name: PR - Docker build test

on:
    pull_request:
        branches:
            - master
        paths:
            - '.github/workflows/docker-test.yml'
            - 'lib/**'
            - 'Dockerfile'
            - 'package.json'
            - 'pnpm-lock.yaml'
            - 'pnpm-workspace.yaml'
        types: [opened, reopened, synchronize, edited]
    # Please, always create a pull request instead of push to master.

concurrency:
    group: docker-test-${{ github.ref_name }}
    cancel-in-progress: true

jobs:
    test:
        name: Docker build & tests
        permissions:
            pull-requests: write
            attestations: write
        runs-on: ubuntu-latest
        timeout-minutes: 10
        steps:
            - name: Checkout
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Set up Docker Buildx # needed by `cache-from`
              uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0

            - name: Extract Docker metadata
              id: meta
              uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
              with:
                  images: rsshub
                  flavor: latest=true

            - name: Build Docker image
              uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
              with:
                  context: .
                  build-args: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=0 # also test bundling Chromium
                  load: true
                  tags: ${{ steps.meta.outputs.tags }}
                  labels: ${{ steps.meta.outputs.labels }}
                  platforms: linux/amd64 # explicit
                  cache-from: |
                      type=registry,ref=${{ vars.DOCKER_USERNAME }}/rsshub:chromium-bundled
                      type=gha,scope=docker-release-linux-amd64
                  outputs: type=docker,compression=zstd,force-compression=true # load: true means docker output type

            - name: Pull Request Labeler
              if: ${{ failure() }}
              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  script: |
                      await github.rest.issues.addLabels({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          issue_number: ${{ github.event.pull_request.number }},
                          labels: ['auto: DO NOT merge'],
                      })
                      await github.rest.issues.removeLabel({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          issue_number: ${{ github.event.pull_request.number }},
                          name: 'auto: ready to review',
                      }).catch((error) => core.warning(error))

            - name: Test Docker image
              run: bash scripts/docker/test-docker.sh

            - name: Export Docker image
              run: docker save rsshub:latest | zstdmt -o rsshub.tar.zst

            - name: Upload Docker image
              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
              with:
                  archive: false
                  path: rsshub.tar.zst
                  retention-days: 1