main.yml

---
name: Test and build Docker image

on:
  merge_group:
  pull_request:
  workflow_call:
  workflow_dispatch:

jobs:
  check:
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4
      - uses: "opensafely-core/setup-action@v1"
        with:
          python-version: "3.12"
          install-just: true
      - name: Check formatting, linting and import sorting
        run: just check

  test:
    runs-on: ubuntu-22.04

    services:
      postgres:
        image: postgres:13
        env:
          POSTGRES_USER: user
          POSTGRES_PASSWORD: password
          POSTGRES_DB: jobserver
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4
      - uses: "opensafely-core/setup-action@v1"
        with:
          python-version: "3.12"
          install-just: true

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: ".node-version"
          cache: "npm"
          cache-dependency-path: package-lock.json

      - name: Install node_modules
        run: just assets-install --ignore-scripts

      - name: Lint assets
        run: npm run lint

      - name: Run JS tests
        run: just assets-test

      - name: Build assets
        run: just assets-build

      - name: Install venv
        run: just devenv

      - name: Run tests
        env:
          DATABASE_URL: postgres://user:password@localhost/jobserver
          GITHUB_TOKEN: empty
          GITHUB_TOKEN_TESTING: ${{ secrets.OPENSAFELY_GITHUB_TESTING_ORG_PAT }}
          SECRET_KEY: 12345
          SOCIAL_AUTH_GITHUB_KEY: test
          SOCIAL_AUTH_GITHUB_SECRET: test
        run: |
          just check-migrations
          # hardcode n because auto=2 in CI for some reason
          just test-ci -n 4

      - name: Upload HTML coverage report if tests failed
        uses: actions/upload-artifact@v4
        with:
          name: python-coverage-report
          path: htmlcov
          # don't fail the job because no files were found, we expect this when
          #  * the tests passed with 100% coverage
          #  * a test failed and coverage didn't run
          if-no-files-found: ignore
        if: ${{ failure() }}  # only upload when the previous step, run tests, fails

  lint-dockerfile:
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4
      - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf  # v3.1.0
        with:
          dockerfile: docker/Dockerfile

  docker-test:
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4
      - uses: "opensafely-core/setup-action@v1"
        with:
          install-just: true

      - name: Build docker image for both prod and dev
        run: |
            just docker-build prod
            just docker-build dev

      - name: Run unit tests on docker dev image
        env:
          GITHUB_TOKEN_TESTING: ${{ secrets.OPENSAFELY_GITHUB_TESTING_ORG_PAT }}
          INTERACTIVE_GITHUB_TOKEN:
        run: |
          # build docker and run test
          just docker-test -n 4  # hardcode n because auto does not dtrt in docker

      - name: Run smoke test on prod
        run: |
          just docker-serve prod -d
          sleep 5
          just docker-smoke-test || { docker logs job-server_prod_1; exit 1; }

      - name: Save docker image
        run: |
          docker save job-server | zstd --fast -o /tmp/job-server.tar.zst

      - name: Upload docker image
        uses: actions/upload-artifact@v4
        with:
            name: job-server-image
            path: /tmp/job-server.tar.zst
            compression-level: 0