skopeo/.github/workflows/ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  path-filter:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      all: ${{ steps.filter.outputs.all }}
      code: ${{ steps.filter.outputs.code }}
      docs: ${{ steps.filter.outputs.docs }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
        id: filter
        with:
          filters: .github/filters.yaml

  validate:
    runs-on: cncf-ubuntu-4-16-x86
    timeout-minutes: 45
    container:
      image: ghcr.io/podman-container-tools/skopeo_cidev:20260603t174659z # FIXME: Should be Renovate-managed.
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - name: fix git safe.directory
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - run: make tools
      - run: make validate-local
      - name: vendor + tree status
        run: |
          make vendor
          hack/tree_status.sh

  doccheck:
    needs: validate
    runs-on: cncf-ubuntu-4-16-x86
    timeout-minutes: 45
    container:
      image: ghcr.io/podman-container-tools/skopeo_cidev:20260603t174659z # FIXME: Should be Renovate-managed.
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - name: fix git safe.directory
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: remove pre-installed skopeo package
        run: dnf remove -y skopeo
      - name: build + install
        run: |
          make BUILDTAGS=containers_image_openpgp bin/skopeo
          make BUILDTAGS=containers_image_openpgp install PREFIX=/usr/local
      - run: make BUILDTAGS=containers_image_openpgp validate-docs

  cross:
    needs: [validate, path-filter]
    if: >-
      !contains(github.event.pull_request.title || github.event.head_commit.message, '[CI:DOCS]')
      && (github.event_name != 'pull_request'
          || needs.path-filter.outputs.all == 'true'
          || needs.path-filter.outputs.code == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version: stable
      - run: make BUILDTAGS=containers_image_openpgp local-cross

  osx:
    needs: [validate, path-filter]
    if: >-
      !contains(github.event.pull_request.title || github.event.head_commit.message, '[CI:DOCS]')
      && (github.event_name != 'pull_request'
          || needs.path-filter.outputs.all == 'true'
          || needs.path-filter.outputs.code == 'true')
    runs-on: macos-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version: stable
      - name: configure GOPATH (Makefile resolves GOBIN as $(GOPATH)/bin)
        run: |
          GOPATH="$(go env GOPATH)"
          mkdir -p "$GOPATH/bin"
          echo "GOPATH=$GOPATH" >> "$GITHUB_ENV"
          echo "$GOPATH/bin" >> "$GITHUB_PATH"
      - name: brew install gpgme (CGo dep for github.com/proglottis/gpgme)
        run: brew install gpgme
      - run: make tools
      - run: make validate-local test-unit-local bin/skopeo
      - run: ./bin/skopeo -v

  test_skopeo:
    needs: validate
    if: >-
      !contains(github.event.pull_request.title || github.event.head_commit.message, '[CI:DOCS]')
      && !contains(github.event.pull_request.title || github.event.head_commit.message, '[CI:BUILD]')
    runs-on: cncf-ubuntu-2-8-x86
    timeout-minutes: 45
    name: test_skopeo / ${{ matrix.name }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Skopeo Test
            buildtags: ""
          - name: Skopeo Test w/ openpgp
            buildtags: containers_image_openpgp
          - name: Skopeo Test w/ Sequoia
            buildtags: containers_image_sequoia
    container:
      image: ghcr.io/podman-container-tools/skopeo_cidev:20260603t174659z # FIXME: Should be Renovate-managed.
      options: --privileged
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - name: fix git safe.directory
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - run: make vendor
      - name: build + install
        run: |
          make "BUILDTAGS=${{ matrix.buildtags }}" bin/skopeo
          make "BUILDTAGS=${{ matrix.buildtags }}" install PREFIX=/usr/local
      - run: make "BUILDTAGS=${{ matrix.buildtags }}" test-unit-local
      - run: make "BUILDTAGS=${{ matrix.buildtags }}" test-integration-local
      - run: make "BUILDTAGS=${{ matrix.buildtags }}" test-system-local

  ostree_rs_ext:
    needs: [validate, path-filter]
    if: >-
      !contains(github.event.pull_request.title || github.event.head_commit.message, '[CI:DOCS]')
      && (github.event_name != 'pull_request'
          || needs.path-filter.outputs.all == 'true'
          || needs.path-filter.outputs.code == 'true')
    runs-on: cncf-ubuntu-4-16-x86
    timeout-minutes: 45
    container:
      image: quay.io/coreos-assembler/fcos-buildroot:testing-devel
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - name: fix git safe.directory
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: install rustup stable
        run: |
          dnf remove -y rust
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: build + install skopeo
        run: |
          dnf builddep -y skopeo
          make
          make install
      - name: clone ostree-rs-ext + cargo build
        run: |
          git clone --depth 1 https://github.com/ostreedev/ostree-rs-ext.git /tmp/ostree-rs-ext
          cd /tmp/ostree-rs-ext
          cargo test --no-run
      - name: cargo test
        run: |
          cd /tmp/ostree-rs-ext
          cargo test -- --nocapture --quiet

  # Merge protection is set up for this job name, do not change it.
  success:
    name: "Total Success"
    needs:
      - path-filter
      - validate
      - doccheck
      - cross
      - osx
      - test_skopeo
      - ostree_rs_ext
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check all required jobs
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]] || \
             [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "One or more required jobs failed or were cancelled"
            exit 1
          fi
          echo "All required jobs passed or were skipped"