ci.yml

name: Run CI

# Run this workflow every time a new commit pushed to your repository
on:
  push:
    branches:
      - main
      - stable/*
    tags:
      - '*'
  pull_request:
  workflow_dispatch:

env:
  IMAGE_NAME: maykinmedia/open-archiefbeheer
  DJANGO_SETTINGS_MODULE: openarchiefbeheer.conf.ci
  DOCKER_BUILDKIT: '1'
  KEYCLOAK_BASE_URL: http://localhost:28080

jobs:
  frontend-build:
    name: Build frontend
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: frontend

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: 'frontend/.nvmrc'

      - name: Build Javascript
        run: |
          npm ci --legacy-peer-deps
          CI=false npm run build 
        env: 
          REACT_APP_API_URL: "http://localhost:8000"

      - uses: actions/upload-artifact@v4
        with:
          name: build
          path: ${{ github.workspace }}/frontend/build/
          retention-days: 1
          if-no-files-found: error


  backend-tests:
    name: Run the Django test suite
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: backend

    services:
      postgres:
        image: postgis/postgis:14-3.4
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        # Needed because the postgres container does not provide a healthcheck
        options:
          --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
          --name postgres
      redis:
        image: redis:6
        ports:
          - 6379:6379
    steps:
      - uses: actions/checkout@v4
      - name: Set up backend environment
        uses: maykinmedia/setup-django-backend@v1.3
        with:
          apt-packages: 'gettext postgresql-client libgdal-dev libyaml-dev gdal-bin'
          python-version: '3.12'
          optimize-postgres: 'yes'
          pg-service: 'postgres'
          setup-node: 'yes'
          npm-ci-flags: '--legacy-peer-deps'
          working-directory: backend
          nvmrc-custom-dir: backend

      - name: Run tests
        working-directory: backend
        run: |
          python src/manage.py compilemessages
          python src/manage.py collectstatic --noinput --link
          coverage run src/manage.py test openarchiefbeheer --exclude-tag=e2e
          coverage xml -o coverage.xml
        env:
          DJANGO_SETTINGS_MODULE: openarchiefbeheer.conf.ci
          SECRET_KEY: dummy
          DB_USER: postgres
          DB_PASSWORD: ''

      - name: Publish coverage report
        uses: codecov/codecov-action@v3.1.4
        with:
          working-directory: backend
          files: ./coverage.xml
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  frontend-tests:
    name: Run storybook tests
    needs: frontend-build
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: frontend

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: 'frontend/.nvmrc'

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright
        run: npx playwright install --with-deps

      - name: Build Storybook
        run: npm run build-storybook

      - name: Run jest tests
        run: npm run test:coverage

      - name: Serve Storybook and run tests
        run: |
          npx concurrently -k -s first -n "SB,TEST" -c "magenta,blue" \
            "npx http-server storybook-static --port 6006" \
            "npx wait-on tcp:127.0.0.1:6006 && npm run test-storybook"

      - name: Publish coverage report
        uses: codecov/codecov-action@v3.1.4
        with:
          working-directory: frontend/coverage
          files: ./clover.xml
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  e2e-tests:
    runs-on: ubuntu-latest
    needs: frontend-build
    strategy:
      fail-fast: false
      matrix:
        browser:
          - chromium
          - firefox
          - webkit
    
    name: End-to-end tests, ${{ matrix.browser }}

    defaults:
      run:
        working-directory: backend

    services:
      postgres:
        image: postgis/postgis:14-3.4
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        # Needed because the postgres container does not provide a healthcheck
        options:
          --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
          --name postgres
      redis:
        image: redis:6
        ports:
          - 6379:6379

    steps:
      - uses: actions/checkout@v4
      - name: Set up backend environment
        uses: maykinmedia/setup-django-backend@v1.3
        with:
          apt-packages: 'gettext postgresql-client libgdal-dev libyaml-dev gdal-bin'
          python-version: '3.12'
          optimize-postgres: 'yes'
          pg-service: 'postgres'
          setup-node: 'yes'
          npm-ci-flags: '--legacy-peer-deps'
          working-directory: backend
          nvmrc-custom-dir: backend
      
      - name: Start CI docker services
        run: |
          docker compose up -d
        working-directory: backend/docker-services/keycloak

      - name: Wait for Keycloak to be up
        run: |
          endpoint="${KEYCLOAK_BASE_URL}/realms/openarchiefbeheer-dev/"
          realm=""

          until [ $realm ]; do
            echo "Checking if Keycloak at ${KEYCLOAK_BASE_URL} is up..."
            realm=$(curl "$endpoint" -s | jq -r ".realm")
            sleep 2
          done

          echo "Running Keycloak with realm $realm"

      # See https://playwright.dev/python/docs/ci#caching-browsers
      - name: Cache Playwright browser
        id: cache-browser
        uses: actions/cache@v4
        with:
          path: /home/runner/.cache/ms-playwright
          key:
            ${{ runner.os }}-${{ matrix.browser }}-playwright-${{ hashFiles('requirements/ci.txt') }}

      - name: Install playwright deps
        run: playwright install --with-deps ${{ matrix.browser }}

      - uses: actions/download-artifact@v4
        with:
          name: build
          path: ${{ github.workspace }}/frontend/build

      - name: Run tests
        working-directory: backend
        run: |
          ln -s ${{ github.workspace }}/frontend/build/static/css ${{ github.workspace }}/backend/src/openarchiefbeheer/static/css
          ln -s ${{ github.workspace }}/frontend/build/static/js ${{ github.workspace }}/backend/src/openarchiefbeheer/static/js
          ln -s ${{ github.workspace }}/frontend/build/index.html ${{ github.workspace }}/backend/src/openarchiefbeheer/templates/index.html
          python src/manage.py compilemessages
          python src/manage.py collectstatic --noinput --link
          python src/manage.py test openarchiefbeheer --tag=e2e
        env:
          DJANGO_SETTINGS_MODULE: openarchiefbeheer.conf.ci
          SECRET_KEY: dummy
          DB_USER: postgres
          DB_PASSWORD: ''
          E2E_SERVE_FRONTEND: yes
          PLAYWRIGHT_HEADLESS: yes
          PLAYWRIGHT_BROWSER: ${{ matrix.browser }}
          PLAYWRIGHT_TRACE_PATH: ${{ matrix.browser }}-playwright-trace.zip

      # # Uncomment if you are recording traces for debug purposes
      # - uses: actions/upload-artifact@v4
      #   if: ${{ failure() }}
      #   with:
      #     name: ${{ matrix.browser }}-playwright-trace.zip
      #     path: ${{ github.workspace }}/backend/${{ matrix.browser }}-playwright-trace.zip
      #     retention-days: 1
      #     if-no-files-found: error
          
  docs:
   name: Build and check documentation
   runs-on: ubuntu-latest

   steps:
     - uses: actions/checkout@v4
       with:
         path: open-archiefbeheer

     - name: Set up backend environment
       uses: maykinmedia/setup-django-backend@v1
       with:
         apt-packages: 'gettext postgresql-client  libgdal-dev gdal-bin'
         python-version: '3.12'
         setup-node: 'no'
         working-directory: open-archiefbeheer/backend

     - name: Build and test docs
       run: pytest check_sphinx.py -v --tb=auto
       working-directory: open-archiefbeheer/backend/docs

  docker_build:
    name: Build Docker image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set tag
        id: vars
        run: |
          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')

          # Strip "v" prefix from tag name (if present at all)
          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')

          # Use Docker `latest` tag convention
          [ "$VERSION" == "main" ] && VERSION=latest

          # PRs result in version 'merge' -> transform that into 'latest'
          [ "$VERSION" == "merge" ] && VERSION=latest

          echo "tag=${VERSION}" >> $GITHUB_OUTPUT
          echo "git_hash=${GITHUB_SHA}" >> $GITHUB_OUTPUT

      - name: Build the production Docker image
        run: |
          docker build . \
            --tag $IMAGE_NAME:$RELEASE_VERSION \
            --build-arg COMMIT_HASH=${{ steps.vars.outputs.git_hash }} \
            --build-arg RELEASE=${{ steps.vars.outputs.tag }} \
        env:
          RELEASE_VERSION: ${{ steps.vars.outputs.tag }}

      - run: docker image save -o image.tar $IMAGE_NAME:${{ steps.vars.outputs.tag }}
      - name: Store image artifact
        uses: actions/upload-artifact@v4
        with:
          name: docker-image
          path: image.tar
          retention-days: 1

  docker_push:
    needs:
      - backend-tests
      - frontend-build
      - e2e-tests
      - docker_build

    name: Push Docker image
    runs-on: ubuntu-latest
    if: github.event_name == 'push' # Exclude PRs

    steps:
      - uses: actions/checkout@v4

      - name: Download built image
        uses: actions/download-artifact@v4
        with:
          name: docker-image

      - name: Set tag
        id: vars
        run: |
          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')

          # Strip "v" prefix from tag name (if present at all)
          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')

          # Use Docker `latest` tag convention
          [ "$VERSION" == "main" ] && VERSION=latest

          echo "tag=${VERSION}" >> $GITHUB_OUTPUT

      - name: Load image
        run: |
          docker image load -i image.tar

      - name: Log into registry
        run:
          echo "${{ secrets.DOCKER_TOKEN }}" | docker login -u ${{ secrets.DOCKER_USERNAME }}
          --password-stdin

      - name: Push the Docker image (production)
        run: docker push $IMAGE_NAME:$RELEASE_VERSION
        env:
          RELEASE_VERSION: ${{ steps.vars.outputs.tag }}