ci.yml

name: ci
on:
  push:
    branches: [ "main" ]
  workflow_dispatch:
    inputs:
      plugins:
        description: "Plugins to build and publish (i.e. connect-go:latest, connect-go, grpc/java:v1.53.0)"
        default: ''
        type: string

env:
  DOCKER_ORG: "ghcr.io/bufbuild"

# Ref: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions
permissions:
  actions: read
  contents: read
  packages: write

concurrency:
  group: ci-${{ github.ref }}
  # Queue pending runs instead of replacing them, so we build every commit.
  # Ref: https://github.blog/changelog/2026-05-07-github-actions-concurrency-groups-now-allow-larger-queues/
  queue: max

defaults:
  run:
    shell: bash

jobs:
  ci:
    runs-on: ubuntu-latest-4-cores
    steps:
    - name: set PLUGINS from workflow inputs
      if: ${{ inputs.plugins }}
      run: echo "PLUGINS=${{ inputs.plugins }}" >> $GITHUB_ENV
    - uses: actions/checkout@v7
      with:
        fetch-depth: 0
    - name: Install Go
      uses: actions/setup-go@v7
      with:
        go-version-file: 'go.mod'
        check-latest: true
    - name: Calculate changed plugins and set PLUGINS env var from the commit being built
      if: ${{ inputs.plugins == '' }}
      run: |
        # We only allow squash merges to main, so we only need to look one commit back.
        # Combined with concurrency `queue: max`, we should build every commit to main.
        # We have to do this because `base_sha` from the GitHub API is no longer reliable.
        # Ref: https://github.com/orgs/community/discussions/206725
        #
        # In a break glass scenario, run this workflow manually and specify the PLUGINS input.
        # This will force a rebuild and publish of the selected plugins.
        val=$(go run ./internal/cmd/changed-plugins --base-ref HEAD~1)
        if [[ -n "${val}" && -z "${PLUGINS}" ]]; then
          echo "PLUGINS=${val}" >> $GITHUB_ENV
        fi
    - name: Get buf version
      shell: bash
      run: |
        echo BUF_VERSION=$(go list -m -f '{{.Version}}' github.com/bufbuild/buf | cut -c2-) >> $GITHUB_ENV
    - uses: bufbuild/buf-action@v1
      with:
        setup_only: true
    - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
    - name: Login to Docker Hub
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    - name: Set up Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
    - name: Login to GitHub Container Registry
      if: github.repository == 'bufbuild/plugins'
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Test
      run: make test
    - name: Push to GHCR
      if: github.repository == 'bufbuild/plugins'
      run: make dockerpush