ci.yml

---
name: CI
permissions:
  contents: read

on:
  pull_request:
    branches:
      - master
    types:
      - opened
      - synchronize
      - reopened
  push:
    branches:
      - master
  workflow_dispatch:

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

jobs:
  github-env:
    name: GitHub Env Debug
    uses: LizardByte/.github/.github/workflows/__call-github-env.yml@master

  release-setup:
    name: Release Setup
    outputs:
      publish_release: ${{ steps.release-setup.outputs.publish_release }}
      release_body: ${{ steps.release-setup.outputs.release_body }}
      release_commit: ${{ steps.release-setup.outputs.release_commit }}
      release_generate_release_notes: ${{ steps.release-setup.outputs.release_generate_release_notes }}
      release_tag: ${{ steps.release-setup.outputs.release_tag }}
      release_version: ${{ steps.release-setup.outputs.release_version }}
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Release Setup
        id: release-setup
        uses: LizardByte/actions/actions/release_setup@4586d7925d5781050fec9819bd497106a7ae2ba3  # v2025.1221.31807

        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}

  build-docker:
    name: Docker
    needs: release-setup
    permissions:
      contents: read
      packages: write
    uses: LizardByte/.github/.github/workflows/__call-docker.yml@master
    with:
      maximize_build_space: true
      publish_release: ${{ needs.release-setup.outputs.publish_release }}
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_tag: ${{ needs.release-setup.outputs.release_tag }}
      release_version: ${{ needs.release-setup.outputs.release_version }}
    secrets:
      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
      DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
      GH_BOT_NAME: ${{ secrets.GH_BOT_NAME }}
      GH_BOT_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-freebsd:
    name: FreeBSD
    needs: release-setup
    uses: ./.github/workflows/ci-freebsd.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  build-homebrew:
    name: Homebrew
    needs: release-setup
    uses: ./.github/workflows/ci-homebrew.yml
    with:
      publish_release: ${{ needs.release-setup.outputs.publish_release }}
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_tag: ${{ needs.release-setup.outputs.release_tag }}
      release_version: ${{ needs.release-setup.outputs.release_version }}
    secrets:
      GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
      GIT_EMAIL: ${{ secrets.GH_BOT_EMAIL }}
      GIT_USERNAME: ${{ secrets.GH_BOT_NAME }}

  build-linux:
    name: Linux
    needs: release-setup
    uses: ./.github/workflows/ci-linux.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  build-archlinux:
    name: Archlinux
    needs: release-setup
    uses: ./.github/workflows/ci-archlinux.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  build-linux-copr:
    name: Linux Copr
    if: github.event_name != 'push'  # releases are handled directly in ci-copr.yml
    needs: release-setup
    permissions:
      contents: write  # needed to update releases
    uses: ./.github/workflows/ci-copr.yml
    secrets:
      COPR_BETA_WEBHOOK_TOKEN: ${{ secrets.COPR_BETA_WEBHOOK_TOKEN }}
      COPR_STABLE_WEBHOOK_TOKEN: ${{ secrets.COPR_STABLE_WEBHOOK_TOKEN }}
      COPR_CLI_CONFIG: ${{ secrets.COPR_CLI_CONFIG }}

  build-linux-flatpak:
    name: Linux Flatpak
    needs: release-setup
    uses: ./.github/workflows/ci-flatpak.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  build-windows:
    name: Windows
    needs: release-setup
    uses: ./.github/workflows/ci-windows.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  bundle-analysis:
    name: Bundle Analysis
    needs: release-setup
    uses: ./.github/workflows/ci-bundle.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  coverage:
    name: Coverage-${{ matrix.name }}
    if: >-
      always() &&
      !cancelled() &&
      startsWith(github.repository, 'LizardByte/')
    needs:
      - build-freebsd
      - build-linux
      - build-archlinux
      - build-linux-flatpak
      - build-homebrew
      - build-windows
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: FreeBSD-14.3-amd64
            coverage: true
            pr: true
          - name: FreeBSD-14.3-aarch64
            coverage: true
            pr: false
          - name: Linux-AppImage
            coverage: true
            pr: true
          - name: Archlinux
            coverage: true
            pr: true
          - name: Homebrew-macos-14
            coverage: false
            pr: true
          - name: Homebrew-macos-15
            coverage: false
            pr: true
          - name: Homebrew-macos-26
            coverage: false
            pr: true
          - name: Homebrew-ubuntu-22.04
            coverage: true
            pr: true
          - name: Windows-AMD64
            coverage: true
            pr: true
    steps:
      - name: Should run
        id: should_run
        run: |
          should_run="false"
          if [ "${GITHUB_EVENT_NAME}" != "pull_request" ] || [ ${{ matrix.pr }} == "true" ]; then
            should_run="true"
          fi
          echo "SHOULD_RUN=${should_run}" >> "${GITHUB_OUTPUT}"

      - name: Checkout
        if: steps.should_run.outputs.SHOULD_RUN == 'true'
        uses: actions/checkout@v6

      - name: Download coverage artifact
        if: steps.should_run.outputs.SHOULD_RUN == 'true'
        uses: actions/download-artifact@v7
        with:
          name: coverage-${{ matrix.name }}
          path: _coverage

      - name: Upload test results
        if: steps.should_run.outputs.SHOULD_RUN == 'true'
        uses: codecov/test-results-action@v1
        with:
          disable_search: true
          fail_ci_if_error: true
          files: ./_coverage/tests/test_results.xml
          flags: ${{ matrix.name }}
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: true

      - name: Upload coverage
        if: |
          steps.should_run.outputs.SHOULD_RUN == 'true'  &&
          matrix.coverage != false
        uses: codecov/codecov-action@v5
        with:
          disable_search: true
          fail_ci_if_error: true
          files: ./_coverage/coverage.xml
          flags: ${{ matrix.name }}
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: true

  release:
    name: Release
    if:
      needs.release-setup.outputs.publish_release == 'true' &&
      startsWith(github.repository, 'LizardByte/')
    needs:
      - release-setup
      - build-archlinux
      - build-docker
      - build-freebsd
      - build-homebrew
      - build-linux
      - build-linux-flatpak
      - build-windows
    runs-on: ubuntu-latest
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v7
        with:
          path: artifacts
          pattern: build-*
          merge-multiple: true

      - name: Debug artifacts
        run: ls -l artifacts

      - name: Create/Update GitHub Release
        uses: LizardByte/actions/actions/release_create@4586d7925d5781050fec9819bd497106a7ae2ba3  # v2025.1221.31807
        with:
          allowUpdates: false
          body: ${{ needs.release-setup.outputs.release_body }}
          generateReleaseNotes: ${{ needs.release-setup.outputs.release_generate_release_notes }}
          name: ${{ needs.release-setup.outputs.release_tag }}
          prerelease: true
          tag: ${{ needs.release-setup.outputs.release_tag }}
          token: ${{ secrets.GH_BOT_TOKEN }}
          virustotal_api_key: ${{ secrets.VIRUSTOTAL_API_KEY }}

  release-homebrew-beta:
    name: Release Homebrew Beta
    if:
      needs.release-setup.outputs.publish_release == 'true' &&
      startsWith(github.repository, 'LizardByte/')
    needs:
      - release-setup
      - build-homebrew
      - release
    runs-on: ubuntu-latest
    steps:
      - name: Download homebrew artifacts
        uses: actions/download-artifact@v7
        with:
          name: beta-Homebrew
          path: homebrew

      - name: Upload Homebrew Beta Formula
        uses: LizardByte/actions/actions/release_homebrew@4586d7925d5781050fec9819bd497106a7ae2ba3  # v2025.1221.31807
        with:
          formula_file: ${{ github.workspace }}/homebrew/sunshine-beta.rb
          git_email: ${{ secrets.GH_BOT_EMAIL }}
          git_username: ${{ secrets.GH_BOT_NAME }}
          publish: true
          token: ${{ secrets.GH_BOT_TOKEN }}
          validate: false