Nexus-Guard-Suite/.gitea/workflows/ci.yml

name: CI

on:
  push:
    tags:
      - 'dev-*'
      - 'v*-dev*'
      - 'v*-beta*'
      - 'v*-test*'
      - 'v[0-9]*.[0-9]*.[0-9]'
  pull_request:
    branches:
      - main
      - develop

jobs:
  # ====================================================================
  # TESTS — test tags only
  # ====================================================================
  server-core-test:
    if: contains(gitea.ref_name, 'test') || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          token: ${{ secrets.BUILD_TOKEN }}
          persist-credentials: true
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
          cache: true
          cache-dependency-path: apps/server-core/go.sum
      - name: Test (skip nftables - needs root)
        working-directory: apps/server-core
        run: go test $(go list ./... | grep -v internal/firewall) -tags dev -cover -count=1

  device-agent-test:
    if: contains(gitea.ref_name, 'test') || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          token: ${{ secrets.BUILD_TOKEN }}
          persist-credentials: true
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
          cache: true
          cache-dependency-path: apps/device-agent/go.sum
      - name: Test
        working-directory: apps/device-agent
        run: go test ./... -cover

  dashboard-test:
    if: contains(gitea.ref_name, 'test') || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          token: ${{ secrets.BUILD_TOKEN }}
          persist-credentials: true
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Install
        working-directory: apps/dashboard-ui
        run: npm ci || npm install
      - name: Build
        working-directory: apps/dashboard-ui
        run: npm run build

  android-agent-test:
    if: contains(gitea.ref_name, 'test') || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          token: ${{ secrets.BUILD_TOKEN }}
          persist-credentials: true
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle
      - name: Setup Android SDK
        uses: android-actions/setup-android@v3
      - name: Grant execute permission for gradlew
        working-directory: apps/android-agent
        run: chmod +x gradlew
      - name: Build debug APK
        working-directory: apps/android-agent
        run: ./gradlew assembleDebug

  # ====================================================================
  # BUILD — after tests pass (release) or directly (dev/beta)
  # ====================================================================
  build-server-core:
    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
    needs: [server-core-test, device-agent-test, dashboard-test, android-agent-test]
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_server_core.yaml
    secrets: inherit

  build-device-agent:
    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
    needs: [server-core-test, device-agent-test, dashboard-test, android-agent-test]
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_device_agent.yaml
    secrets: inherit

  build-dashboard:
    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
    needs: [server-core-test, device-agent-test, dashboard-test, android-agent-test]
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_dashboard.yaml
    secrets: inherit

  build-android-agent:
    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
    needs: [server-core-test, device-agent-test, dashboard-test, android-agent-test]
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_android_agent.yaml
    secrets: inherit

  # ====================================================================
  # DOCS — after builds pass, release tags only
  # ====================================================================
  build-docs:
    if: always() && !contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
    needs: [build-server-core, build-device-agent, build-dashboard, build-android-agent]
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/docs_call.yaml
    secrets: inherit

  # ====================================================================
  # RELEASE — after everything passes
  # ====================================================================
  release:
    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
    needs: [build-server-core, build-device-agent, build-dashboard, build-android-agent, build-docs]
    uses: ./.gitea/workflows/release_call.yaml
    with:
      prerelease: ${{ contains(gitea.ref_name, 'dev') }}
      draft: ${{ contains(gitea.ref_name, 'beta') }}
    secrets: inherit

  # ====================================================================
  # DEPLOY DEV — auto-deploy on dev tags
  # ====================================================================
  deploy-dev:
    if: contains(gitea.ref_name, 'dev') && !failure() && !cancelled()
    needs: [build-server-core, build-device-agent, build-dashboard, build-android-agent]
    uses: ./.gitea/workflows/deploy_call.yaml
    with:
      environment: dev
    secrets: inherit

  # ====================================================================
  # DEPLOY PROD — manual trigger after release
  # ====================================================================
  deploy-prod:
    if: startsWith(gitea.ref_name, 'v') && !contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
    needs: [build-server-core, build-device-agent, build-dashboard, build-android-agent, build-docs]
    uses: ./.gitea/workflows/deploy_call.yaml
    with:
      environment: production
    secrets: inherit