main.yml

name: Default
on:
  merge_group:
  push:
    branches:
      - main
      - releases/*
  pull_request:
    types: [ assigned, opened, synchronize, reopened, labeled ]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  PR:
    if: github.event_name == 'pull_request'
    name: Check PR Title
    runs-on: ubuntu-latest
    permissions:
      statuses: write
    steps:
      - uses: amannn/action-semantic-pull-request@v5
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  Dirty:
    runs-on: "ubuntu-latest"
    steps:
      - uses: 'actions/checkout@v4'
        with:
          fetch-depth: 0
      - name: Setup Env
        uses: ./.github/actions/env
        with:
          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
      - run: >
          earthly
          --allow-privileged
          --secret SPEAKEASY_API_KEY=$SPEAKEASY_API_KEY
          ${{ contains(github.event.pull_request.labels.*.name, 'no-cache') && '--no-cache' || '' }}
          +pre-commit
        env:
          SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
      - name: Get changed files
        id: changed-files
        shell: bash
        run: |
          hasChanged=$(git status --porcelain) 
          if (( $(echo ${#hasChanged}) != 0 )); then
            git status
            echo "There are changes in the repository"
            exit 1
          fi

  Tests:
    runs-on: "ubuntu-latest"
    steps:
      - uses: 'actions/checkout@v4'
        with:
          fetch-depth: 0
      - name: Setup Env
        uses: ./.github/actions/env
        with:
          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
      - run: >
          earthly
          --no-output
          --allow-privileged
          --secret SPEAKEASY_API_KEY=$SPEAKEASY_API_KEY
          ${{ contains(github.event.pull_request.labels.*.name, 'no-cache') && '--no-cache' || '' }}
          +tests
        env:
          SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}

  GoReleaser:
    runs-on: "ubuntu-latest"
    if: contains(github.event.pull_request.labels.*.name, 'build-images') || github.ref == 'refs/heads/main' || github.event_name == 'merge_group'
    needs:
      - Dirty
    steps:
      - uses: earthly/actions-setup@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          version: "latest"
      - uses: 'actions/checkout@v4'
        with:
          fetch-depth: 0
      - name: Setup Env
        uses: ./.github/actions/env
        with:
          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: "NumaryBot"
          password: ${{ secrets.NUMARY_GITHUB_TOKEN }}
      - run: >
          earthly
          --no-output
          --allow-privileged
          --secret SPEAKEASY_API_KEY=$SPEAKEASY_API_KEY
          --secret GITHUB_TOKEN=$GITHUB_TOKEN
          --secret FURY_TOKEN=$FURY_TOKEN
          --secret GORELEASER_KEY=$GORELEASER_KEY
          ${{ contains(github.event.pull_request.labels.*.name, 'no-cache') && '--no-cache' || '' }}
          +release --mode=ci
        env:
          GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
          SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}

  Benchmark:
    runs-on: "github-001"
    if: contains(github.event.pull_request.labels.*.name, 'benchmarks') || github.ref == 'refs/heads/main'
    needs:
      - Dirty
    steps:
      - uses: 'actions/checkout@v4'
        with:
          fetch-depth: 0
      - run: >
          earthly
          --allow-privileged
          ${{ contains(github.event.pull_request.labels.*.name, 'no-cache') && '--no-cache' || '' }}
          ./test/performance+run --args="-benchtime 10s"
      - run: >
          earthly
          --allow-privileged
          ${{ contains(github.event.pull_request.labels.*.name, 'no-cache') && '--no-cache' || '' }}
          ./test/performance+generate-graphs
      - uses: actions/upload-artifact@v3
        with:
          name: graphs
          path: test/performance/report

  Deploy:
    runs-on: "ubuntu-latest"
    if: github.ref == 'refs/heads/main'
    environment: staging
    needs:
      - GoReleaser
      - Tests
    steps:
      - uses: earthly/actions-setup@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          version: "latest"
      - uses: 'actions/checkout@v4'
        with:
          fetch-depth: 0
      - name: Tailscale
        uses: tailscale/github-action@v2
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:ci
      - name: "Deploy in staging"
        env:
          TAG: ${{ github.sha }}
          COMPONENT: ledger
          ARGOCD_REGION_AUTH_TOKEN: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }}
        run: >
          earthly  
          --no-output 
          --secret AUTH_TOKEN=$ARGOCD_REGION_AUTH_TOKEN
          +deploy-staging
          --TAG=$TAG
          --COMPONENT=$COMPONENT