poimen-memory/.gitea/workflows/build.yaml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE: forgejo.riotpiao.com/riotpiao-poimen/poimen-memory
  DOCKER_HOST: tcp://localhost:2375
  SQLX_OFFLINE: "true"

jobs:
  ci:
    name: CI
    runs-on: rust
    steps:
      - name: Clean disk space (runner GC)
        run: |
          df -h /
          echo "Cleaning docker, cargo cache..."
          docker system prune -af --volumes || true
          rm -rf ~/.cargo/registry/cache ~/.cargo/registry/index ~/.cargo/git || true
          rm -rf /tmp/* || true
          df -h /

      - name: Install Node.js and Docker
        run: |
          apt-get update
          apt-get install -y nodejs docker.io

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Cargo build, test, clippy (single compile pass)
        run: |
          cargo build --all --verbose
          cargo test --all --lib --verbose 2>&1 | tail -150 || true
          cargo clippy --all --all-targets -- -D warnings 2>&1 | tail -50 || true

      - name: Get short SHA
        id: sha
        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Registry login
        run: |
          if [ -z "${REGISTRY_USER}" ] || [ -z "${REGISTRY_TOKEN}" ]; then
            echo "ERROR: Missing REGISTRY_USER or REGISTRY_TOKEN secrets"
            exit 1
          fi
          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
            --username "${REGISTRY_USER}" --password-stdin
        env:
          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}

      - name: Clean cargo before Docker build
        run: |
          cargo clean || true
          rm -rf ~/.cargo/registry/cache ~/.cargo/registry/index ~/.cargo/git || true
          df -h /

      - name: Build and push Docker image (SHA tag only)
        run: |
          docker build --no-cache --progress=plain \
            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
            -f Dockerfile .
          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
          echo "Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"

      - name: Install kubectl
        run: |
          apt-get update
          apt-get install -y curl
          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x kubectl
          mv kubectl /usr/local/bin/

      - name: Setup kubeconfig for Tekton
        run: |
          mkdir -p ~/.kube
          echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
          chmod 600 ~/.kube/config
          kubectl cluster-info 2>&1 | head -3
          echo "✓ kubeconfig ready"
        env:
          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}

      - name: Trigger Tekton PipelineRun (CI/CD)
        id: tekton
        run: |
          SHA="${{ steps.sha.outputs.short_sha }}"
          RUN_NAME="poimen-ci-${SHA}"
          NAMESPACE="poimen"
          IMAGE="${REGISTRY}/riotpiao-poimen/poimen-memory:${SHA}"
          REGISTRY_USER="${{ secrets.FORGEJO_REGISTRY_USER }}"
          REGISTRY_TOKEN="${{ secrets.FORGEJO_REGISTRY_TOKEN }}"

          echo "Triggering Tekton PipelineRun: ${RUN_NAME}"
          echo "Image: ${IMAGE}"
          echo ""

          # Create PipelineRun
          cat <<YAML | kubectl create -f -
          apiVersion: tekton.dev/v1
          kind: PipelineRun
          metadata:
            name: ${RUN_NAME}
            namespace: ${NAMESPACE}
            labels:
              commit-sha: "${SHA}"
          spec:
            pipelineRef:
              name: poimen-ci
            params:
            - name: image
              value: "${IMAGE}"
            - name: registry-user
              value: "${REGISTRY_USER}"
            - name: registry-token
              value: "${REGISTRY_TOKEN}"
          YAML

          echo "✓ PipelineRun created"
          echo ""
          echo "Waiting for completion (timeout 10m)..."

          # Wait for PipelineRun to complete
          if kubectl wait pipelinerun/${RUN_NAME} -n ${NAMESPACE} \
               --for=condition=Succeeded --timeout=600s 2>/dev/null; then
            echo "result=pass" >> $GITHUB_OUTPUT
            echo "✓ Pipeline passed"
          else
            echo "result=fail" >> $GITHUB_OUTPUT
            echo "✗ Pipeline failed or timed out"
          fi

          # Print pipeline summary
          echo ""
          echo "=== PipelineRun Status ==="
          kubectl describe pipelinerun ${RUN_NAME} -n ${NAMESPACE} | tail -30

          # Print task results
          echo ""
          echo "=== Task Results ==="
          SUMMARY=$(kubectl get pipelinerun ${RUN_NAME} -n ${NAMESPACE} \
            -o jsonpath='{.status.taskRuns[*].status.taskResults[?(@.name=="summary")].value}')
          echo "Summary: ${SUMMARY}"

          # Print logs from integration-tests task
          echo ""
          echo "=== Integration Test Logs ==="
          POD=$(kubectl get pod -n ${NAMESPACE} \
            -l tekton.dev/pipelineRun=${RUN_NAME} -l tekton.dev/pipelineTask=integration-tests \
            -o name | head -1)
          if [ -n "$POD" ]; then
            kubectl logs -n ${NAMESPACE} "${POD}" -c step-test 2>/dev/null | tail -200 || true
          fi

      - name: Gate on test result
        if: steps.tekton.outputs.result != 'pass'
        run: |
          echo "✗ Integration tests FAILED"
          echo "Image NOT promoted to :latest"
          exit 1

      - name: Promote image to latest
        run: |
          docker login -u "${REGISTRY_USER}" -p "${REGISTRY_TOKEN}" "${REGISTRY}"
          docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
          docker push "${IMAGE}:latest"
          echo "✓ Promoted to :latest"
        env:
          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}

      - name: Cleanup
        if: always()
        run: |
          docker image prune -a --force 2>&1 | tail -3 || true
          cargo clean || true
          df -h /