sharenet/.forgejo/workflows/ci.yml

name: Podman Rootless Demo
on: [push, pull_request]

jobs:
  test-backend:
    runs-on: [ci]

    # Point all steps at the host's rootless Podman socket
    env:
      # Point the client at the mounted socket
      CONTAINER_HOST: unix:///run/user/1001/podman/podman.sock
      # Make sure podman looks in the correct runtime dir hierarchy
      XDG_RUNTIME_DIR: /tmp
      RUN_ID: ${{ github.run_id }}
      POSTGRES_IMG_DIGEST: ${{ secrets.POSTGRES_IMG_DIGEST }}
      RUST_IMG_DIGEST: ${{ secrets.RUST_IMG_DIGEST }}
      PREBUILT_BACKEND_TEST_IMAGE: ${{ secrets.REGISTRY_HOST }}/${{ github.repository }}/sharenet-test-rust
      CACHE_REPO: ${{ secrets.REGISTRY_HOST }}/${{ github.repository }}/sharenet-test-rust-cache

    steps:
      - name: Checkout code
        uses: actions/checkout@v4


      - name: Verify socket visibility
        run: |
          set -euo pipefail
          id -u; id -g
          ls -ld /run/user/1001/podman
          ls -l  /run/user/1001/podman/podman.sock
          test -S /run/user/1001/podman/podman.sock

      - name: Use host rootless Podman
        run: |
          set -euo pipefail
          podman --remote info --format '{{.Host.RemoteSocket.Path}} (remote={{.Host.RemoteSocket.Exists}})'
          podman --remote version
          podman --remote run --rm alpine:3.20 echo "Hello from host rootless Podman!"

      - name: Login to container registry with PAT
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | podman --remote login \
            -u "${{ secrets.REGISTRY_USERNAME }}" \
            --password-stdin \
            "${{ secrets.REGISTRY_HOST }}"

      - name: Create network
        run: podman --remote network create integ-${{ env.RUN_ID }}

      - name: Generate cache key from lockfile
        id: cache-key
        run: |
          cd "$GITHUB_WORKSPACE/backend"
          LOCK_HASH=$(sha256sum Cargo.lock | cut -d' ' -f1)
          SHORT_HASH=$(echo "$LOCK_HASH" | cut -c1-12)
          echo "cache_key=$SHORT_HASH" >> $GITHUB_OUTPUT
          echo "Using cache key: $SHORT_HASH"

      - name: Build dependencies cache image
        run: |
          # Build deps stage with layer caching
          podman --remote build \
            --layers \
            --cache-to   "$CACHE_REPO" \
            --cache-from "$CACHE_REPO" \
            --target deps \
            -f Dockerfile.test-rust \
            -t "$PREBUILT_BACKEND_TEST_IMAGE:deps-${{ steps.cache-key.outputs.cache_key }}" \
            backend
          
          podman --remote push \
            "$PREBUILT_BACKEND_TEST_IMAGE:deps-${{ steps.cache-key.outputs.cache_key }}"

      - name: Build full test image with cached dependencies
        run: |
          # Build final image using cached deps
          podman --remote build \
            --layers \
            --cache-from "$CACHE_REPO" \
            --target runner \
            -f Dockerfile.test-rust \
            -t "$PREBUILT_BACKEND_TEST_IMAGE:test-${{ github.sha }}" \
            backend

      - name: Start PostgreSQL
        run: |  
          podman --remote run -d \
            --name test-postgres-${{ env.RUN_ID }} \
            --network integ-${{ env.RUN_ID }} \
            -e POSTGRES_PASSWORD=password \
            -e POSTGRES_USER=postgres \
            -e POSTGRES_DB=sharenet_test \
            "$POSTGRES_IMG_DIGEST"

      - name: Wait for PostgreSQL
        run: |
          timeout 60 bash -euc '
            until podman --remote exec test-postgres-${{ env.RUN_ID }} \
              pg_isready -h 127.0.0.1 -p 5432 -U postgres; do
              sleep 1
            done
          '

      - name: Ensure host Cargo cache directory exists
        run: |
          podman --remote run --rm \
            -v /home/ci-service/.cache:/c \
            alpine:3.20 sh -lc 'mkdir -p /c/cargo'

      - name: Run backend tests
        run: |
          # Run tests in the pre-built test image
          podman --remote run --rm \
            --network integ-${{ env.RUN_ID }} \
            -e DATABASE_URL=postgres://postgres:password@test-postgres-${{ env.RUN_ID }}:5432/sharenet_test \
            "$PREBUILT_BACKEND_TEST_IMAGE:test-${{ github.sha }}"

      - name: Cleanup
        if: always()
        run: |
          podman --remote rm -f test-postgres-${{ env.RUN_ID }} 2>/dev/null || true
          podman --remote network rm integ-${{ env.RUN_ID }} 2>/dev/null || true

      - name: Debug DB (on failure)
        if: failure()
        run: podman --remote logs --tail=200 test-postgres-${{ env.RUN_ID }} || true