ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - # v6.0.2
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0

      - name: Install gitleaks
        run: |
          GITLEAKS_VERSION=$(curl -sf https://api.github.com/repos/gitleaks/gitleaks/releases/latest \
            | grep '"tag_name"' | cut -d'"' -f4)
          curl -sfL "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz" \
            | tar -xz -C /usr/local/bin gitleaks

      - name: Verify extension pins and paths
        run: ./hack/verify.sh

      - name: Gitleaks secret scan
        run: gitleaks detect --source . --redact

      - name: Hadolint
        uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf
        with:
          dockerfile: Dockerfile

      - name: Pre-commit (all files)
        # v3.0.1
        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
        with:
          extra_args: --all-files

      - name: Set up Python
        # v5.6.0
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.x"

      - name: Commit message convention check
        run: |
          python -m pip install --upgrade pip commitizen
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            RANGE="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
          else
            RANGE="${{ github.event.before }}..${{ github.sha }}"
          fi
          echo "Checking commit messages in range: ${RANGE}"
          cz check --rev-range "${RANGE}"

  build:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up QEMU
        # v4.0.0
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a

      - name: Set up Docker Buildx
        # v4.0.0
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd

      - name: Build extension image (no push)
        # v7.0.0
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: false