name: CI

on:
  push:
  workflow_dispatch:

permissions: {}

jobs:
  lint:
    name: Linting
    runs-on: ubuntu-slim
    permissions:
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Run zizmor
        uses: zizmorcore/zizmor-action@v0.7.1

  test_local:
    strategy:
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
    runs-on: ${{ matrix.os }}
    name: Test / ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: recursive
      - name: Install dependencies
        run: |
          brew install bash coreutils findutils
          echo "$(brew --prefix)/opt/coreutils/libexec/gnubin" >> "$GITHUB_PATH"
          echo "$(brew --prefix)/opt/findutils/libexec/gnubin" >> "$GITHUB_PATH"
        if: runner.os == 'macOS'
        # Is it even macOS anymore? It is for me. I really am too lazy to deal
        # with ancient utilities that come with the actual macOS.
      - name: Test
        run: make test

  test_docker:
    strategy:
      matrix:
        # Keep in sync with those in Makefile & Launchpad:
        distro:
          - xenial
          - bionic
          - focal
          - jammy
          - noble
          - resolute
    runs-on: ubuntu-latest
    name: Test / Docker / ${{ matrix.distro }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: recursive
      - name: Test
        run: |
          make 'test/docker/${{ matrix.distro }}'

  aur:
    name: Publish to AUR
    needs:
      - lint
      - test_local
      - test_docker
    runs-on: ubuntu-latest
    if: |
      startsWith(github.ref, 'refs/tags/')
      && !startsWith(github.ref, 'refs/tags/debian/')
    container:
      image: archlinux:base-devel
    permissions:
      contents: write
    steps:
      # This step must be done before actions/checkout. From the latter's
      # output:
      #
      #     To create a local Git repository instead, add Git 2.18 or higher to the PATH
      #
      - name: Install dependencies
        run: |
          pacman -Syu --noconfirm git openssh
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: true
          ref: aur
          submodules: recursive
      - name: Run maintenance
        env:
          SSH_KEY: ${{ secrets.SSH_KEY }}
        run: |
          make -C "$GITHUB_WORKSPACE" ci