cicd.yaml

name: CICD

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  check-default:
    runs-on: ubuntu-22.04
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Check Nixpkgs input
        uses: DeterminateSystems/flake-checker-action@v7

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v11

      # basic check to verify that all Nix flake outputs are soundly typed
      - name: Check flake
        run: |
          nix flake check \
            --all-systems \
            --no-build

      # If running `gomod2nix` changes `gomod2nix.toml`, that means that the
      # file is not up to date and the build needs to fail. If that happens,
      # run `gomod2nix` inside the Nix development environment to regenerate
      # that file and then commit the changes to Git.
      - name: Ensure gomod2nix dependencies are up to date
        run: |
          nix develop --command gomod2nix
          git diff --exit-code gomod2nix.toml

      - name: Run golangci-lint
        run: |
          nix develop --command \
            golangci-lint run \
              --verbose \
              --timeout=3m

      - name: Run go test and generate coverage report
        run: |
          nix develop --command \
            go test \
              -v \
              -coverprofile=coverage.out \
              -coverpkg=./... \
              ./...

      - name: Upload coverage report to Codecov
        uses: codecov/codecov-action@v4 # nosemgrep
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          codecov_yml_path: codecov.yml
          
  check-postgres: 
    runs-on: ubuntu-22.04
    
    env:
      TEST_AIO_SUBSYSTEMS_STORE_CONFIG_POSTGRES_HOST: "localhost"
      TEST_AIO_SUBSYSTEMS_STORE_CONFIG_POSTGRES_PORT: "5432"
      TEST_AIO_SUBSYSTEMS_STORE_CONFIG_POSTGRES_USERNAME: "username"
      TEST_AIO_SUBSYSTEMS_STORE_CONFIG_POSTGRES_PASSWORD: "password"
      TEST_AIO_SUBSYSTEMS_STORE_CONFIG_POSTGRES_DATABASE: "resonate_test"
      
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_USER: ${{ env.TEST_AIO_SUBSYSTEMS_STORE_CONFIG_POSTGRES_USERNAME }}
          POSTGRES_PASSWORD: ${{ env.TEST_AIO_SUBSYSTEMS_STORE_CONFIG_POSTGRES_PASSWORD }}
          POSTGRES_DB: ${{ env.TEST_AIO_SUBSYSTEMS_STORE_CONFIG_POSTGRES_DATABASE }}
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
          
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: false

      # Intentionally not using nix here as a workout around to the postgres dependency. 
      - name: Run go test and generate coverage report
        run: |
          go test -v -coverprofile=coverage.out -coverpkg=./... ./...

  check-linearizability:
    runs-on: ubuntu-22.04
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v11

      - name: Use Magic Nix Cache
        uses: DeterminateSystems/magic-nix-cache-action@v6

      - name: Build server and harness
        run: |
          nix build ".#resonate"
          cp ./result/bin/resonate resonate

          nix build ".#durable-promise-test-harness"
          cp ./result/bin/durable-promise-test-harness durable-promise-test-harness

      - name: Run resonate server
        run: |
          ./resonate serve --aio-store-sqlite-path :memory: &

      - name: Run linearizability check
        run: |
          ./durable-promise-test-harness verify -r 1000 -c 10

      - uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: test-harness-results
          path: test/results/

  scan:
    name: semgrep
    runs-on: ubuntu-20.04
    needs: [check-default, check-postgres, check-linearizability]
    env:
      SEMGREP_RULES: "auto semgrep.yml"
    if: (github.actor != 'dependabot[bot]')
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
      
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v11

      - name: Use Magic Nix Cache
        uses: DeterminateSystems/magic-nix-cache-action@v6
      
      - name: semgrep
        run: |
          nix develop --command \
            semgrep ci