ersatztv/.gitea/workflows/docker-build.yml

name: Build ErsatzTV Image

# Builds the fork's own amd64 image and pushes it to the Gitea container registry.
#   pull_request      -> test job only (no image build/push)
#   push to main      -> :latest + :<short-sha>   (test image; does NOT touch prod)
#   push tag v*       -> :prod + :<version> + :<short-sha>   (prod release)
#   workflow_dispatch -> manual run; only publishes when the ref is main or a v* tag
#
# Runner + registry provisioned in server-management#172. The Gitea registry is
# HTTP-only, so BuildKit needs the inline `http = true` config below (it does not
# inherit the host daemon's insecure-registries setting).
#
# `:latest` is intentionally the test/dev channel (per ersatztv#3); prod pins
# `:prod`, never `:latest` (enforced in the prod compose — server-management#481).

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
    tags:
      - 'v*'

# Single runner on jazz: serialize all runs so the push-main-then-tag release
# flow can't collide on the shared :buildcache tag or the smoke container.
concurrency:
  group: ersatztv-build
  cancel-in-progress: false

env:
  REGISTRY: 192.168.1.95:3000
  IMAGE: 192.168.1.95:3000/timothy/ersatztv

jobs:
  test:
    name: Build & test (.NET)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '22.x'
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Install SPA dependencies
        working-directory: web
        run: npm ci

      - name: Check generated SPA API client
        working-directory: web
        run: npm run check:api

      - name: Lint SPA
        working-directory: web
        run: npm run lint

      - name: Typecheck SPA
        working-directory: web
        run: npm run typecheck

      - name: Test SPA
        working-directory: web
        run: npm test -- --run

      - name: Build SPA
        working-directory: web
        run: npm run build

      - name: Strip Scanner project ref (matches Docker build)
        run: sed -i '/Scanner/d' ErsatzTV/ErsatzTV.csproj

      - name: Build
        run: dotnet build --configuration Release --no-restore

      - name: Test
        run: dotnet test --configuration Release --no-build --blame-hang-timeout "2m" --verbosity normal

  migrations:
    name: EF migration integrity (SQLite + MySql)
    runs-on: ubuntu-latest
    # Independent gate (not a 'needs' of build yet) so the new MySql-service dependency
    # can't block image builds until it's proven reliable on the runner. Promote to a
    # required check / build dependency once green. (ersatztv#13)
    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_ROOT_PASSWORD: ersatztv
          MYSQL_DATABASE: ersatztv_migrations
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -persatztv --silent"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=30
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore

      - name: Build
        run: dotnet build --configuration Release --no-restore

      - name: Install dotnet-ef
        run: dotnet tool install --global dotnet-ef --version 9.0.12

      # SQLite is the prod provider; both checks validated locally.
      - name: SQLite — model drift + apply all migrations to a fresh DB
        run: |
          set -euo pipefail
          export PATH="$PATH:$HOME/.dotnet/tools"
          echo "::group::SQLite model drift (has-pending-model-changes)"
          dotnet ef migrations has-pending-model-changes --no-build --configuration Release \
            --context TvContext --startup-project ErsatzTV --project ErsatzTV.Infrastructure.Sqlite -- --provider Sqlite
          echo "::endgroup::"
          echo "::group::SQLite apply all migrations to a fresh DB"
          export ETV_CONFIG_FOLDER="$(mktemp -d)" ETV_TRANSCODE_FOLDER="$(mktemp -d)"
          dotnet ef database update --no-build --configuration Release \
            --context TvContext --startup-project ErsatzTV --project ErsatzTV.Infrastructure.Sqlite -- --provider Sqlite
          echo "::endgroup::"

      # MySql uses ServerVersion.AutoDetect (connects at config time), so it runs against the
      # service container above. MySql__ConnectionString maps to config key "MySql:ConnectionString".
      - name: MySql — model drift + apply all migrations to a fresh DB
        env:
          MySql__ConnectionString: "Server=mysql;Port=3306;Database=ersatztv_migrations;Uid=root;Pwd=ersatztv;"
        run: |
          set -euo pipefail
          export PATH="$PATH:$HOME/.dotnet/tools"
          echo "::group::MySql model drift (has-pending-model-changes)"
          dotnet ef migrations has-pending-model-changes --no-build --configuration Release \
            --context TvContext --startup-project ErsatzTV --project ErsatzTV.Infrastructure.MySql -- --provider MySql
          echo "::endgroup::"
          echo "::group::MySql apply all migrations to a fresh DB"
          dotnet ef database update --no-build --configuration Release \
            --context TvContext --startup-project ErsatzTV --project ErsatzTV.Infrastructure.MySql -- --provider MySql
          echo "::endgroup::"

  build:
    name: Build & push image (amd64)
    runs-on: ubuntu-latest
    needs: [test, migrations]
    if: github.event_name != 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Compute version and tags
        id: meta
        run: |
          SHORT=$(git rev-parse --short HEAD)
          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            VERSION="${GITHUB_REF_NAME#v}"
            INFO_VERSION="${VERSION}"
            TAGS=("${IMAGE}:prod" "${IMAGE}:${VERSION}" "${IMAGE}:${SHORT}")
          else
            DESC=$(git describe --tags --abbrev=0 2>/dev/null || echo v0.0.0)
            INFO_VERSION="${DESC#v}-${SHORT}"
            TAGS=("${IMAGE}:latest" "${IMAGE}:${SHORT}")
          fi
          echo "info_version=${INFO_VERSION}" >> "$GITHUB_OUTPUT"
          echo "short=${SHORT}" >> "$GITHUB_OUTPUT"
          {
            echo "tags<<__EOT__"
            printf '%s\n' "${TAGS[@]}"
            echo "__EOT__"
          } >> "$GITHUB_OUTPUT"
          echo "INFO_VERSION=${INFO_VERSION}"
          printf 'tag: %s\n' "${TAGS[@]}"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
            [registry."192.168.1.95:3000"]
              http = true

      - name: Login to Gitea registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/Dockerfile
          platforms: linux/amd64
          # only publish from main or a v* tag; other refs (e.g. branch dispatch) build only
          push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
          provenance: false
          build-args: |
            INFO_VERSION=${{ steps.meta.outputs.info_version }}
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=registry,ref=192.168.1.95:3000/timothy/ersatztv:buildcache
          cache-to: type=registry,ref=192.168.1.95:3000/timothy/ersatztv:buildcache,mode=max,ignore-error=true

      - name: Smoke + IPTV E2E (assert key endpoints)
        if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
        run: |
          IMG="${IMAGE}:${{ steps.meta.outputs.short }}"
          NAME="etv-smoke-${{ github.run_id }}"
          trap 'docker rm -f "$NAME" >/dev/null 2>&1 || true' EXIT
          echo "Pulling ${IMG}"
          docker pull "$IMG"
          docker run -d --name "$NAME" --memory 2g \
            -e ETV_CONFIG_FOLDER=/tmp/etv/config \
            -e ETV_TRANSCODE_FOLDER=/tmp/etv/transcode \
            "$IMG"
          # probe ErsatzTV's web server from inside the container (image ships python3)
          cat > probe.py <<'PY'
          import urllib.request, urllib.error, sys
          try:
              urllib.request.urlopen("http://localhost:8409/", timeout=3)
          except urllib.error.HTTPError:
              pass          # any HTTP status means the server is serving
          except Exception:
              sys.exit(1)   # not listening yet
          PY
          ok=0
          for _ in $(seq 1 60); do
            if [ -z "$(docker ps -q --filter name="$NAME" --filter status=running)" ]; then
              echo "Container exited early"; break
            fi
            if docker exec -i "$NAME" python3 - < probe.py >/dev/null 2>&1; then
              ok=1; break
            fi
            sleep 2
          done
          if [ "$ok" != "1" ]; then
            echo "===== container logs (tail) ====="; docker logs "$NAME" 2>&1 | tail -n 40 || true
            echo "Smoke test FAILED: ErsatzTV did not serve HTTP on :8409"
            exit 1
          fi
          echo "HTTP ready; asserting key IPTV endpoints (ersatztv#16)"
          # E2E: assert the real Jellyfin-facing surfaces serve a valid playlist + guide, not just
          # that the app answers HTTP. xmltv.xml needs channels.xml, which the scheduler writes a
          # few seconds after boot, so poll each endpoint until it returns 2xx with the right shape.
          # urlopen() returns only on 2xx (raises on 4xx/5xx), so reaching sys.exit means status OK.
          check() {
            local path="$1" needle="$2" i
            for i in $(seq 1 20); do
              if docker exec "$NAME" python3 -c "import urllib.request,sys; b=urllib.request.urlopen('http://localhost:8409$path',timeout=5).read(512).decode('utf-8','replace'); sys.exit(0 if '$needle' in b else 1)" 2>/dev/null; then
                echo "  OK   $path (2xx, contains '$needle')"; return 0
              fi
              sleep 3
            done
            echo "  FAIL $path (no 2xx containing '$needle' within timeout)"; return 1
          }
          if check "/iptv/channels.m3u" "#EXTM3U" && check "/iptv/xmltv.xml" "<tv" && check "/app/" "ChicoryTV"; then
            echo "Smoke + IPTV E2E passed: channels.m3u + xmltv.xml serve a valid playlist + guide; /app/ serves the ChicoryTV SPA"
          else
            echo "===== container logs (tail) ====="; docker logs "$NAME" 2>&1 | tail -n 40 || true
            exit 1
          fi