ci.yml

name: CI

permissions:
  actions: read

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch: {}

env:
  CARGO_TERM_COLOR: always

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  tests:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }}
    runs-on: ubuntu-latest
    container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
    steps:
      - uses: actions/checkout@v4
      - name: Install deps
        run: ./ci/installdeps.sh
      - name: Mark git checkout as safe
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      # xref containers/containers-image-proxy-rs
      - name: Cache Dependencies
        uses: Swatinem/rust-cache@v2
        with:
          key: "tests"
      - name: cargo fmt (check)
        run: cargo fmt -- --check -l
      - name: Build
        run: cargo test --no-run
      - name: Build lib without default features
        run: cd lib && cargo check --no-default-features
      - name: Individual checks
        run: (cd cli && cargo check) && (cd lib && cargo check)
      - name: Lints
        run: cargo xtask custom-lints
      - name: Run tests
        run: cargo test -- --nocapture --quiet
      - name: Manpage generation
        run: mkdir -p target/man && cargo run --features=docgen -- man --directory target/man
      - name: Clippy (gate on correctness and suspicous)
        run: cargo clippy -- -D clippy::correctness -D clippy::suspicious
  build-fedora:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }}
    runs-on: ubuntu-latest
    container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
    steps:
      - uses: actions/checkout@v4
      - name: Install deps
        run: ./ci/installdeps.sh
      - name: Cache Dependencies
        uses: Swatinem/rust-cache@v2
        with:
          key: "build"
      - name: Build
        run: make test-bin-archive
      - name: Upload binary
        uses: actions/upload-artifact@v4
        with:
          name: bootc.tar.zst
          path: target/bootc.tar.zst
  cargo-deny:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: EmbarkStudios/cargo-deny-action@v1
      with:
        log-level: warn
        command: check bans sources licenses
  privtest:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }}
    name: "Privileged testing"
    needs: build-fedora
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Download
        uses: actions/download-artifact@v4
        with:
          name: bootc.tar.zst
      - name: Install
        run: sudo tar -C / -xvf bootc.tar.zst
      - name: Integration tests
        run: sudo podman run --rm --privileged -v /run/systemd:/run/systemd -v /:/run/host -v /usr/bin/bootc:/usr/bin/bootc --pid=host quay.io/fedora/fedora-coreos:testing-devel bootc internal-tests run-privileged-integration
  container-tests:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }}
    name: "Container testing"
    needs: build-fedora
    runs-on: ubuntu-latest
    container: quay.io/centos-bootc/fedora-bootc:eln-1708320930
    steps:
      - name: Download
        uses: actions/download-artifact@v4
        with:
          name: bootc.tar.zst
      - name: Install
        run: sudo tar -C / -xvf bootc.tar.zst
      - name: Integration tests
        run: bootc internal-tests run-container-integration
  install-tests:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }}
    name: "Test install"
    # For a not-ancient podman
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Ensure host skopeo is disabled
        run: sudo rm -f /bin/skopeo /usr/bin/skopeo
      - name: Integration tests
        run: |
          set -xeu
          sudo podman build -t localhost/bootc -f hack/Containerfile .
          cargo run -p tests-integration run-install-tests localhost/bootc
  docs:
    if: ${{ contains(github.event.pull_request.labels.*.name, 'documentation') }}
    runs-on: ubuntu-latest
    env:
      MDBOOK_VERSION: 0.4.37
    steps:
      - uses: actions/checkout@v4
      - name: Install mdBook
        run: |
          tag=$(curl 'https://api.github.com/repos/rust-lang/mdbook/releases/latest' | jq -r '.tag_name')
          url="https://github.com/rust-lang/mdbook/releases/download/${tag}/mdbook-${tag}-x86_64-unknown-linux-gnu.tar.gz"
          mkdir mdbook
          curl -sSL $url | tar -xz --directory=./mdbook
          echo `pwd`/mdbook >> $GITHUB_PATH
      - name: Install mdbook-mermaid
        run: |
          tag=$(curl 'https://api.github.com/repos/badboy/mdbook-mermaid/releases/latest' | jq -r '.tag_name')
          url="https://github.com/badboy/mdbook-mermaid/releases/download/${tag}/mdbook-mermaid-${tag}-x86_64-unknown-linux-gnu.tar.gz"
          mkdir mdbook-mermaid
          curl -sSL $url | tar -xz --directory=./mdbook-mermaid
          echo `pwd`/mdbook-mermaid >> $GITHUB_PATH
      - name: Install mdbook-linkcheck
        run: |
          tag=$(curl 'https://api.github.com/repos/Michael-F-Bryan/mdbook-linkcheck/releases/latest' | jq -r '.tag_name')
          archive="mdbook-linkcheck.x86_64-unknown-linux-gnu.zip"
          url="https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases/download/${tag}/${archive}"
          mkdir mdbook-linkcheck
          curl -sSL -O $url && unzip ${archive} -d ./mdbook-linkcheck && chmod +x ./mdbook-linkcheck/mdbook-linkcheck
          echo `pwd`/mdbook-linkcheck >> $GITHUB_PATH
      - name: Build with mdBook
        run: cd docs && mdbook-mermaid install && mdbook build