ci.yaml

# This is a basic workflow

name: ci

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the main branch
on:
  push:
    branches: ["main", "devel/*"]
    tags:
      - "v*.*"
  pull_request:
    branches: ["main", "devel/*"]
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:
    inputs:
      publish:
        description: "Publish a pre-release"
        required: false
        default: "false"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.ref }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

env:
  FORCE_COLOR: "1" # make mocha output colorful
  PRETTIER_LEGACY_CLI: "1" # https://github.com/prettier/prettier/issues/15832
  # https://docs.github.com/en/actions/learn-github-actions/environment-variables
  # https://devblogs.microsoft.com/commandline/share-environment-vars-between-wsl-and-windows/
  WSLENV: HOSTNAME:CI:FORCE_COLOR:GITHUB_ACTION:GITHUB_ACTION_PATH/p:GITHUB_ACTION_REPOSITORY:GITHUB_WORKFLOW:GITHUB_WORKSPACE/p:GITHUB_PATH/p:GITHUB_ENV/p:VIRTUAL_ENV/p:SKIP_PODMAN:SKIP_DOCKER:NODE_OPTIONS
  # We define a hostname because otherwise the variable might not always be accessible on runners.
  HOSTNAME: gha

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  build:
    name: ${{ matrix.name }}
    environment: ci
    env:
      SKIP_DOCKER: ${{ matrix.env.SKIP_DOCKER || 0 }}
      SKIP_PODMAN: ${{ matrix.env.SKIP_PODMAN || 0 }}
      # NODE_OPTIONS must be kept in sync with one inside .envrc file
      NODE_OPTIONS: --max-old-space-size=8192
      TASKFILE_ARGS: --output=group --output-group-begin='::group::{{.TASK}}' --output-group-end='::endgroup::'

    defaults:
      run:
        shell: ${{ matrix.shell || 'bash'}}
    # The type of runner that the job will run on
    runs-on: ${{ matrix.os || 'ubuntu-22.04' }}
    # see https://github.com/containers/podman/issues/13609
    continue-on-error: ${{ contains(matrix.name, 'macos') && true || false }}
    outputs:
      can_release_to_npm: ${{ steps.package.outputs.can_release_to_npm }}
    strategy:
      fail-fast: false
      matrix:
        # Avoid letting github do the matrix multiplication and use manual
        # includes for each job, this gives us fine control over job name.
        # Order is important, keep it alphabetical: docs, lint, test*
        continue-on-error:
          - false
        os:
          - ubuntu-22.04
        task-name:
          - docs
        name:
          - docs
        include:
          - name: lint
            task-name: lint
            os: ubuntu-22.04
            env:
              SKIP_PODMAN: 1
              SKIP_DOCKER: 1

          - name: test (linux)
            task-name: test

          - name: test (macos)
            task-name: test
            os: macos-13-large
            env:
              SKIP_PODMAN: 1
              SKIP_DOCKER: 1
            # only until we fix some broken tests, as we need it to pass
            # in order to enable the caching
            continue-on-error: true

          - name: test (wsl)
            # runner does not support running containers
            task-name: als:test-without-ee
            log-name: als-test-without-ee
            # https://github.com/actions/virtual-environments/issues/5151
            os: devtools-win-x64
            shell: "wsl-bash {0}"
            env:
              SKIP_PODMAN: 1
              SKIP_DOCKER: 1
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # we need tags for dynamic versioning
          show-progress: false

      # https://github.com/marketplace/actions/setup-wsl
      - name: Activate WSL
        if: contains(matrix.shell, 'wsl')
        uses: Vampire/setup-wsl@v4.0.0
        with:
          distribution: Ubuntu-22.04
          set-as-default: "true"
          # '-i' seems to be the only option that loads .bashrc file that we need
          # https://github.com/Vampire/setup-wsl/discussions/54
          wsl-shell-command: "bash -i -eo pipefail"
          # https://github.com/MicrosoftDocs/WSL/blob/main/WSL/wsl-config.md#L159
          wsl-conf: |
            [automount]
            enabled = true
            root = /
            options = "metadata,umask=077"
            [boot]
            command=/etc/init.d/dbus start
            [interop]
            enabled = false
            appendWindowsPath = false
            [network]
            hostname = wsl
          additional-packages: curl
            dbus
            dirmngr
            gawk
            git
            gpg
            gpg-agent
            jq
            make
            python3-dev
            python3-full
            python3-venv
            qemu-user-static
            tar
            unzip
            xvfb
          # asdf nodejs plugin requires: dirmngr gpg curl gawk

      - name: Install mise
        uses: jdx/mise-action@v2
        # with:
        #   version: 2024.12.14 # [default: latest] mise version to install
        #   install: true # [default: true] run `mise install`
        #   cache: true # [default: true] cache mise using GitHub's cache
        #   experimental: true # [default: false] enable experimental features
        #   # automatically write this mise.toml file
        #   mise_toml: |
        #     [tools]
        #     shellcheck = "0.9.0"
        #   # or, if you prefer .tool-versions:
        #   tool_versions: |
        #     shellcheck 0.9.0

      # - name: Setup asdf
      #   if: ${{ !contains(matrix.shell, 'wsl') }}
      #   uses: asdf-vm/actions/install@v3

      - name: Setup python
        if: ${{ !contains(matrix.shell, 'wsl') }}
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install mise inside WSL
        if: contains(matrix.shell, 'wsl')
        run: |
          set -ex
          curl https://mise.run | sh
          echo "$HOME/.local/bin" >> $GITHUB_PATH
          echo "$HOME/.local/share/mise/bin" >> $GITHUB_PATH
          echo "$HOME/.local/share/mise/shims" >> $GITHUB_PATH
          echo 'eval "$(~/.local/bin/mise activate bash)"' >> ~/.bashrc

      - name: Validate mise availability
        # if: contains(matrix.shell, 'wsl')
        run: |
          set -ex
          mise --version
          direnv --version
          task --version
          yarn --version
          node --version
          python3 --version
          mise doctor

      # - name: Activate direnv
      #   if: ${{ !contains(matrix.shell, 'wsl') }}
      #   run: |
      #     set -x
      #     asdf direnv setup --shell bash --version latest
      #     asdf current
      #     asdf exec direnv allow
      #     asdf exec direnv reload

      #     # https://github.com/direnv/direnv/wiki/GitHubActions
      #     # Github prevents export of NODE_OPTIONS to GITHUB_ENV due to security reasons:
      #     # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#setting-an-environment-variable
      #     asdf exec direnv export gha >> "$GITHUB_ENV"
      #     asdf exec direnv exec . bash -c 'echo "${VIRTUAL_ENV}/bin"' >> "$GITHUB_PATH"


      - name: Ensure .envrc file is automatically loaded (direnv)
        if: ${{ !contains(matrix.shell, 'wsl') }}
        run: |
          set -ex
          test "${VIRTUAL_ENV:-}" = "${HOME}/.local/share/virtualenvs/vsa" || {
            echo "VIRTUAL_ENV mismatch"
            exit 99
          }
          test "$(which python3)" = "${HOME}/.local/share/virtualenvs/vsa/bin/python3" || {
            echo "python3 mismatch"
            exit 98
          }
          # Ensure NODE_OPTIONS config on CI is identical with the one in .envrc
          [[ "${NODE_OPTIONS:-}" == "$(asdf exec direnv exec . printenv NODE_OPTIONS)" ]] || { echo "NODE_OPTIONS mismatch between .envrc and ci.yaml"; exit 97; }

      - name: Enable caching
        uses: actions/cache@v4
        with:
          path: |
            .vscode-test
            .yarn/cache
            out/ext
            out/test-resources
            out/test-resources-oldest
            ~/.cache/pip
            ~/.cache/yarn
            ~/.cache/pre-commit/
          key: ${{ runner.os }}-${{ matrix.task-name }}-${{ hashFiles('package.json', 'yarn.lock', '.config/requirements.txt', 'tools/*.*') }}

      # - name: Enable caching for podman-machine
      #   if: "contains(matrix.os, 'macos')"
      #   uses: actions/cache@v4
      #   with:
      #     path: |
      #       ~/.local/share/containers
      #       ~/.config/containers
      #     key: ${{ runner.os }}-${{ matrix.task-name }}-${{ hashFiles('package.json', 'yarn.lock', '.config/requirements.txt', '**/Taskfile.yml', 'tools/*.*') }}

      - name: task setup
        # starting podman machine can randomly get stuck on macos
        timeout-minutes: 25
        run: task setup

      ## uncomment to debug on GHA runner
      # - name: Setup tmate session
      #   uses: mxschmitt/action-tmate@v3
      - name: task package
        id: package
        run: |
            task package ${{ matrix.env.TASKFILE_ARGS }}

      - name: task ${{ matrix.task-name }}
        if: "${{ !contains(matrix.name, 'test') }}"
        run: task ${{ matrix.task-name }} ${{ matrix.env.TASKFILE_ARGS }}

      - name: task unit
        if: contains(matrix.name, 'test')
        run: task unit ${{ matrix.env.TASKFILE_ARGS }}

      - name: task ui
        # https://github.com/ansible/vscode-ansible/issues/1451
        if: "${{ contains(matrix.name, 'test') && !contains(matrix.name, 'wsl') }}"
        run: task ui ${{ matrix.env.TASKFILE_ARGS }}

      - name: task e2e
        # https://github.com/ansible/vscode-ansible/issues/1451
        if: "${{ contains(matrix.name, 'test') && !contains(matrix.name, 'wsl') }}"
        run: task e2e ${{ matrix.env.TASKFILE_ARGS }}

      - name: task als
        # https://github.com/ansible/vscode-ansible/issues/1451
        if: contains(matrix.name, 'test')
        run: task als ${{ matrix.env.TASKFILE_ARGS }}

      - name: Upload vsix artifact
        if: ${{ matrix.name == 'test (linux)' }}
        uses: actions/upload-artifact@v4
        with:
          name: ansible-extension-build-${{ github.event.number || github.ref_name }}.zip
          path: ansible-*.vsix
          if-no-files-found: error
          retention-days: 90

      - name: Upload ansible-language-server npm package
        if: ${{ matrix.name == 'test (linux)' }}
        uses: actions/upload-artifact@v4
        with:
          name: "@ansible-ansible-language-server-build-${{ github.event.number || github.ref_name }}.tgz"
          path: packages/ansible-language-server/*.tgz
          if-no-files-found: error
          retention-days: 90

      - name: Upload test logs and reports
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: logs-${{ matrix.os }}-${{  matrix.log-name || matrix.task-name }}.zip
          path: |
            out/coverage
            out/e2eTestReport
            out/log
            out/test-resources/settings/logs
            out/userdata/logs
            out/test-resources/screenshots
          if-no-files-found: ignore
          retention-days: 90

      # - name: Stop services
      #   if: "contains(matrix.os, 'macos')"
      #   # Stopping podman machine is needed or caching it will fail
      #   run: |
      #     command -v podman && {
      #     podman machine stop
      #     while [[ "$(podman machine ls --format '{{.Running}}' \
      #           --noheading || true)" != "false" ]]; do
      #       sleep 1
      #       echo -n .
      #     done
      #     echo .
      #     }
      #   continue-on-error: true

      ## commented out for future use to debug on the GHA node if required
      # - name: Setup tmate session
      #   if: ${{ always() }}
      #   uses: mxschmitt/action-tmate@v3

  ack:
    if: github.event_name == 'pull_request'
    uses: ansible/team-devtools/.github/workflows/ack.yml@main
    secrets: inherit

  check: # This job does nothing and is only used for the branch protection
    if: always()

    needs:
      - build

    permissions: # codecov
      id-token: write
      checks: read

    runs-on: ubuntu-22.04

    steps:
      - name: Merge logs into a single archive
        uses: actions/upload-artifact/merge@v4
        with:
          name: logs.zip
          pattern: logs*.zip
          separate-directories: true
          delete-merged: true

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: logs.zip
          path: .

      - name: Upload als test coverage data [1/4]
        uses: codecov/codecov-action@v5.1.1
        with:
          name: als
          files: ./*/coverage/als/lcov.info
          flags: als
          disable_search: true
          fail_ci_if_error: true
          use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }} # cspell:ignore oidc

      - name: Upload unit test coverage data [2/4]
        uses: codecov/codecov-action@v5.1.1
        with:
          name: unit
          files: ./*/coverage/unit/lcov.info
          flags: unit
          disable_search: true
          fail_ci_if_error: true
          use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }} # cspell:ignore oidc

      - name: Upload ui test coverage data [3/4]
        uses: codecov/codecov-action@v5.1.1
        with:
          name: ui
          files: ./*/coverage/ui/lcov.info
          flags: ui
          disable_search: true
          fail_ci_if_error: true
          use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }} # cspell:ignore oidc

      - name: Upload e2e test coverage data [4/4]
        uses: codecov/codecov-action@v5.1.1
        with:
          name: e2e
          files: ./*/coverage/e2e/lcov.info
          flags: e2e
          disable_search: true
          fail_ci_if_error: true
          use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }} # cspell:ignore oidc

      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1
        with:
          jobs: ${{ toJSON(needs) }}

  publish:
    if: github.ref_type == 'tag' || github.event.inputs.publish == 'true'
    runs-on: ubuntu-latest
    environment: release
    needs:
      - check
    steps:
      - name: Checkout Source
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: node post install
        run: |
          corepack enable
          npm config set fund false

      - name: Install Node
        uses: actions/setup-node@v4
        with:
          cache: yarn
          cache-dependency-path: "**/yarn.lock"
          node-version-file: .tool-versions

      - name: Download the artifact
        uses: actions/download-artifact@v4
        with:
          name: ansible-extension-build-${{ github.event.number || github.ref_name }}.zip

      - run: |
          yarn install --immutable
          ls -la *.vsix

      - name: Setup python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Publish extension to marketplaces
        run: |
          ./tools/helper --publish
        env:
          VSCE_PAT: ${{ secrets.VSCE_PAT }}
          OVSX_PAT: ${{ secrets.OVSX_PAT }}

  publish-npm:
    environment: release
    if: needs.build.outputs.can_release_to_npm == 'true' && (github.ref_type == 'tag' || github.event.inputs.publish == 'true')
    runs-on: ubuntu-latest
    needs:
      - build
      - check
    steps:
      - name: Download the artifact
        uses: actions/download-artifact@v4
        with:
          name: "@ansible-ansible-language-server-build-${{ github.event.number || github.ref_name }}.tgz"

      # Setup .npmrc file to publish to npm
      - uses: actions/setup-node@v4
        with:
          cache: yarn
          cache-dependency-path: "**/yarn.lock"
          node-version-file: .tool-versions
          registry-url: "https://registry.npmjs.org"

      - run: npm publish --access public @ansible-ansible-language-server-*.tgz
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}