.github/workflows/ci.yaml

name: ci
on: push
# Prevent writing to the repository using the CI token.
# Ref: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions
permissions: read-all
env:
  MAKEFLAGS: '-j 2'
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v4
      - name: setup-go
        uses: actions/setup-go@v5
        with:
          go-version: '1.23.x'
      - name: cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/buf/${{ runner.os }}/x86_64/bin
            ~/.cache/buf/${{ runner.os }}/x86_64/go/pkg/mod
            ~/.cache/buf/${{ runner.os }}/x86_64/gocache
            ~/.cache/buf/${{ runner.os }}/x86_64/include
            ~/.cache/buf/${{ runner.os }}/x86_64/versions
          key: ${{ runner.os }}-buf-lint-${{ hashFiles('**/go.sum', 'make/**') }}
          restore-keys: |
            ${{ runner.os }}-buf-lint-
      - name: golangci-lint-cache
        uses: actions/cache@v4
        with:
          path: ~/.cache/golangci-lint
          # https://github.com/golangci/golangci-lint-action#caching-internals includes an interval number in the cache
          # key, however we update our go modules at least once weekly so we shouldn't need that.
          key: ${{ runner.os }}-buf-golangci-lint-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-buf-golangci-lint-
      - name: make-lint
        run: make lint
        env:
          BUF_BREAKING_AGAINST_INPUT: 'https://github.com/bufbuild/buf.git#branch=main'
          BUF_INPUT_HTTPS_USERNAME: ${{ github.actor }}
          BUF_INPUT_HTTPS_PASSWORD: ${{ github.token }}
  test:
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v4
      - name: setup-go
        uses: actions/setup-go@v5
        with:
          go-version: '1.23.x'
      - name: cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/buf/${{ runner.os }}/x86_64/bin
            ~/.cache/buf/${{ runner.os }}/x86_64/go/pkg/mod
            ~/.cache/buf/${{ runner.os }}/x86_64/gocache
            ~/.cache/buf/${{ runner.os }}/x86_64/include
            ~/.cache/buf/${{ runner.os }}/x86_64/versions
          key: ${{ runner.os }}-buf-test-${{ hashFiles('**/go.sum', 'make/**') }}
          restore-keys: |
            ${{ runner.os }}-buf-test-
      - name: make-test
        run: make test
  docker:
    runs-on: ubuntu-latest
    needs:
      - lint
      - test
    # This job only runs when
    # 1. The previous lint and test jobs have completed successfully
    # 2. The repository is not a fork, i.e. it will only run on the official bufbuild/buf
    # 3. The workflow run is trigged by main branch OR a tag with v prefix
    # See https://github.com/bufbuild/buf/pull/289/files#r596207623 for the discussion
    if:  ${{ github.repository == 'bufbuild/buf' && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v')) }}
    steps:
      # qemu is used when executing things like `apk` in the final build
      # stage which must execute on the target platform. We currently do
      # not have any CGO and care should be taken in the Dockerfile to ensure
      # that go cross compilation happens on the build platform.
      - name: setup-qemu
        uses: docker/setup-qemu-action@v3
        id: qemu
        with:
          # alpine image doesn't support linux/riscv64
          platforms: linux/386,linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6,linux/ppc64le,linux/s390x
      - name: setup-docker-buildx
        uses: docker/setup-buildx-action@v3
      - name: login-docker
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: docker-meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            bufbuild/buf
          tags: |
            type=edge,branch=main
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}.{{minor}}.{{patch}}
            type=semver,pattern={{version}}
          flavor: |
            latest=auto
      - name: docker-build-push
        uses: docker/build-push-action@v6
        with:
          file: Dockerfile.buf
          platforms: ${{ steps.qemu.outputs.platforms }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}