ci.yml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Foreseerr CI

on:
  pull_request:
    branches:
      - '*'
  push:
    branches:
      - develop
  workflow_dispatch:

permissions:
  contents: read

env:
  DOCKER_HUB: selmantr/foreseerr

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  i18n:
    name: i18n Check
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GH_REPO: ${{ github.repository }}
      NUMBER: ${{ github.event.pull_request.number }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - parallel:
          - name: Pnpm Setup
            uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

          - name: Set up Node.js
            uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
            with:
              node-version-file: '.node-version'

      - name: Get pnpm store directory
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        env:
          CI: true
        run: pnpm install

      - name: i18n Check
        shell: bash
        env:
          I18N_LABEL: i18n-out-of-sync
          BODY: |
            The i18n check failed because translation messages are out of sync.

            This usually happens when you've added or modified translation strings in your code but haven't updated the translation file.

            Please run `pnpm i18n:extract` and commit the changes.
        run: |
          retry() { n=0; until "$@"; do n=$((n+1)); [ $n -ge 3 ] && break; echo "retry $n: $*" >&2; sleep 2; done; }
          check_failed=0; node bin/check-i18n.js || check_failed=$?
          pr_labels=$(gh pr view "$NUMBER" -R "$GH_REPO" --json labels -q '.labels[].name' 2>/dev/null) || true
          has_label=0
          while IFS= read -r name; do [ -n "$name" ] && [ "$name" = "$I18N_LABEL" ] && has_label=1 && break; done <<< "$pr_labels"
          if [ "$check_failed" -eq 1 ]; then
            [ "$has_label" -eq 0 ] && { retry gh pr edit "$NUMBER" -R "$GH_REPO" --add-label "$I18N_LABEL" || true; retry gh pr comment "$NUMBER" -R "$GH_REPO" -b "$BODY" || true; }
          else
            [ "$has_label" -eq 1 ] && retry gh pr edit "$NUMBER" -R "$GH_REPO" --remove-label "$I18N_LABEL" || true
          fi
          exit $check_failed
  test:
    name: Lint & Test Build
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    container: node:22.22.2-alpine3.23@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Pnpm Setup
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - name: Get pnpm store directory
        shell: sh
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        env:
          CI: true
        run: pnpm install

      - parallel:
          - name: Version consistency
            run: pnpm check:versions

          - name: Lint
            run: pnpm lint

          - name: Formatting
            run: pnpm format:check

          - name: Typecheck
            run: pnpm typecheck

          - name: Build
            run: pnpm build

  unit-test:
    name: Unit Tests
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    container: node:22.22.2-alpine3.23@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f
    permissions:
      checks: write
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Pnpm Setup
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - name: Get pnpm store directory
        shell: sh
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        env:
          CI: true
        run: pnpm install

      - name: Run tests
        env:
          CI: true
        run: pnpm test

      - name: Publish test report
        uses: mikepenz/action-junit-report@3a81627bfac62268172037048872e8ebd4207e6d # v6.4.1
        if: success() || failure() # always run even if the previous step fails
        with:
          report_paths: 'report.xml'

  migration-test:
    name: Migration Tests
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    container: node:22.22.2-alpine3.23@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: foreseerr
          POSTGRES_PASSWORD: foreseerr
          POSTGRES_DB: foreseerr
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U foreseerr"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DB_HOST: postgres
      DB_PORT: 5432
      DB_USER: foreseerr
      DB_PASS: foreseerr
      DB_NAME: foreseerr
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Pnpm Setup
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - name: Get pnpm store directory
        shell: sh
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        env:
          CI: true
        run: pnpm install

      - name: Run migration checks
        run: pnpm check:migrations

      - name: Run upgrade-matrix tests (SQLite + PostgreSQL)
        env:
          CI: true
        run: pnpm test server/migration/upgradeMatrix.sqlite.test.ts server/migration/upgradeMatrix.postgres.test.ts

  helm-lint:
    name: Helm Lint
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Version consistency
        run: node scripts/check-version-consistency.mjs

      - name: Set up Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5

      - name: Lint chart
        run: helm lint charts/foreseerr-chart

      - name: Verify default image tag
        run: |
          expected_tag="ghcr.io/selmant/foreseerr:v$(node -p "require('./package.json').version")"
          rendered_tag=$(helm template test charts/foreseerr-chart | awk -F'"' '/image:/{print $2; exit}')
          if [ "$rendered_tag" != "$expected_tag" ]; then
            echo "Expected default image $expected_tag, got $rendered_tag"
            exit 1
          fi

  build:
    name: Build (per-arch, native runners)
    needs: [test, unit-test, migration-test, helm-lint]
    if: github.ref == 'refs/heads/develop'
    strategy:
      matrix:
        include:
          - runner: ubuntu-24.04
            platform: linux/amd64
            arch: amd64
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - parallel:
          - name: Checkout
            uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
            with:
              persist-credentials: false

          - name: Set up Docker Buildx
            uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Commit timestamp
        id: ts
        run: echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"

      - name: Warm cache (no push) — ${{ matrix.platform }}
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ matrix.platform }}
          push: false
          build-args: |
            COMMIT_TAG=${{ github.sha }}
            BUILD_VERSION=develop
            SOURCE_DATE_EPOCH=${{ steps.ts.outputs.TIMESTAMP }}
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
          provenance: false

  publish:
    name: Publish multi-arch image
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - parallel:
          - name: Checkout
            uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
            with:
              persist-credentials: false

          - name: Set up Docker Buildx
            uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Log in to Docker Hub
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Commit timestamp
        id: ts
        run: echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: |
            ${{ env.DOCKER_HUB }}
            ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=develop
            type=sha
          labels: |
            org.opencontainers.image.created=${{ steps.ts.outputs.TIMESTAMP }}

      - name: Build & Push (multi-arch, single tag)
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            COMMIT_TAG=${{ github.sha }}
            BUILD_VERSION=develop
            SOURCE_DATE_EPOCH=${{ steps.ts.outputs.TIMESTAMP }}
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: |
            type=gha,scope=linux/amd64
            type=gha,scope=linux/arm64
          cache-to: type=gha,mode=max
          provenance: false

  discord:
    name: Send Discord Notification
    needs: publish
    if: always() && github.event_name != 'pull_request'
    runs-on: ubuntu-24.04
    steps:
      - name: Determine Workflow Status
        id: status
        run: |
          case "${{ needs.publish.result }}" in
            success)   echo "status=Success"   >> $GITHUB_OUTPUT; echo "colour=3066993"  >> $GITHUB_OUTPUT ;;
            failure)   echo "status=Failure"   >> $GITHUB_OUTPUT; echo "colour=15158332" >> $GITHUB_OUTPUT ;;
            cancelled) echo "status=Cancelled" >> $GITHUB_OUTPUT; echo "colour=10181046" >> $GITHUB_OUTPUT ;;
            *)         echo "status=Skipped"   >> $GITHUB_OUTPUT; echo "colour=9807270"  >> $GITHUB_OUTPUT ;;
          esac

      - name: Send Discord notification
        shell: bash
        run: |
          WEBHOOK="${{ secrets.DISCORD_WEBHOOK }}"

          PAYLOAD=$(cat <<EOF
          {
            "embeds": [{
              "title": "${{ steps.status.outputs.status }}: ${{ github.workflow }}",
              "color": ${{ steps.status.outputs.colour }},
              "fields": [
                { "name": "Repository",   "value": "[${{ github.repository }}](${{ github.server_url }}/${{ github.repository }})", "inline": true },
                { "name": "Ref",          "value": "${{ github.ref }}", "inline": true },
                { "name": "Event",        "value": "${{ github.event_name }}", "inline": true },
                { "name": "Triggered by", "value": "${{ github.actor }}", "inline": true },
                { "name": "Workflow",     "value": "[${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": true }
              ],
            }]
          }
          EOF
          )

          curl -sS -H "Content-Type: application/json" -X POST -d "$PAYLOAD" "$WEBHOOK" || true