name: build

on:
  push:
    branches: [ master, dev ]
    tags: [ 'v*', '[0-9]*' ]
  pull_request:
    branches: [ master ]
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:

  build:
    name: Build
    runs-on: ubuntu-latest

    # The queue's ordering rule - consumers registered before the queue is
    # started - is invisible on the memory backend, which is the default and
    # therefore what every other test runs on: queue.Memory's Register starts a
    # consumer goroutine whatever the state. Only redis refuses a late
    # registration, so without a server here the tests that cover it would skip
    # and the suite would report success for a queue that accepts no consumers.
    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10

    env:
      GO_ADMIN_TEST_REDIS_ADDR: 127.0.0.1:6379

    steps:

    - name: Set up Go 1.26
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: 1.26.5
      id: go

    - name: Check out code into the Go module directory
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    - name: Get dependencies
      run: go mod tidy

    # go build does not compile _test.go, so building alone never ran a single
    # test. This is the only workflow that fires on every push and pull request,
    # which makes it the one place a test gate belongs.
    - name: Test
      run: make test

    - name: Build
      run: make build

    # Fails the build on the silent-failure classes listed in
    # tools/checksilent, one of which is the contract boundary: nothing under
    # common/ may import app/. A boundary that is only written down erodes; this
    # is what keeps it true.
    - name: Silent-failure checks
      run: make checksilent

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      if: startsWith(github.ref, 'refs/tags/')

    - name: Log in to the Container registry
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
      if: startsWith(github.ref, 'refs/tags/')
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata (tags, labels) for Docker
      id: meta
      if: startsWith(github.ref, 'refs/tags/')
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        flavor: |
          latest=auto
        tags: |
          type=schedule
          type=ref,event=tag
          type=sha,prefix=,format=long,enable=true,priority=100

    - name: Build and push Docker image
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      if: startsWith(github.ref, 'refs/tags/')
      with:
        context: .
        file: scripts/Dockerfile
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}