Wegwichtel/.gitea/workflows/build-and-deploy.yaml

name: Sonarqube Scanner

on:
  push:
    branches:
      - main
    paths-ignore:
      - '.gitea/workflows/**'

  workflow_dispatch:
    inputs:
      job:
        description: "Job auswählen"
        required: true
        default: all
        type: choice
        options:
          - all
          - prepare
          - build
          - analyse
          - deploy

jobs:
  prepare:
    name: Prepare environment
    runs-on: web

    if: |
      ${{
        gitea.event_name == 'push' ||
        inputs.job == 'all' ||
        inputs.job == 'prepare' ||
        inputs.job == 'build' ||
        inputs.job == 'analyse'
      }}

    steps:
      - name: Check runtime environment
        run: |-
          node --version
          npm --version
          java -version

      - name: Download SonarQube Scanner
        env:
          SONAR_SCANNER_VERSION: ${{ vars.SONAR_SCANNER_VERSION }}
        run: |-
          apk --no-cache add curl unzip

          curl --create-dirs -sSLo /tmp/sonar-scanner.zip \
            "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$SONAR_SCANNER_VERSION.zip"

      - name: Verify SonarQube Scanner archive
        env:
          SONAR_SCANNER_HOME: ${{ vars.SONAR_SCANNER_HOME }}
        run: |-
          unzip -o /tmp/sonar-scanner.zip -d /tmp/

          test -f "$SONAR_SCANNER_HOME/bin/sonar-scanner"

          "$SONAR_SCANNER_HOME/bin/sonar-scanner" --version

      - name: Store SonarQube Scanner
        uses: actions/upload-artifact@v4
        with:
          name: sonar-scanner
          path: /tmp/sonar-scanner.zip
          retention-days: 1


  build:
    name: Build and test
    runs-on: web
    needs: prepare

    if: |
      ${{
        gitea.event_name == 'push' ||
        inputs.job == 'all' ||
        inputs.job == 'build' ||
        inputs.job == 'analyse'
      }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install dependencies
        run: |-
          npm ci

      - name: Run Coverage tests
        env:
          API_USER: ${{ secrets.API_USER }}
          API_PASSWORD: ${{ secrets.API_SECRET }}
        run: |-
          rm -rf coverage
          npm run test:coverage

      - name: Store Coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage/
          retention-days: 1


  analyse:
    name: SonarQube analysis
    runs-on: web
    needs: build

    if: |
      ${{
        gitea.event_name == 'push' ||
        inputs.job == 'all' ||
        inputs.job == 'analyse'
      }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install required tools
        run: |-
          apk --no-cache add unzip

      - name: Download SonarQube Scanner
        uses: actions/download-artifact@v4
        with:
          name: sonar-scanner
          path: /tmp

      - name: Extract SonarQube Scanner
        env:
          SONAR_SCANNER_HOME: ${{ vars.SONAR_SCANNER_HOME }}
        run: |-
          unzip -o /tmp/sonar-scanner.zip -d /tmp/

          test -f "$SONAR_SCANNER_HOME/bin/sonar-scanner"

          chmod +x "$SONAR_SCANNER_HOME/bin/sonar-scanner"

          "$SONAR_SCANNER_HOME/bin/sonar-scanner" --version

      - name: Download Coverage report
        uses: actions/download-artifact@v4
        with:
          name: coverage
          path: coverage

      - name: Verify Coverage report
        run: |-
          test -s coverage/js/lcov.info
          test -s coverage/python/coverage.xml

      - name: Run sonar-scanner
        env:
          SONAR_SCANNER_HOME: ${{ vars.SONAR_SCANNER_HOME }}
          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
          SONAR_PROJECT_KEY: ${{ vars.SONAR_PROJECT_KEY }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: |-
          "$SONAR_SCANNER_HOME/bin/sonar-scanner" \
            -Dsonar.projectKey="$SONAR_PROJECT_KEY" \
            -Dsonar.host.url="$SONAR_HOST_URL" \
            -Dsonar.javascript.lcov.reportPaths=coverage/js/lcov.info \
            -Dsonar.python.coverage.reportPaths=coverage/python/coverage.xml \
            -Dsonar.sources=src,public,scripts,server.js,tools/python \
            -Dsonar.tests=test,test-support \
            -Dsonar.test.inclusions=test/**/*.test.js \
            -Dsonar.test-support.inclusions=test-support/**/*.js \
            -Dsonar.exclusions=public/vendor/**,node_modules/**,data/**,storage/**

      - name: Check SonarQube Quality Gate
        uses: SonarSource/sonarqube-quality-gate-action@v1
        timeout-minutes: 5
        env:
          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}


  deploy:
    name: Deploy to Server
    runs-on: web
    needs: analyse

    if: |
      ${{
        always() &&
        (
          (
            gitea.event_name == 'push' &&
            needs.analyse.result == 'success'
          ) ||
          (
            gitea.event_name == 'workflow_dispatch' &&
            inputs.job == 'all' &&
            needs.analyse.result == 'success'
          ) ||
          (
            gitea.event_name == 'workflow_dispatch' &&
            inputs.job == 'deploy'
          )
        )
      }}

    steps:            
      - name: Deploy Wegwichtel
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ vars.SSH_HOST }}
          username: ${{ vars.SSH_USER }}
          key: ${{ secrets.SSH_KEY }}
          script: |-
            set -e

            cd "$HOME/Wegwichtel"

            git pull --ff-only

            systemctl --user restart wegwichtel.service
            systemctl --user is-active --quiet wegwichtel.service

            echo "Wegwichtel erfolgreich aktualisiert und neu gestartet."