Nexus-Guard-Suite/.gitea/workflows/ci.yml

name: CI

on:
  push:
    tags:
      - 'dev-*'
      - 'v*-dev*'
      - 'v*-beta*'
      - 'v*-test*'
      - 'v[0-9]*.[0-9]*.[0-9]'

jobs:
  # ====================================================================
  # TEST TAGS — test only, no build, no docs
  # ====================================================================
  server-core-test:
    if: contains(gitea.ref_name, 'test')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          token: ${{ secrets.BUILD_TOKEN }}
          persist-credentials: true
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
          cache: true
      - name: Test (skip nftables - needs root)
        working-directory: apps/server-core
        run: go test $(go list ./... | grep -v internal/firewall) -tags dev -cover -count=1

  device-agent-test:
    if: contains(gitea.ref_name, 'test')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          token: ${{ secrets.BUILD_TOKEN }}
          persist-credentials: true
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
          cache: true
      - name: Test
        working-directory: apps/device-agent
        run: go test ./... -cover

  dashboard-test:
    if: contains(gitea.ref_name, 'test')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          token: ${{ secrets.BUILD_TOKEN }}
          persist-credentials: true
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Install
        working-directory: apps/dashboard-ui
        run: npm ci || npm install
      - name: Build
        working-directory: apps/dashboard-ui
        run: npm run build

  # ====================================================================
  # DEV/BETA TAGS — build only, no docs, no test
  # ====================================================================
  build-server-core-dev:
    if: contains(gitea.ref_name, 'dev') || contains(gitea.ref_name, 'beta')
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_server_core.yaml
    secrets: inherit

  build-device-agent-dev:
    if: contains(gitea.ref_name, 'dev') || contains(gitea.ref_name, 'beta')
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_device_agent.yaml
    secrets: inherit

  build-dashboard-dev:
    if: contains(gitea.ref_name, 'dev') || contains(gitea.ref_name, 'beta')
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_dashboard.yaml
    secrets: inherit

  release-dev:
    if: (contains(gitea.ref_name, 'dev') || contains(gitea.ref_name, 'beta')) && !failure()
    needs: [build-server-core-dev, build-device-agent-dev, build-dashboard-dev]
    uses: ./.gitea/workflows/release_call.yaml
    with:
      prerelease: ${{ contains(gitea.ref_name, 'dev') }}
      draft: ${{ contains(gitea.ref_name, 'beta') }}
    secrets: inherit

  # ====================================================================
  # RELEASE TAGS — build all + docs + release
  # ====================================================================
  build-server-core-release:
    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_server_core.yaml
    secrets: inherit

  build-device-agent-release:
    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_device_agent.yaml
    secrets: inherit

  build-dashboard-release:
    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/build_dashboard.yaml
    secrets: inherit

  build-docs-release:
    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/docs_call.yaml
    secrets: inherit

  release-stable:
    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test') && !failure()
    needs: [build-server-core-release, build-device-agent-release, build-dashboard-release, build-docs-release]
    uses: ./.gitea/workflows/release_call.yaml
    with:
      prerelease: false
      draft: false
    secrets: inherit