ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:


concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  pre-commit-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
        with:
          enable-cache: true
      - name: Install dev dependencies (pre-commit lives in geocomponents dev group)
        run: uv sync --project geocomponents --frozen
      - name: Cache pre-commit hook environments
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            pre-commit-${{ runner.os }}-
      - name: Run pre-commit
        run: uv run --project geocomponents pre-commit run --all-files --show-diff-on-failure

  test:
    runs-on: ubuntu-latest
    services:
      db:
        image: postgis/postgis:16-3.4
        env:
          POSTGRES_USER: geocomponents
          POSTGRES_PASSWORD: geocomponents
          POSTGRES_DB: geocomponents
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U geocomponents"
          --health-interval 3s
          --health-timeout 3s
          --health-retries 20
    env:
      DB_HOST: localhost
      DB_PORT: "5432"
      DB_NAME: geocomponents
      DB_USER: geocomponents
      DB_PASSWORD: geocomponents
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
        with:
          enable-cache: true
      - name: Sync dependencies
        run: uv sync --project geocomponents --frozen
      - name: Run tests
        working-directory: geocomponents
        run: uv run pytest

  test-gcimport:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
        with:
          enable-cache: true
      - name: Sync dependencies
        run: uv sync --project gcimport --frozen
      - name: Run tests
        working-directory: gcimport
        run: uv run pytest

  audit:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: geocomponents
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
        with:
          enable-cache: true
      - name: Export runtime dependencies to requirements.txt
        run: uv export --frozen --no-dev --no-emit-project --format requirements-txt -o requirements.txt
      - name: Audit dependencies with pip-audit
        run: uvx pip-audit -r requirements.txt --disable-pip

  audit-gcimport:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: gcimport
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
        with:
          enable-cache: true
      - name: Export runtime dependencies to requirements.txt
        run: uv export --frozen --no-dev --no-emit-project --format requirements-txt -o requirements.txt
      - name: Audit dependencies with pip-audit
        run: uvx pip-audit -r requirements.txt --disable-pip

  # Builds each Docker image on every PR and every push, loads it into the local
  # Docker daemon (no registry credentials), and fails the run on HIGH/CRITICAL
  # OS or library CVEs. Populates the GHA build cache so `publish` can reuse
  # layers.
  build-and-scan:
    needs: [pre-commit-lint, test, test-gcimport, audit, audit-gcimport]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - service: geocomponents
            context: ./geocomponents
            local_tag: geocomponents:scan
            image_name: ${{ github.repository }}-geocomponents
            cache_scope: geocomponents
          - service: gcimport
            context: ./gcimport
            local_tag: gcimport:scan
            image_name: ${{ github.repository }}-gcimport
            cache_scope: gcimport
          - service: gccore
            context: ./gccore
            local_tag: gccore:scan
            image_name: ${{ github.repository }}-gccore
            cache_scope: gccore
          - service: gcjobs
            context: ./gcjobs
            local_tag: gcjobs:scan
            image_name: ${{ github.repository }}-gcjobs
            cache_scope: gcjobs
          - service: gcmapview
            context: ./gcmapview
            local_tag: gcmapview:scan
            image_name: ${{ github.repository }}-gcmapview
            cache_scope: gcmapview
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0

      - name: Build ${{ matrix.service }} image (load into local daemon for scanning)
        uses: docker/build-push-action@cb941d0b895b09c17fa011d41c411b33c752cf28  # v6.16.0
        with:
          context: ${{ matrix.context }}
          load: true
          tags: ${{ matrix.local_tag }}
          cache-from: type=gha,scope=${{ matrix.cache_scope }}
          cache-to: type=gha,mode=max,scope=${{ matrix.cache_scope }}

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
        with:
          image-ref: ${{ matrix.local_tag }}
          format: table
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

  # Publishes one GHCR artifact per Dockerfile only on merges to main. Depends
  # on build-and-scan so a failing Trivy scan (or lint/test) blocks publish.
  # Rebuilds via buildx but `cache-from: type=gha` makes it a near-no-op that
  # just re-tags and pushes.
  publish:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: [build-and-scan]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - service: geocomponents
            context: ./geocomponents
            image_name: ${{ github.repository }}-geocomponents
            cache_scope: geocomponents
          - service: gcimport
            context: ./gcimport
            image_name: ${{ github.repository }}-gcimport
            cache_scope: gcimport
          - service: gccore
            context: ./gccore
            image_name: ${{ github.repository }}-gccore
            cache_scope: gccore
          - service: gcjobs
            context: ./gcjobs
            image_name: ${{ github.repository }}-gcjobs
            cache_scope: gcjobs
          - service: gcmapview
            context: ./gcmapview
            image_name: ${{ github.repository }}-gcmapview
            cache_scope: gcmapview
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    env:
      REGISTRY: ghcr.io
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0

      - name: Log in to the Container registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@703896b4f30f62d53f5530a80bcdc589a3f702bc  # v5.7.0
        with:
          images: ${{ env.REGISTRY }}/${{ matrix.image_name }}
          tags: |
            # Always tag with short git SHA (e.g. a1b2c3d)
            type=sha,prefix=,format=short
            # On v*.*.* tags, also tag with the semver (e.g. 1.2.3)
            type=semver,pattern={{version}}
            # Tag latest on every push to the default branch
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push ${{ matrix.service }} Docker image
        id: push
        uses: docker/build-push-action@cb941d0b895b09c17fa011d41c411b33c752cf28  # v6.16.0
        with:
          context: ${{ matrix.context }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.cache_scope }}
          cache-to: type=gha,mode=max,scope=${{ matrix.cache_scope }}

      - name: Generate ${{ matrix.service }} artifact attestation
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
        with:
          subject-name: ${{ env.REGISTRY }}/${{ matrix.image_name }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true