main.yml

on:
  push:
    tags-ignore:
      - "**"
    branches:
      - main
  pull_request:

# ignore gh-pages
name: main
permissions: write-all

jobs:
  build-test:
    strategy:
      matrix:
        runs-on: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v16
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - name: Run `nixci build`
        run: |
          nix run nixpkgs#nixci -- \
            --extra-access-tokens ${{ secrets.GITHUB_TOKEN }} \
            -v \
            build
      - name: Collect artifacts
        id: collect-artifacts
        run: |
          ALL=$(nix eval --raw '.#all.outPath')/bin/*
          echo ::set-output name=all::$ALL
      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.runs-on }}
          path: ${{steps.collect-artifacts.outputs.all}}

  docs:
    needs: [build-test]
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: DeterminateSystems/nix-installer-action@v16
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - name: Run Zola
        run: |
          nix develop --command zola build
          cp ./static/pages/* public
        working-directory: docs
      - uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./docs/public
          force_orphan: true

  crates-publish:
    name: Publish to crates.io
    needs: [build-test]
    if: github.ref == 'refs/heads/main' && contains(github.event.head_commit.message, 'release:')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Swatinem/rust-cache@v2
      - uses: katyo/publish-crates@v2
        continue-on-error: true
        with:
          registry-token: ${{ secrets.CRATES_IO_TOKEN }}
          args: --no-verify
  
  fh-publish:
    name: Publish to FlakeHub
    needs: [build-test]
    if: github.ref == 'refs/heads/main' && contains(github.event.head_commit.message, 'release:')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/flakehub-push@main
        with:
          visibility: public

  gh-publish:
    name: Publish to Github
    needs: [build-test]
    if: github.ref == 'refs/heads/main' && contains(github.event.head_commit.message, 'release:')
    strategy:
      matrix:
        runs-on: [ubuntu-latest, macos-latest]
        target:
          [
            clang-tidy-sarif,
            clippy-sarif,
            hadolint-sarif,
            shellcheck-sarif,
            sarif-fmt,
          ]
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: Swatinem/rust-cache@v2
      - uses: DeterminateSystems/nix-installer-action@v16
      - uses: DeterminateSystems/magic-nix-cache-action@v8
      - uses: actions-rs/cargo@v1
        with:
          command: build
          args: --release --bin ${{ matrix.target }}
      - name: targets
        id: targets
        run: |
          TARGET_TRIPLE=$(rustc --version --verbose | grep host | awk '{print $2}')
          echo ::set-output name=target_triple::$TARGET_TRIPLE
          TARGET_VERSION=$(./target/release/${{ matrix.target }} --version | awk '{print $2}')
          echo ::set-output name=target_version::$TARGET_VERSION
          TARGET_BINARY=./target/release/${{ matrix.target }}-${TARGET_TRIPLE}
          mv ./target/release/${{ matrix.target }} ${TARGET_BINARY}
          echo ::set-output name=target_binary::$TARGET_BINARY
      - name: changelog
        id: changelog
        run: |
          nix develop --command git-cliff -c ${{ matrix.target }}/cliff.toml --unreleased --tag ${{ matrix.target }}-v${{steps.targets.outputs.target_version}} --output CHANGELOG.md
      - name: latest
        continue-on-error: true
        run: |
          git push --delete origin ${{ matrix.target }}-latest
      - uses: ncipollo/release-action@v1
        with:
          artifacts: ${{steps.targets.outputs.target_binary}}
          bodyFile: CHANGELOG.md
          token: ${{ secrets.GITHUB_TOKEN }}
          allowUpdates: true
          tag: ${{ matrix.target }}-v${{steps.targets.outputs.target_version}}
          name: ${{ matrix.target }} ${{steps.targets.outputs.target_version}}
      - uses: ncipollo/release-action@v1
        with:
          artifacts: ${{steps.targets.outputs.target_binary}}
          bodyFile: CHANGELOG.md
          token: ${{ secrets.GITHUB_TOKEN }}
          allowUpdates: true
          tag: ${{ matrix.target }}-latest
          name: ${{ matrix.target }} latest
          replacesArtifacts: true
          makeLatest: true