neiam /gitgud

name: checks
# A pull request's build and tests: the forge compiled (NIFs included)
# and `mix test` against a throwaway Postgres. Every pull request — the
# security update PRs gg-security opens (dependency-updates.yml) most of
# all, since a bump that resolves isn't one that builds.
on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    runs-on: self-hosted
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    env:
      MIX_ENV: test
      GITGUD_TEST_DB_HOST: postgres
      GITGUD_TEST_DB_PORT: "5432"
      # Postgres takes 100 connections; the runner has cores for more.
      GITGUD_TEST_DB_POOL_SIZE: "40"
      # A fresh container has no git identity, and some tests commit.
      GIT_AUTHOR_NAME: checks
      GIT_AUTHOR_EMAIL: checks@bots.invalid
      GIT_COMMITTER_NAME: checks
      GIT_COMMITTER_EMAIL: checks@bots.invalid
    steps:
      - uses: actions/checkout@v4

      # As the Dockerfile's builder: what the NIFs need to compile.
      - name: Build dependencies
        run: |
          sudo apt-get update -q
          sudo apt-get install -y -q --no-install-recommends \
            build-essential git pkg-config libssl-dev libclang-dev

      # OTP and Elixir from builds.hex.pm, the builds setup-beam would
      # fetch — taken directly, since setup-beam chooses one by ImageOS,
      # which this runner sets to "selfhosted" over anything a workflow
      # says.
      - name: OTP and Elixir
        env:
          OTP_VERSION: "28.5.0.2"
          ELIXIR_VERSION: "1.19.5"
        run: |
          ubuntu=$(. /etc/os-release && echo "$VERSION_ID")
          curl -sSfL "https://builds.hex.pm/builds/otp/ubuntu-${ubuntu}/OTP-${OTP_VERSION}.tar.gz" | tar xz -C /tmp
          # Installed where it's unpacked: Install's root is its own directory.
          (cd "/tmp/OTP-${OTP_VERSION}" && ./Install -minimal "/tmp/OTP-${OTP_VERSION}" > /dev/null)
          curl -sSfL -o /tmp/elixir.zip "https://builds.hex.pm/builds/elixir/v${ELIXIR_VERSION}-otp-${OTP_VERSION%%.*}.zip"
          unzip -q -d /tmp/elixir /tmp/elixir.zip
          echo "/tmp/OTP-${OTP_VERSION}/bin" >> "$GITHUB_PATH"
          echo /tmp/elixir/bin >> "$GITHUB_PATH"

      - name: Rust
        run: |
          curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.88.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Dependencies
        run: |
          mix local.hex --force
          mix local.rebar --force
          mix deps.get

      - name: Compile
        run: mix compile

      # jarsigner (a JDK) isn't on the runner; the F-Droid signing test that
      # shells out to it says to leave it out where that's so.
      - name: Test
        run: mix test --exclude jarsigner