
| ;; | |
| fix:*|fix\(*|perf:*|perf\(*|refactor:*|refactor\(*) | |
| [ "$BUMP" = "none" ] && BUMP="patch" | |
| ;; | |
| esac | |
| done <<< "$COMMITS" | |
| if [ "$BUMP" = "none" ]; then | |
| echo "No version-relevant commits since ${LATEST_TAG}, skipping release" | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| case "$BUMP" in | |
| major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;; | |
| minor) MINOR=$((MINOR + 1)); PATCH=0 ;; | |
| patch) PATCH=$((PATCH + 1)) ;; | |
| esac | |
| NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}" | |
| echo "new_version=${NEW_VERSION}" >> "$GITHUB_OUTPUT" | |
| echo "new_tag=v${NEW_VERSION}" >> "$GITHUB_OUTPUT" | |
| echo "bump=${BUMP}" >> "$GITHUB_OUTPUT" | |
| echo "skip=false" >> "$GITHUB_OUTPUT" | |
| echo "Version bump: ${BUMP} -> v${NEW_VERSION}" | |
| - name: Generate changelog | |
| id: changelog | |
| if: steps.version.outputs.skip != 'true' | |
| shell: bash | |
| run: | | |
| LATEST_TAG="${{ steps.version.outputs.latest_tag }}" | |
| NEW_TAG="${{ steps.version.outputs.new_tag }}" | |
| BODY="## ${NEW_TAG}"$'\n\n' | |
| for type_label in "feat:Features" "fix:Bug Fixes" "refactor:Refactoring" "perf:Performance" "docs:Documentation" "chore:Maintenance"; do | |
| prefix="${type_label%%:*}" | |
| label="${type_label#*:}" | |
| MATCHES=$(git log "${LATEST_TAG}..HEAD" --pretty=format:"%s" 2>/dev/null | grep -E "^${prefix}[:(]" || true) | |
| if [ -n "$MATCHES" ]; then | |
| BODY="${BODY}### ${label}"$'\n\n' | |
| while IFS= read -r line; do | |
| CLEAN=$(echo "$line" | sed -E "s/^${prefix}(\([^)]*\))?:\s*//") | |
| BODY="${BODY}- ${CLEAN}"$'\n' | |
| done <<< "$MATCHES" | |
| BODY="${BODY}"$'\n' | |
| fi | |
| done | |
| echo "${BODY}" > /tmp/changelog.md | |
| echo "Generated changelog for ${NEW_TAG}" | |
| - name: Create tag and release | |
| if: steps.version.outputs.skip != 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| NEW_TAG="${{ steps.version.outputs.new_tag }}" | |
| git tag -a "${NEW_TAG}" -m "Release ${NEW_TAG}" | |
| git push origin "${NEW_TAG}" | |
| gh release create "${NEW_TAG}" \ | |
| --title "${NEW_TAG}" \ | |
| --notes-file /tmp/changelog.md | |
| docker: | |
| needs: release | |
| if: needs.release.outputs.skip != 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push image | |
| run: | | |
| VERSION="${{ needs.release.outputs.new_version }}" | |
| TAG="${{ needs.release.outputs.new_tag }}" | |
| IMAGE="ghcr.io/${{ github.repository_owner }}/wiregui" | |
| MAJOR=$(echo "$VERSION" | cut -d. -f1) | |
| MINOR=$(echo "$VERSION" | cut -d. -f2) | |
| echo "Building ${IMAGE}:${TAG}" | |
| docker build --no-cache \ | |
| --build-arg "VERSION=${VERSION}" \ | |
| -t "${IMAGE}:${TAG}" \ | |
| -t "${IMAGE}:${MAJOR}.${MINOR}" \ | |
| -t "${IMAGE}:latest" \ | |
| . | |
| docker push "${IMAGE}:${TAG}" | |
| docker push "${IMAGE}:${MAJOR}.${MINOR}" | |
| docker push "${IMAGE}:latest" | |
| echo "Pushed ${IMAGE}:${TAG}, ${IMAGE}:${MAJOR}.${MINOR}, ${IMAGE}:latest" |