ci.yaml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, labeled]
  release:
    types: [published]
  workflow_dispatch:
  repository_dispatch:
    types: [start-ci, deploy-demo]

env:
  MIX_ENV: test
  NODE_VERSION: "20"
  MANTAINERS: '["cdimonaco", "dottorblaster", "janvhs", "nelsonkopliku", "arbulu89","jagabomb","emaksy", "balanza", "gagandeepb"]'
  RG_TEST_LABEL: regression
  INTEGRATION_TEST_LABEL: integration

jobs:
  elixir-deps:
    name: Elixir ${{ matrix.mix_env }} dependencies
    runs-on: ubuntu-20.04
    strategy:
      matrix:
        include:
          - mix_env: dev
          - mix_env: test
    env:
      MIX_ENV: ${{ matrix.mix_env }}
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
        env:
          ImageOS: ubuntu20
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: mix-cache
        with:
          path: |
            deps
            _build/${{ matrix.mix_env }}
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Install Dependencies
        if: steps.mix-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p priv/plts
          mix local.rebar --force
          mix local.hex --force
          mix deps.get
          mix deps.compile --warnings-as-errors
          mix dialyzer --plt

  npm-deps:
    name: Npm dependencies
    runs-on: ubuntu-20.04
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            assets/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('assets/package-lock.json') }}
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Install NPM dependencies
        if: steps.npm-cache.outputs.cache-hit != 'true'
        run: cd assets && npm install

  codespell:
    name: Check common misspellings
    runs-on: ubuntu-20.04
    defaults:
      run:
        shell: bash
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install codespell
        run: |
          sudo apt-get install -y git python3 python3-pip
          python3 -m pip install codespell
      - name: codespell
        run: codespell -S priv*,*package*json,deps*,*node_modules*,*svg,*.git,*.app -L enque,daa,afterall,statics

  generate-docs:
    name: Generate project documentation
    runs-on: ubuntu-20.04
    if: github.event_name == 'push' && github.ref_name == 'main'
    steps:
      - uses: actions/checkout@v4
      - name: Set up Elixir
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: mix-cache
        with:
          path: |
            deps
            _build/test
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Build docs
        uses: lee-dohm/generate-elixir-docs@v1
      - name: Generate openapi.json
        run: mix openapi.spec.json --start-app=false --spec TrentoWeb.OpenApi.V1.ApiSpec
      - name: Generate Swagger UI
        uses: Legion2/swagger-ui-action@v1
        with:
          output: ./doc/swaggerui
          spec-file: openapi.json
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish to Pages
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./doc

  static-code-analysis:
    name: Static Code Analysis
    needs: [elixir-deps, npm-deps]
    runs-on: ubuntu-20.04
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
        env:
          ImageOS: ubuntu20
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Retrieve Elixir Cached Dependencies
        uses: actions/cache@v4
        id: mix-cache
        with:
          path: |
            deps
            _build/test
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Retrieve NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            assets/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('assets/package-lock.json') }}
      - name: Check for unused dependencies
        run: mix deps.unlock --check-unused
      - name: Check Code Format
        run: mix format --check-formatted
      - name: Run Credo
        run: mix credo
      - name: Run Dialyzer
        run: mix dialyzer
      - name: Run Eslint
        run: cd assets && npm run lint
      - name: Check JS Code Format
        run: cd assets && npm run format:check

  test-fe:
    name: Run FE tests
    needs: npm-deps
    runs-on: ubuntu-20.04
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Retrieve NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            assets/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('assets/package-lock.json') }}
      - name: Run JS tests
        run: cd assets && npm test

  test:
    name: Test
    needs: [elixir-deps]
    runs-on: ubuntu-20.04
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: mix-cache
        with:
          path: |
            deps
            _build/test
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Compile
        run: mix compile --warnings-as-errors
      - name: "Docker compose dependencies"
        uses: isbang/compose-action@v2.0.2
        with:
          compose-file: "./docker-compose.yaml"
          down-flags: "--volumes"
      - name: Run test
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: mix coveralls.github --warnings-as-errors --trace

  chromatic:
    name: Chromatic deployment
    needs: [elixir-deps, npm-deps]
    runs-on: ubuntu-20.04
    if: github.event_name != 'repository_dispatch'
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: mix-cache
        with:
          path: |
            deps
            _build/test
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Retrieve NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            assets/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('assets/package-lock.json') }}
      - name: Build CSS
        run: npx tailwindcss --input=css/app.css --output=../priv/static/assets/app.css --postcss
        working-directory: assets
      - name: Build Frontend
        run: npm run build
        working-directory: assets
      - name: Publish to Chromatic
        uses: chromaui/action@v11
        with:
          workingDir: assets
          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
          autoAcceptChanges: true
          skip: dependabot/**

  npm-e2e-deps:
    name: Npm E2E dependencies
    runs-on: ubuntu-20.04
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: npm-e2e-cache
        with:
          path: |
            test/e2e/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('test/e2e/package-lock.json') }}
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Install E2E NPM dependencies
        if: steps.npm-e2e-cache.outputs.cache-hit != 'true'
        run: cd test/e2e && npm install

  test-e2e:
    name: End to end tests
    needs: [elixir-deps, npm-deps, npm-e2e-deps]
    runs-on: ubuntu-20.04
    env:
      MIX_ENV: dev
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
        env:
          ImageOS: ubuntu20
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: mix-cache
        with:
          path: |
            deps
            _build/dev
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Retrieve NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            assets/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('assets/package-lock.json') }}
      - name: Retrieve E2E NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-e2e-cache
        with:
          path: |
            test/e2e/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('test/e2e/package-lock.json') }}
      - name: Check Eslint and JS Code Format
        run: cd test/e2e && npm run lint && npm run format:check
      - name: "Docker compose dependencies"
        uses: isbang/compose-action@v2.0.2
        with:
          compose-file: "./docker-compose.yaml"
          down-flags: "--volumes"
      - name: Mix setup
        run: mix setup
      - name: Run trento detached
        run: mix phx.server &
      - name: Install photofinish
        uses: jaxxstorm/action-install-gh-release@v1.14.0
        with:
          repo: trento-project/photofinish
          tag: v1.4.1
          cache: enable
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Give executable permissions to photofinish
        run: chmod +x $(whereis photofinish | cut -d" " -f2)
      - name: Cypress run
        uses: cypress-io/github-action@v6
        env:
          cypress_video: false
          cypress_db_host: postgres
          cypress_db_port: 5432
          cypress_photofinish_binary: $(whereis photofinish | cut -d" " -f2)
        with:
          working-directory: test/e2e
          wait-on-timeout: 30
          config: baseUrl=http://localhost:4000
      - name: Upload cypress test screenshots
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: e2e-screenshots
          path: test/e2e/cypress/screenshots/

  check-regression-label:
    name: Check if the regression test criteria are met, store in the job output
    runs-on: ubuntu-22.04
    outputs:
      run_regression_test: ${{ steps.check.outputs.run_regression_test }}
    steps:
      - id: check
        run: echo "run_regression_test=${{ contains(fromJson(env.MANTAINERS), github.event.sender.login) && contains(github.event.pull_request.labels.*.name, env.RG_TEST_LABEL) }}" >> "$GITHUB_OUTPUT"

  regression-test-e2e:
    name: Regression tests
    needs: [check-regression-label, elixir-deps, npm-deps, npm-e2e-deps]
    runs-on: ubuntu-22.04
    if: needs.check-regression-label.outputs.run_regression_test == 'true'
    strategy:
      matrix:
        include:
          - test: sap_system_split
            cypress_spec: |
              cypress/e2e/databases_overview.cy.js
              cypress/e2e/sap_systems_overview.cy.js
          - test: process_manager_rename
            cypress_spec: |
              cypress/e2e/host_details.cy.js
    env:
      MIX_ENV: dev
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
        env:
          ImageOS: ubuntu20
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: mix-cache
        with:
          path: |
            deps
            _build/dev
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Retrieve NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            assets/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('assets/package-lock.json') }}
      - name: Retrieve E2E NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-e2e-cache
        with:
          path: |
            test/e2e/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('test/e2e/package-lock.json') }}
      - name: "Docker compose dependencies"
        uses: isbang/compose-action@v2.0.2
        with:
          compose-file: "./docker-compose.yaml"
          down-flags: "--volumes"
      - name: Postgres trento_dev restore
        uses: tj-actions/pg-restore@v6
        with:
          database_url: "postgresql://postgres:postgres@localhost:5433/postgres"
          backup_file: "test/fixtures/regression/${{ matrix.test }}/trento_dev.sql"
          postgresql_version: "15"
      - name: Postgres trento_eventstore_dev restore
        uses: tj-actions/pg-restore@v6
        with:
          database_url: "postgresql://postgres:postgres@localhost:5433/postgres"
          backup_file: "test/fixtures/regression/${{ matrix.test }}/trento_eventstore_dev.sql"
          postgresql_version: "15"
      - name: Run DB migrations
        run: mix ecto.migrate
      - name: Run DB seed
        run: mix run priv/repo/seeds.exs
      - name: Run trento detached
        run: mix phx.server &
      - name: Install photofinish
        uses: jaxxstorm/action-install-gh-release@v1.14.0
        with:
          repo: trento-project/photofinish
          tag: v1.4.1
          cache: enable
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Give executable permissions to photofinish
        run: chmod +x $(whereis photofinish | cut -d" " -f2)
      - name: Cypress run
        uses: cypress-io/github-action@v6
        env:
          cypress_video: false
          cypress_db_host: postgres
          cypress_db_port: 5432
          cypress_photofinish_binary: $(whereis photofinish | cut -d" " -f2)
        with:
          working-directory: test/e2e
          spec: ${{ matrix.cypress_spec }}
          wait-on-timeout: 30
          config: baseUrl=http://localhost:4000
      - name: Upload cypress test screenshots
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: regression-${{ matrix.test }}-e2e-screenshots
          path: test/e2e/cypress/screenshots/

  check-integration-tests-label:
    name: Check if the integration test criteria are met, store in the job output
    runs-on: ubuntu-22.04
    outputs:
      run_integration_test: ${{ steps.check.outputs.run_integration_test }}
    steps:
      - id: check
        run: echo "run_integration_test=${{ contains(fromJson(env.MANTAINERS), github.event.sender.login) && contains(github.event.pull_request.labels.*.name, env.INTEGRATION_TEST_LABEL) }}" >> "$GITHUB_OUTPUT"

  integration-test-e2e:
    name: Integration tests
    needs: [check-integration-tests-label, elixir-deps, npm-deps, npm-e2e-deps]
    runs-on: ubuntu-22.04
    if: needs.check-integration-tests-label.outputs.run_integration_test == 'true'
    strategy:
      matrix:
        include:
          - test: oidc
            cypress_spec: |
              cypress/e2e/sso_integration.cy.js
            config_file_content: |
              import Config

              config :trento, :oidc, enabled: true
            env:
              MIX_ENV: dev
              CYPRESS_SSO_INTEGRATION_TESTS: true
              CYPRESS_SSO_TYPE: oidc
          - test: oauth2
            cypress_spec: |
              cypress/e2e/sso_integration.cy.js
            config_file_content: |
              import Config

              config :trento, :oauth2, enabled: true
            env:
              MIX_ENV: dev
              CYPRESS_SSO_INTEGRATION_TESTS: true
              CYPRESS_SSO_TYPE: oauth2
          - test: saml
            cypress_spec: |
              cypress/e2e/sso_integration.cy.js
            config_file_content: |
              import Config

              config :trento, :saml, enabled: true
            env:
              MIX_ENV: dev
              CYPRESS_SSO_INTEGRATION_TESTS: true
              CYPRESS_SSO_TYPE: saml
    env: ${{ matrix.env }}
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
        env:
          ImageOS: ubuntu20
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Retrieve Cached Dependencies
        uses: actions/cache@v4
        id: mix-cache
        with:
          path: |
            deps
            _build/dev
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Retrieve NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            assets/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('assets/package-lock.json') }}
      - name: Retrieve E2E NPM Cached Dependencies
        uses: actions/cache@v4
        id: npm-e2e-cache
        with:
          path: |
            test/e2e/node_modules
          key: ${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('test/e2e/package-lock.json') }}
      - name: "Docker compose dependencies"
        uses: isbang/compose-action@v2.0.2
        with:
          compose-file: "./docker-compose.yaml"
          compose-flags: "--profile idp"
          down-flags: "--volumes"
      - name: Create dev.local.exs file
        run: echo "${{ matrix.config_file_content }}" > config/dev.local.exs
      - name: Mix setup
        run: mix setup
      - name: Run trento detached
        run: mix phx.server &
      - name: Cypress run
        uses: cypress-io/github-action@v6
        env:
          cypress_video: false
          cypress_db_host: postgres
          cypress_db_port: 5432
        with:
          working-directory: test/e2e
          spec: ${{ matrix.cypress_spec }}
          wait-on-timeout: 30
          config: baseUrl=http://localhost:4000
      - name: Upload cypress test screenshots
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: integration-${{ matrix.test }}-e2e-screenshots
          path: test/e2e/cypress/screenshots/

  target-branch-deps:
    name: Rebuild target branch dependencies
    runs-on: ubuntu-20.04
    env:
      BRANCH_NAME: ${{ github.event.pull_request.base.ref || github.ref_name }}
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        if: github.ref_name != '${{ env.BRANCH_NAME }}'
        with:
          access_token: ${{ github.token }}
      - name: Checkout target branch
        uses: actions/checkout@v4
        if: github.ref_name != '${{ env.BRANCH_NAME }}'
        with:
          ref: ${{ env.BRANCH_NAME }}
      - name: Set up Elixir
        id: setup-elixir
        uses: erlef/setup-beam@v1
        if: github.ref_name != '${{ env.BRANCH_NAME }}'
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Retrieve Cached Dependencies - target branch
        uses: actions/cache@v4
        id: mix-cache-target
        if: github.ref_name != '${{ env.BRANCH_NAME }}'
        with:
          path: |
            deps
            _build/test
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Install missing dependencies
        if: steps.mix-cache-target.outputs.cache-hit != 'true' && github.ref_name != '${{ env.BRANCH_NAME }}'
        run: |
          mkdir -p priv/plts
          mix local.rebar --force
          mix local.hex --force
          mix deps.get
          mix deps.compile --warnings-as-errors
          mix dialyzer --plt

  api-bc-check:
    name: API bc check
    needs: [elixir-deps, target-branch-deps]
    runs-on: ubuntu-20.04
    strategy:
      matrix:
        include:
          - version: V1
          - version: V2
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout current branch
        uses: actions/checkout@v4
      - name: Set up Elixir
        id: setup-elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Retrieve Cached Dependencies - current branch
        uses: actions/cache@v4
        id: mix-cache-current
        with:
          path: |
            deps
            _build/test
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Generate current openapi.json
        run: |
          mix openapi.spec.json --start-app=false --spec TrentoWeb.OpenApi.${{ matrix.version }}.ApiSpec /tmp/specs/current-spec.json

      - name: Checkout target branch
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.ref || github.ref_name }}
      - name: Retrieve Cached Dependencies - target branch
        uses: actions/cache@v4
        id: mix-cache-target
        with:
          path: |
            deps
            _build/test
            priv/plts
          key: ${{ runner.os }}-${{ steps.setup-elixir.outputs.otp-version }}-${{ steps.setup-elixir.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
      - name: Generate target openapi.json
        run: |
          mix openapi.spec.json --start-app=false --spec TrentoWeb.OpenApi.${{ matrix.version }}.ApiSpec /tmp/specs/target-spec.json
      - name: Locate generated specs
        run: mv /tmp/specs .
      - name: Find difference between OpenAPI specifications
        run: |
          docker run -v "$(pwd)/specs:/specs" --rm openapitools/openapi-diff:2.0.1 \
            /specs/target-spec.json \
            /specs/current-spec.json \
            --fail-on-incompatible \
            --markdown /specs/changes.md \
            --text /specs/changes.txt \
            --html /specs/changes.html
      - name: Upload OpenAPI diff report
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: openapi-diff-report-${{ matrix.version }}
          path: specs/

  build-and-push-container-images:
    name: Build and push container images
    runs-on: ubuntu-latest
    if: github.event_name == 'release' || (github.event_name == 'push' && github.ref_name == 'main') || github.event_name == 'workflow_dispatch'
    needs: [static-code-analysis, test, test-fe, test-e2e]
    permissions:
      contents: read
      packages: write
    env:
      REGISTRY: ghcr.io
      IMAGE_REPOSITORY: ghcr.io/${{ github.repository_owner }}/trento-web
      IMAGE_TAG: "${{ (github.event_name == 'release' && github.event.release.tag_name) || (github.event_name == 'push' && github.ref_name == 'main' && 'rolling') || github.sha }}"
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: docker/setup-buildx-action@v3
      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96
        with:
          images: ${{ env.IMAGE_REPOSITORY }}
      - name: Build and push container image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ env.IMAGE_REPOSITORY }}:${{ env.IMAGE_TAG }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-demo-img:
    name: Build the docker image for the demo environment
    runs-on: ubuntu-latest
    if: github.event.action == 'deploy-demo' || github.event_name == 'release' || (github.event_name == 'push' && github.ref_name == 'main') || github.event_name == 'workflow_dispatch'
    needs: [static-code-analysis, test, test-fe]
    permissions:
      contents: read
      packages: write
    env:
      MIX_ENV: demo
      REGISTRY: ghcr.io
      IMAGE_REPOSITORY: ghcr.io/${{ github.repository_owner }}/trento-web
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: docker/setup-buildx-action@v3
      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96
        with:
          images: ${{ env.IMAGE_REPOSITORY }}
      - name: Build and push container image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ env.IMAGE_REPOSITORY }}:demo
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: MIX_ENV=demo

  deploy-demo-env:
    name: Deploy updated images to the demo environment
    runs-on: self-hosted
    if: |
      vars.DEPLOY_DEMO == 'true' &&
        (
          github.event_name == 'release' ||
          github.event.action == 'deploy-demo' ||
          (github.event_name == 'push' && github.ref_name == 'main') ||
          github.event_name == 'workflow_dispatch'
        )
    env:
      IMAGE_REPOSITORY: ghcr.io/${{ github.repository_owner }}
      TRENTO_WEB_ORIGIN: ${{ secrets.TRENTO_DEMO_IP }}
      TRENTO_NAMESPACE: ${{ secrets.TRENTO_NAMESPACE }}
      TRENTO_ADMIN_EMAIL: ${{ secrets.TRENTO_ADMIN_EMAIL }}
      TRENTO_INGRESS_CLASS: ${{ secrets.TRENTO_INGRESS_CLASS }}
    needs: [build-demo-img, test-e2e]
    steps:
      - name: Start a local k8s cluster
        uses: jupyterhub/action-k3s-helm@v4
        with:
          k3s-version: v1.31.2+k3s1
      - name: Add bitnami & jetstack(cert-manager) helm deps
        run: |
          helm repo add bitnami https://charts.bitnami.com/bitnami
          helm repo add jetstack https://charts.jetstack.io
          helm repo update
      - name: Install CRDs for cert-manager
        run: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.crds.yaml
      - name: Install cert-manager
        run: helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.14.5
        continue-on-error: true
      - name: Download and unzip helm chart
        run: |
          rm rolling.zip | true
          rm -rf helm-charts-rolling | true
          wget https://github.com/trento-project/helm-charts/archive/refs/tags/rolling.zip
          unzip rolling.zip
      - name: Prepare valid cluster-issuer and certificate (for cert-manager)
        run: |
          envsubst < helm-charts-rolling/hack/cert-manager/certificate.tpl.yaml > helm-charts-rolling/hack/cert-manager/certificate.yaml
          envsubst < helm-charts-rolling/hack/cert-manager/cluster-issuer.tpl.yaml > helm-charts-rolling/hack/cert-manager/cluster-issuer.yaml
          envsubst < helm-charts-rolling/hack/cert-manager/override-values.tpl.yaml > helm-charts-rolling/hack/cert-manager/override-values.yaml
      - name: Apply cluster-issuer and certificate (for cert-manager)
        run: |
          kubectl apply -f helm-charts-rolling/hack/cert-manager/cluster-issuer.yaml
          kubectl apply -f helm-charts-rolling/hack/cert-manager/certificate.yaml
      - name: Install trento-server helm chart
        run: |
          cd helm-charts-rolling/charts/trento-server
          helm dependency update
          helm upgrade -i trento --wait . \
            --set trento-web.adminUser.password="${{ secrets.DEMO_PASSWORD }}" \
            --set trento-web.image.pullPolicy=Always \
            --set trento-web.image.repository="${IMAGE_REPOSITORY}/trento-web" \
            --set trento-web.image.tag="demo" \
            --set trento-wanda.image.pullPolicy=Always \
            --set trento-wanda.image.repository="${IMAGE_REPOSITORY}/trento-wanda" \
            --set trento-wanda.image.tag="demo" \
            --set trento-web.trentoWebOrigin="${TRENTO_WEB_ORIGIN}" \
            -f ../../hack/cert-manager/override-values.yaml

  run-photofinish-demo-env:
    name: Use photofinish to push mock data to the demo environment
    runs-on: ubuntu-20.04
    if: |
      vars.DEPLOY_DEMO == 'true' &&
        (
          github.event_name == 'release' ||
          github.event.action == 'deploy-demo' ||
          (github.event_name == 'push' && github.ref_name == 'main') ||
          github.event_name == 'workflow_dispatch'
        )
    needs: deploy-demo-env
    env:
      TRENTO_DEMO_IP: ${{ secrets.TRENTO_DEMO_IP }}
      TRENTO_API_KEY: ${{ secrets.TRENTO_API_KEY }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install photofinish
        uses: jaxxstorm/action-install-gh-release@v1.14.0
        with:
          repo: trento-project/photofinish
          tag: v1.4.1
          cache: enable
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Give executable permissions to photofinish
        run: chmod +x $(whereis photofinish | cut -d" " -f2)
      - name: Push data
        run: |
          photofinish run healthy-27-node-SAP-cluster -u "http://$TRENTO_DEMO_IP/api/collect" "$TRENTO_API_KEY"
          photofinish run hana-scale-out -u "http://$TRENTO_DEMO_IP/api/collect" "$TRENTO_API_KEY"
          photofinish run hana-diskless-sbd -u "http://$TRENTO_DEMO_IP/api/collect" "$TRENTO_API_KEY"
          photofinish run multi-tenant -u "http://$TRENTO_DEMO_IP/api/collect" "$TRENTO_API_KEY"
          photofinish run hana-scale-up-angi -u "http://$TRENTO_DEMO_IP/api/collect" "$TRENTO_API_KEY"
          photofinish run java-system -u "http://$TRENTO_DEMO_IP/api/collect" "$TRENTO_API_KEY"

  obs-commit-image:
    name: Commit to OBS to generate container image
    runs-on: ubuntu-20.04
    if: github.event_name == 'release' || (github.event_name == 'push' && github.ref_name == 'main') || github.event_name == 'workflow_dispatch'
    needs: [static-code-analysis, test, test-fe, test-e2e]
    container:
      image: ghcr.io/trento-project/continuous-delivery:main
      env:
        GITHUB_OAUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        DEST_FOLDER: "/tmp/osc_project"
        NAME: trento-web-image
        OBS_USER: ${{ secrets.OBS_USER }}
        OBS_PASS: ${{ secrets.OBS_PASS }}
        OBS_PROJECT: ${{ secrets.OBS_PROJECT }}
        FOLDER: packaging/suse/container
        REPOSITORY: ${{ github.repository }}
      options: -u 0:0
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - name: Checkout
        uses: actions/checkout@v4
      - uses: actions-ecosystem/action-get-latest-tag@v1
        id: latest-tag
        with:
          semver_only: true
          initial_version: 0.0.1
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Install assets
        run: cd assets && npm install
      - name: Get mix deps
        run: mix local.hex --force && mix deps.clean --all && mix deps.get
      - name: Configure OSC
        # OSC credentials must be configured beforehand as the HOME variables cannot be changed from /github/home
        # that is used to run osc commands
        run: |
          mkdir -p $HOME/.config/osc
          cp /home/osc/.config/osc/oscrc $HOME/.config/osc
          /scripts/init_osc_creds.sh
      - name: Prepare .changes file
        # The .changes file is updated only in release creation. This current task should be improved
        # in order to add the current rolling release notes
        if: github.event_name == 'release'
        run: |
          CHANGES_FILE=$NAME.changes
          osc checkout $OBS_PROJECT $NAME $CHANGES_FILE
          mv $CHANGES_FILE $FOLDER
          VERSION=${{ steps.latest-tag.outputs.tag }}
          hack/gh_release_to_obs_changeset.py $REPOSITORY -a shap-staff@suse.de -t $VERSION -f $FOLDER/$CHANGES_FILE
      - name: Set version
        run: |
          git config --global --add safe.directory /__w/web/web
          VERSION=$(./hack/get_version_from_git.sh)
          # "+" character is not allowed in OBS dockerfile version strings
          VERSION=${VERSION//[+]/-}
          sed -i 's~%%VERSION%%~'"${VERSION}"'~' $FOLDER/Dockerfile
      - name: Commit on OBS
        run: |
          OBS_PACKAGE=$OBS_PROJECT/$NAME
          osc checkout $OBS_PACKAGE -o $DEST_FOLDER
          cp -r $FOLDER/* $DEST_FOLDER
          tar --transform 's,^./,/web/,' -zcvf $DEST_FOLDER/web.tar.gz --exclude=./.git ./*
          cd $DEST_FOLDER
          osc ar
          osc commit -m "New development version of $NAME released"

  obs-commit-rpm:
    name: Commit to OBS to generate RPM package
    needs: [static-code-analysis, test, test-fe, test-e2e]
    runs-on: ubuntu-20.04
    if: github.ref == 'refs/heads/main' || github.event_name == 'release'
    container:
      image: ghcr.io/trento-project/continuous-delivery:main
      env:
        OBS_USER: ${{ secrets.OBS_USER }}
        OBS_PASS: ${{ secrets.OBS_PASS }}
        OBS_PROJECT: ${{ secrets.OBS_PROJECT }}
        OSC_CHECKOUT_DIR: /tmp/trento-web-package
        REPOSITORY: ${{ github.repository }}
        FOLDER: packaging/suse/rpm
      options: -u 0:0
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          access_token: ${{ github.token }}
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Configure OSC
        run: |
          mkdir -p $HOME/.config/osc
          cp /home/osc/.config/osc/oscrc $HOME/.config/osc
          /scripts/init_osc_creds.sh
      - name: Prepare _service file
        run: |
          git config --global --add safe.directory /__w/web/web
          VERSION=$(./hack/get_version_from_git.sh)
          sed -i 's~%%REVISION%%~${{ github.sha }}~' $FOLDER/_service && \
          sed -i 's~%%REPOSITORY%%~'"${REPOSITORY}"'~' $FOLDER/_service && \
          sed -i 's~%%VERSION%%~'"${VERSION}"'~' $FOLDER/_service
      - name: Get mix deps & prepare tarball
        run: |
          mix local.hex --force && mix deps.clean --all && mix deps.get
          tar -c deps | gzip -n > deps.tar.gz
      - name: Checkout and prepare OBS package
        run: |
          osc checkout $OBS_PROJECT trento-web -o $OSC_CHECKOUT_DIR
          cp $FOLDER/_service $OSC_CHECKOUT_DIR
          cp $FOLDER/trento-web.spec $OSC_CHECKOUT_DIR
          rm -vf $OSC_CHECKOUT_DIR/*.tar.gz
          pushd $OSC_CHECKOUT_DIR
          osc service manualrun
          rm -vf $OSC_CHECKOUT_DIR/*.tgz
          cp  /__w/web/web/deps.tar.gz .
      - name: Prepare trento-web.changes file
        # The .changes file is updated only in release creation. This current task should be improved
        # in order to add the current rolling release notes
        if: github.event_name == 'release'
        run: |
          git config --global --add safe.directory /__w/web/web
          VERSION=$(./hack/get_version_from_git.sh)
          TAG=$(echo $VERSION | cut -f1 -d+)
          hack/gh_release_to_obs_changeset.py $REPOSITORY -a shap-staff@suse.de -t $TAG -f $OSC_CHECKOUT_DIR/trento-web.changes
      - name: Commit changes into OBS
        run: |
          pushd $OSC_CHECKOUT_DIR
          osc ar
          osc commit -m "GitHub Actions automated update to reference ${{ github.sha }}"