name: Server

on:
  push:
    branches:
      - main
    paths:
      - Server/**
      - .github/workflows/server.yml
  pull_request:
    paths:
      - Server/**
      - .github/workflows/server.yml
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: server-${{ github.ref }}
  cancel-in-progress: true

jobs:
  deployment-config:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Check deployment scripts
        run: sh -n Server/deployments/raspberry-pi/backup.sh Server/deployments/raspberry-pi/restore.sh Server/deployments/raspberry-pi/smoke-test.sh

      - name: Validate Compose model
        env:
          QSFERA_IMAGE: example.invalid/qsfera:test
          QSFERA_URL: https://cloud.example.invalid
          QSFERA_ADMIN_PASSWORD: ci-only-placeholder
          QSFERA_CONFIG_DIR: /tmp/qsfera-config
          QSFERA_DATA_DIR: /tmp/qsfera-data
          QSFERA_MEMORY_LIMIT: 1g
        run: docker compose -f Server/deployments/raspberry-pi/compose.yaml config --quiet

  vulnerability-scan:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: Server
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Go from go.mod
        uses: actions/setup-go@v6
        with:
          go-version-file: Server/go.mod
          cache-dependency-path: Server/go.sum

      - name: Install native image dependency
        run: sudo apt-get update && sudo apt-get install --yes libvips-dev

      - name: Run pinned govulncheck
        run: make govulncheck