ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  repository:
    name: JavaScript and documentation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          cache: npm
      - run: npm ci
      - name: Lint JavaScript and documentation
        run: npm run lint
      - name: Dependency audit
        run: npm audit --audit-level=high

  dependency-review:
    name: Dependency review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5

  controller:
    name: Controller, Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12", "3.14"]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install uv
        run: python -m pip install uv==0.11.32
      - name: Install dependencies
        working-directory: controller
        run: uv sync --frozen --extra dev
      - name: Lint
        working-directory: controller
        run: uv run ruff format --check . && uv run ruff check .
      - name: Type check
        working-directory: controller
        run: uv run mypy
      - name: Test
        working-directory: controller
        run: uv run pytest --cov-report=xml
      - name: Dependency audit
        working-directory: controller
        run: |
          uv export --quiet --frozen --extra dev --no-emit-project --format requirements-txt --output-file /tmp/devboxes-requirements.txt
          uv run pip-audit --requirement /tmp/devboxes-requirements.txt

  cli:
    name: CLI
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: cli
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Format
        run: cargo fmt --check
      - name: Lint
        run: cargo clippy --all-targets --all-features --locked -- -D warnings
      - name: Test
        run: cargo test --all-features --locked
      - name: Dependency audit
        run: |
          cargo install cargo-audit --locked --version 0.22.2
          cargo audit

  packaging:
    name: Helm and shell
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v4.2.2
      - name: Shell lint
        run: shellcheck scripts/*.sh workspace/*.sh workspace/devbox-shell workspace/tests/*.sh
      - name: Terminal compatibility unit tests
        run: workspace/tests/test-devbox-shell.sh
      - name: Release version consistency
        run: scripts/check-version.sh
      - name: Secret scan
        run: |
          go install github.com/zricethezav/gitleaks/v8@v8.30.1
          "$(go env GOPATH)/bin/gitleaks" detect --source . --no-git --redact --no-banner
      - name: Helm Insights contracts
        run: scripts/test-helm-insights.sh
      - name: Helm custom image contracts
        run: scripts/test-helm-images.sh
      - name: Helm multi-tenancy contracts
        run: scripts/test-helm-tenancy.sh
      - name: Render LoadBalancer installation
        run: helm template devboxes charts/devboxes --namespace devboxes > /tmp/devboxes.yaml
      - name: Validate Kubernetes resources
        run: docker run --rm -i ghcr.io/yannh/kubeconform:v0.7.0 -strict -summary -ignore-missing-schemas < /tmp/devboxes.yaml
      - name: Render NodePort, TLS ingress, monitoring, and disruption budget
        run: >-
          helm template devboxes charts/devboxes --namespace devboxes
          --set workspace.sshService.type=NodePort
          --set workspace.sshService.host=192.0.2.10
          --set ingress.enabled=true
          --set ingress.className=nginx
          --set ingress.tls.enabled=true
          --set ingress.tls.secretName=devboxes-tls
          --set controller.externalUrl=https://devboxes.example.com
          --set controller.cookieSecure=true
          --set serviceMonitor.enabled=true
          --set podDisruptionBudget.enabled=true
          > /tmp/devboxes-full.yaml
      - name: Reject incomplete NodePort configuration
        run: |
          if helm template devboxes charts/devboxes --set workspace.sshService.type=NodePort >/dev/null 2>&1; then
            echo "NodePort rendered without workspace.sshService.host" >&2
            exit 1
          fi

  images:
    name: Container images
    runs-on: ubuntu-latest
    strategy:
      matrix:
        component: [controller, workspace]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Build image
        run: docker build --tag "devboxes-${{ matrix.component }}:ci" "${{ matrix.component }}"
      - name: Exercise terminal compatibility inside workspace image
        if: matrix.component == 'workspace'
        run: workspace/tests/test-image-terminal.sh devboxes-workspace:ci

  kind:
    name: Clean-cluster install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v4.2.2
      - name: Install kind
        run: |
          go install sigs.k8s.io/kind@v0.31.0
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
      - name: Build CLI for end-to-end verification
        run: cargo build --manifest-path cli/Cargo.toml --locked
      - name: Run full lifecycle E2E
        run: scripts/kind-e2e.sh
        env:
          DEVBOXES_E2E_CLI: cli/target/debug/devbox