tinker_tickets/.gitea/workflows/lint.yml

name: Lint

on:
  push:
    branches: ["**"]
  pull_request:
    branches: ["**"]

jobs:
  php-lint:
    name: PHP (phpcs PSR-12)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Install PHP and phpcs
        run: |
          apt-get update -qq
          apt-get install -y -qq php-cli php-xml
          curl -sL https://squizlabs.github.io/PHP_CodeSniffer/phpcs.phar -o /usr/local/bin/phpcs
          chmod +x /usr/local/bin/phpcs

      - name: Run phpcs
        run: phpcs --standard=.phpcs.xml .

  js-lint:
    name: JS (eslint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Install ESLint
        run: npm install --save-dev eslint@8

      - name: Run ESLint
        run: npx eslint assets/js/

  requirements:
    name: PHP requirements (version + extensions)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Install PHP with required extensions
        run: |
          apt-get update -qq
          # Install the extensions declared in config/requirements.php so the
          # check verifies they are actually installable + loadable, and so this
          # build fails if a required extension can't be provided.
          apt-get install -y -qq php-cli php-ldap php-mysql php-curl php-mbstring

      - name: Verify runtime requirements
        run: php scripts/check_requirements.php

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: [php-lint, js-lint, requirements]
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/development')
    permissions:
      contents: write
    steps:
      - name: Trigger webhook
        env:
          WEBHOOK_SECRET: ${{ secrets.WEBHOOK_SECRET }}
          GIT_REF: ${{ github.ref }}
        run: |
          if [ "$GIT_REF" = "refs/heads/main" ]; then
            HOOK_ID="tinker-deploy"
          else
            HOOK_ID="tinker-beta-deploy"
          fi
          PAYLOAD="{\"ref\":\"${GIT_REF}\"}"
          SIG=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | awk '{print $2}')
          curl -sf --connect-timeout 10 \
            -X POST \
            -H "Content-Type: application/json" \
            -H "X-Gitea-Signature: ${SIG}" \
            -d "$PAYLOAD" \
            "http://10.10.10.45:9000/hooks/${HOOK_ID}"

      - name: Tag deployed commit
        if: github.ref == 'refs/heads/main'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="deploy-$(date -u +%Y.%m.%d)-${{ github.run_number }}"
          curl -sf -X POST \
            -H "Authorization: token $GITHUB_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"${TAG}\",\"target\":\"${{ github.sha }}\",\"message\":\"Deployed to production\"}" \
            "https://code.lotusguild.org/api/v1/repos/${{ github.repository }}/tags"

  notify-failure:
    name: Notify on failure
    runs-on: ubuntu-latest
    needs: [php-lint, js-lint, requirements]
    if: failure() && github.event_name == 'push'
    steps:
      - name: Send Matrix alert
        env:
          MATRIX_WEBHOOK_URL: ${{ secrets.MATRIX_WEBHOOK_URL }}
          REPO: ${{ github.repository }}
          BRANCH: ${{ github.ref_name }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          if [ -z "$MATRIX_WEBHOOK_URL" ] || [ "$MATRIX_WEBHOOK_URL" = "CONFIGURE_ME" ]; then exit 0; fi
          curl -sf -X POST "$MATRIX_WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -d "{\"text\":\"CI FAILED: ${REPO} @ ${BRANCH} — ${RUN_URL}\"}"