ci.yml

name: Tests
on:
  push:
  pull_request:
    branches: [main]
  schedule:
    - cron: "2 0 * * *" # Run every day at 02:00 UTC.
  workflow_dispatch:

permissions:
  packages: write

env:
  REGISTRY_USER: ${{ github.actor }}
  REGISTRY_PASSWORD: ${{ github.token }}
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
  # This is required for running GUI tests on Github Actions
  DISPLAY: ":99.0"
  QT_SELECT: "qt6"

# Disable multiple concurrent runs on the same branch
# When a new CI build is triggered, it will cancel the
# other in-progress ones (for the same branch)
concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  run-lint:
    runs-on: ubuntu-latest
    container:
      image: debian:bookworm
    steps:
      - uses: actions/checkout@v4
      - name: Install dev. dependencies
        run: |-
          apt-get update
          apt-get install -y git make python3 python3-poetry --no-install-recommends
          poetry install --only lint,test
      - name: Run linters to enforce code style
        run: poetry run make lint
      - name: Check that the QA script is up to date with the docs
        run: "./dev_scripts/qa.py --check-refs"

  # This is already built daily by the "build.yml" file
  # But we also want to include this in the checks that run on each push.
  build-container-image:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Get current date
        id: date
        run: echo "::set-output name=date::$(date +'%Y-%m-%d')"

      - name: Cache container image
        id: cache-container-image
        uses: actions/cache@v4
        with:
          key: v2-${{ steps.date.outputs.date }}-${{ hashFiles('Dockerfile', 'dangerzone/conversion/common.py', 'dangerzone/conversion/doc_to_pixels.py', 'dangerzone/conversion/pixels_to_pdf.py', 'poetry.lock', 'gvisor_wrapper/entrypoint.py') }}
          path: |-
            share/container.tar.gz
            share/image-id.txt

      - name: Build Dangerzone container image
        if: ${{ steps.cache-container-image.outputs.cache-hit != 'true' }}
        run: |
          sudo apt-get install -y python3-poetry
          python3 ./install/common/build-image.py

  windows:
    runs-on: windows-latest
    env:
      DUMMY_CONVERSION: 1
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install poetry
      - run: poetry install
      - name: Run CLI tests
        run: poetry run make test
      # Taken from: https://github.com/orgs/community/discussions/27149#discussioncomment-3254829
      - name: Set path for candle and light
        run: echo "C:\Program Files (x86)\WiX Toolset v3.14\bin" >> $GITHUB_PATH
        shell: bash
      - name: Build the MSI installer
        # NOTE: This also builds the .exe internally.
        run: poetry run .\install\windows\build-app.bat

  macOS:
    runs-on: macos-latest
    env:
      DUMMY_CONVERSION: 1
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install poetry
      - run: poetry install
      - name: Run CLI tests
        run: poetry run make test

  build-deb:
    name: "build-deb (${{ matrix.distro }} ${{ matrix.version }})"
    runs-on: ubuntu-latest
    needs: build-container-image
    strategy:
      matrix:
        include:
          - distro: ubuntu
            version: "20.04"
          - distro: ubuntu
            version: "22.04"
          - distro: ubuntu
            version: "23.10"
          - distro: ubuntu
            version: "24.04"
          - distro: debian
            version: bullseye
          - distro: debian
            version: bookworm
          - distro: debian
            version: trixie
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Login to GHCR
        run: |
          echo ${{ github.token }} | podman login ghcr.io -u USERNAME --password-stdin

      - name: Get the dev environment
        run: |
          ./dev_scripts/env.py \
              --distro ${{ matrix.distro }} \
              --version ${{ matrix.version }} \
              build-dev --sync

      - name: Get current date
        id: date
        run: echo "::set-output name=date::$(date +'%Y-%m-%d')"

      - name: Restore container cache
        uses: actions/cache/restore@v4
        with:
          key: v2-${{ steps.date.outputs.date }}-${{ hashFiles('Dockerfile', 'dangerzone/conversion/common.py', 'dangerzone/conversion/doc_to_pixels.py', 'dangerzone/conversion/pixels_to_pdf.py', 'poetry.lock', 'gvisor_wrapper/entrypoint.py') }}
          path: |-
            share/container.tar.gz
            share/image-id.txt
          fail-on-cache-miss: true

      - name: Build Dangerzone .deb
        run: |
          ./dev_scripts/env.py --distro ${{ matrix.distro }} \
              --version ${{ matrix.version }} \
              run --dev --no-gui ./dangerzone/install/linux/build-deb.py

      - name: Upload Dangerzone .deb
        if: matrix.distro == 'debian' && matrix.version == 'bookworm'
        uses: actions/upload-artifact@v4
        with:
          name: dangerzone.deb
          path: "deb_dist/dangerzone_*_*.deb"
          if-no-files-found: error
          compression-level: 0

  install-deb:
    name: "install-deb (${{ matrix.distro }} ${{ matrix.version }})"
    runs-on: ubuntu-latest
    needs: build-deb
    strategy:
      matrix:
        include:
          - distro: ubuntu
            version: "20.04"
          - distro: ubuntu
            version: "22.04"
          - distro: ubuntu
            version: "23.10"
          - distro: ubuntu
            version: "24.04"
          - distro: debian
            version: bullseye
          - distro: debian
            version: bookworm
          - distro: debian
            version: trixie

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Download Dangerzone .deb
        uses: actions/download-artifact@v4
        with:
          name: dangerzone.deb
          path: "deb_dist/"

      - name: Build end-user environment
        run: |
          ./dev_scripts/env.py --distro ${{ matrix.distro }} \
              --version ${{ matrix.version }} \
              build

      - name: Run a test command
        run: |
          ./dev_scripts/env.py --distro ${{ matrix.distro }} \
              --version ${{ matrix.version }} \
              run dangerzone-cli dangerzone/tests/test_docs/sample-pdf.pdf

      - name: Check that the Dangerzone GUI imports work
        run: |
          ./dev_scripts/env.py --distro ${{ matrix.distro }} \
              --version ${{ matrix.version }} \
              run dangerzone --help

  build-install-rpm:
    name: "build-install-rpm (${{ matrix.distro }} ${{matrix.version}})"
    runs-on: ubuntu-latest
    needs: build-container-image
    strategy:
      matrix:
        distro: ["fedora"]
        version: ["39", "40"]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Login to GHCR
        run: |
          echo ${{ github.token }} | podman login ghcr.io -u USERNAME --password-stdin

      - name: Get the dev environment
        run: |
          ./dev_scripts/env.py \
              --distro ${{ matrix.distro }} \
              --version ${{ matrix.version }} \
              build-dev --sync

      - name: Get current date
        id: date
        run: echo "::set-output name=date::$(date +'%Y-%m-%d')"

      - name: Restore container image
        uses: actions/cache/restore@v4
        with:
          key: v2-${{ steps.date.outputs.date }}-${{ hashFiles('Dockerfile', 'dangerzone/conversion/common.py', 'dangerzone/conversion/doc_to_pixels.py', 'dangerzone/conversion/pixels_to_pdf.py', 'poetry.lock', 'gvisor_wrapper/entrypoint.py') }}
          path: |-
            share/container.tar.gz
            share/image-id.txt
          fail-on-cache-miss: true

      - name: Build Dangerzone .rpm
        run: |
          ./dev_scripts/env.py --distro ${{ matrix.distro }} --version ${{ matrix.version }} \
              run --dev --no-gui ./dangerzone/install/linux/build-rpm.py

      # Reclaim some space in this step, now that the dev environment is no
      # longer necessary. Previously, we encountered out-of-space issues while
      # running this CI job.
      - name: Reclaim some storage space
        run: podman system reset -f

      - name: Build end-user environment
        run: |
          ./dev_scripts/env.py --distro ${{ matrix.distro }} \
              --version ${{ matrix.version }} \
              build --download-pyside6

      - name: Run a test command
        run: |
          ./dev_scripts/env.py --distro ${{ matrix.distro }} --version ${{ matrix.version }} \
              run dangerzone-cli dangerzone/tests/test_docs/sample-pdf.pdf

      - name: Check that the Dangerzone GUI imports work
        run: |
          ./dev_scripts/env.py --distro ${{ matrix.distro }} --version ${{ matrix.version }} \
              run dangerzone --help

  run-tests:
    name: "run tests (${{ matrix.distro }} ${{ matrix.version }})"
    runs-on: ubuntu-latest
    needs: build-container-image
    strategy:
      matrix:
        include:
          - distro: ubuntu
            version: "20.04"
          - distro: ubuntu
            version: "22.04"
          - distro: ubuntu
            version: "23.10"
          - distro: ubuntu
            version: "24.04"
          - distro: debian
            version: bullseye
          - distro: debian
            version: bookworm
          - distro: debian
            version: trixie
          - distro: fedora
            version: "39"
          - distro: fedora
            version: "40"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Login to GHCR
        run: |
          echo ${{ github.token }} | podman login ghcr.io -u USERNAME --password-stdin

      - name: Get current date
        id: date
        run: echo "::set-output name=date::$(date +'%Y-%m-%d')"

      - name: Get the dev environment
        run: |
          ./dev_scripts/env.py \
              --distro ${{ matrix.distro }} \
              --version ${{ matrix.version }} \
              build-dev --sync

      - name: Restore container image
        uses: actions/cache/restore@v4
        with:
          key: v2-${{ steps.date.outputs.date }}-${{ hashFiles('Dockerfile', 'dangerzone/conversion/common.py', 'dangerzone/conversion/doc_to_pixels.py', 'dangerzone/conversion/pixels_to_pdf.py', 'poetry.lock', 'gvisor_wrapper/entrypoint.py') }}
          path: |-
            share/container.tar.gz
            share/image-id.txt
          fail-on-cache-miss: true

      - name: Setup xvfb (Linux)
        run: |
          # Stuff copied wildly from several stackoverflow posts
          sudo apt-get install -y xvfb libxkbcommon-x11-0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 libxcb-randr0 libxcb-render-util0 libxcb-xinerama0 libxcb-xinput0 libxcb-xfixes0 libxcb-shape0 libglib2.0-0 libgl1-mesa-dev '^libxcb.*-dev' libx11-xcb-dev libglu1-mesa-dev libxrender-dev libxi-dev libxkbcommon-dev libxkbcommon-x11-dev

          # start xvfb in the background
          sudo /usr/bin/Xvfb $DISPLAY -screen 0 1280x1024x24 &

      - name: Run CI tests
        run: |-
          ./dev_scripts/env.py --distro ${{ matrix.distro }} --version ${{ matrix.version }} run --dev \
              bash -c 'cd dangerzone; poetry run make test'