ci.yml

name: CI

on:
  push:
    branches:
      - main
      - release-*
  pull_request: {}
  workflow_dispatch: {}

permissions:
  contents: read

env:
  # We can't run a step 'if secrets.FOO != ""' but we can run a step
  # 'if env.FOO' != ""', so we copy secrets to env vars for conditional checks.
  AWS_USR: ${{ secrets.AWS_USR }}

jobs:
  check-diff:
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Install Nix
        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31

      - name: Setup Cachix
        uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: crossplane
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Verify Generated Code
        run: nix build .#checks.x86_64-linux.generate --print-build-logs

  lint:
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Install Nix
        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31

      - name: Setup Cachix
        uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: crossplane
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Lint
        run: nix build .#checks.x86_64-linux.go-lint --print-build-logs

  codeql:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Install Nix
        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31

      - name: Setup Cachix
        uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: crossplane
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Setup Nix Environment
        uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1

      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        with:
          languages: go

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4

  unit-tests:
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Install Nix
        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31

      - name: Setup Cachix
        uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: crossplane
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Run Unit Tests
        run: nix build .#checks.x86_64-linux.test --print-build-logs

      - name: Publish Unit Test Coverage
        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
        with:
          flags: unittests
          file: result/coverage.txt
          token: ${{ secrets.CODECOV_TOKEN }}

  # Build all artifacts
  build-artifacts:
    permissions:
      contents: read
    runs-on: ubuntu-24.04

    outputs:
      version: ${{ steps.set-version.outputs.version }}

    steps:
      - name: Cleanup Disk
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
        with:
          android: true
          dotnet: true
          haskell: true
          tool-cache: true
          swap-storage: false
          large-packages: false
          docker-images: false

      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0

      - name: Install Nix
        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31

      - name: Setup Cachix
        uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: crossplane
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      # Set buildVersion in flake.nix. The version is an input to the build.
      # Pure (sandboxed, reproducible) Nix build inputs can only come from git
      # tracked files, so we set it in flake.nix before building.
      - name: Set Version
        id: set-version
        run: |
          VERSION=$(git describe --dirty --always --tags | sed 's/-/./2g')
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          sed -i "s|buildVersion = null;|buildVersion = \"$VERSION\";|" flake.nix

      - name: Build Artifacts
        run: nix build .#release --option warn-dirty false --print-build-logs

      - name: Upload Artifacts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: output
          path: result/**

      - name: Push Artifacts to S3
        if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')) && env.AWS_USR != ''
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_USR }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_PSW }}
          AWS_DEFAULT_REGION: us-east-1
        run: nix run --option warn-dirty false .#push-artifacts -- "${GITHUB_REF##*/}"

      - name: Promote Artifacts to Master Channel
        if: github.ref == 'refs/heads/main' && env.AWS_USR != ''
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_USR }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_PSW }}
          AWS_DEFAULT_REGION: us-east-1
        run: nix run --option warn-dirty false .#promote-artifacts -- main "$VERSION" master

  # Validate our generated docs.
  validate-docs:
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    needs: [build-artifacts]

    steps:
      - name: Checkout crossplane/docs
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          repository: crossplane/docs
          persist-credentials: false
          path: ./docs

      - name: Download Artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: output
          path: .

      - name: Generate docs
        run: |
          chmod +x ./bin/linux_amd64/crossplane
          ./bin/linux_amd64/crossplane config set features.enableAlpha true
          ./bin/linux_amd64/crossplane generate-docs -o ./docs/content/cli/master/command-reference.md

      - name: Run Vale
        uses: vale-cli/vale-action@85f9f7f2c5f449ac0ae5b66662961bae3f77ca6a # 2.1.2
        with:
          version: "3.14.2"
          files: ./docs/content/cli/master/command-reference.md
          vale_flags: "--config=./docs/utils/vale/.vale.ini"
          fail_on_error: true
          reporter: local
          filter_mode: nofilter

      - name: Show generated docs on failure
        if: ${{ failure() }}
        run: |
          cat ./docs/content/cli/master/command-reference.md

      # If we're running on main, create a PR to update the "master" version of
      # the reference docs on docs.crossplane.io, which should always reflect
      # the current main build.
      #
      # To reduce noise, avoid creating a docs update PR if only the version
      # number has changed. We assume a diffstat of +1/-1 is just a version
      # number change.
      - name: Find docs changes
        if: ${{ github.ref == 'refs/heads/main' }}
        id: find-changes
        run: |
          cd docs
          diffstat=$(git diff --numstat content/cli/master/command-reference.md)
          added=$(echo "$diffstat" | awk '{ print $1 }')
          deleted=$(echo "$diffstat" | awk '{ print $2 }')
          changed="false"
          if [[ ${added} -ne 1 || ${deleted} -ne 1 ]]; then
            changed="true"
          fi
          echo "changed=${changed}" >> "$GITHUB_OUTPUT"

      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
        if: ${{ github.ref == 'refs/heads/main' && steps.find-changes.outputs.changed == 'true' }}
        id: generate-token
        with:
          app-id: ${{ secrets.CLI_DOCS_BOT_APP_ID }}
          private-key: ${{ secrets.CLI_DOCS_BOT_APP_PRIVATE_KEY }}
          owner: crossplane
          repositories: docs

      - name: Create docs PR
        if: ${{ github.ref == 'refs/heads/main' && steps.find-changes.outputs.changed == 'true' }}
        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
        with:
          token: ${{ steps.generate-token.outputs.token }}
          path: ./docs
          commit-message: Update master CLI reference docs for ${{ needs.build-artifacts.outputs.version }}
          author: cli-docs-bot <info@crossplane.io>
          signoff: true
          title: Update master CLI reference docs for ${{ needs.build-artifacts.outputs.version }}
          # We use a static branch name so that if an existing PR is already
          # open it gets updated, rather than opening a sequence of PRs of which
          # it makes sense to merge only the most recent.
          branch: auto-update-cli-docs
          add-paths: content/cli/master/command-reference.md