fish-config/.github/workflows/ci.yml

name: CI

on:
  push:
    branches:
      - main
    paths:
      - "docs/manual/**"
      - "docs/build-manual.py"
      - "docs/manualtools.py"
      - "docs/verify-manual.py"
      - "docs/site/**"
      - "functions/**"
      - "conf.d/**"
      - "config.fish"
      - "completions/**"
      - "integrations/**"
      - "tests/**"
  workflow_dispatch:
    inputs:
      job:
        description: "Job to run"
        required: false
        default: all
        type: choice
        options:
          - all
          - test
          - build-docs

jobs:
  # This workflow file is mirrored to GitHub as-is, but the runner label
  # below (racknerd-mini) only exists on the Gitea instance -- on GitHub
  # the job just sits queued forever with no matching runner, so the
  # mirror never gets a completed status. Gate the real jobs to Gitea and
  # let the github-mirror job below stand in on GitHub instead.
  test:
    if: |
      github.server_url != 'https://github.com' &&
      (github.event_name != 'workflow_dispatch' || github.event.inputs.job == 'all' || github.event.inputs.job == 'test')
    runs-on: racknerd-mini
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}

      - name: Install fish
        run: |
          sudo apt-get -o Acquire::Retries=3 update -qq
          # apt-utils, so debconf has a target for the "delaying package
          # configuration" notice's OWN follow-up run (irrelevant to
          # anything else in this job). That notice still fires exactly
          # once here regardless -- verified live against two orderings
          # (bundled with another package, and installed fully alone,
          # first) -- because it fires *during* apt-utils' own first
          # install, before debconf considers it "installed". Nothing
          # this workflow controls can pre-seed that; accepted as
          # unavoidable, same as the runs-on/checkout hint noise below.
          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common
          sudo add-apt-repository -y ppa:fish-shell/release-4
          sudo apt-get -o Acquire::Retries=3 update -qq
          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y fish

      - name: Run fish config tests
        run: fish tests/run-tests.fish

  build-docs:
    needs: test
    if: |
      github.server_url != 'https://github.com' &&
      always() &&
      (github.event.inputs.job == 'build-docs' ||
        ((github.event_name != 'workflow_dispatch' || github.event.inputs.job == 'all') &&
          needs.test.result == 'success'))
    runs-on: racknerd-mini
    env:
      # Silences Node's internal "punycode module is deprecated" notice
      # (astro's toolchain still requires it transitively) on every node
      # invocation in this job, setup-node's own included.
      NODE_OPTIONS: --no-deprecation
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}

      - name: Install dependencies
        run: |
          sudo apt-get -o Acquire::Retries=3 update -qq
          # apt-utils: see the "Install fish" step's identical comment in
          # the test job for why its own debconf notice is accepted, not
          # chased further.
          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common
          sudo add-apt-repository -y ppa:fish-shell/release-4
          sudo apt-get -o Acquire::Retries=3 update -qq
          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y pandoc python3-yaml fish

      - name: Generate concatenated markdown
        run: python3 docs/build-manual.py --concat -o docs/fish-config.md

      # Regeneration MUST run before verification: verify-manual.py's
      # test_concat_roundtrips_original compares a freshly-built concat
      # against docs/fish-config.md on disk. Before this step ran, that
      # file was still the stale pre-push copy, so any ordinary edit under
      # docs/manual/** failed the round-trip check before anything was
      # regenerated. Do not reorder this back — verification still gates
      # pandoc and the auto-commit below, it just no longer requires a
      # contributor to hand-sync the generated file before pushing.
      - name: Verify manual integrity
        run: python3 docs/verify-manual.py

      - name: Compile man page
        run: |
          pandoc --standalone \
                 --from markdown \
                 --to man \
                 docs/fish-config.md \
                 -o docs/fish-config.1

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "24"

      - name: Generate site content
        run: python3 docs/build-manual.py --site

      - name: Build project wiki
        working-directory: docs/site
        run: |
          npm ci --no-fund
          npx astro build

      - name: Deploy to Cloudflare Pages
        working-directory: docs/site
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
        run: |
          npx --yes wrangler pages deploy dist/ \
            --project-name=fish-config-docs \
            --branch=main \
            --commit-dirty=true

      - name: Commit generated docs
        env:
          BOT_GPG_KEY: ${{ secrets.CI_GPG_PRIVATE_KEY }}
        run: |
          # actions@gitea was never a verified email on any account, so
          # these commits could never show as signed/verified regardless
          # of server config. fishconfig-bot is a dedicated Gitea account
          # (verified email, no login) that owns this key; the private
          # key lives only in the CI_GPG_PRIVATE_KEY repo secret.
          #
          # Secret is base64-encoded: a raw multi-line armored key piped
          # through `echo "$VAR" | gpg --import` came out CRC-corrupted
          # ("Invalid keyring") the first time this ran -- something in
          # the secret/env round-trip mangles embedded newlines. Base64
          # collapses it to one line immune to that.
          export GNUPGHOME="$(mktemp -d)"
          chmod 700 "$GNUPGHOME"
          echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf"
          echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
          command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg
          echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --quiet --import
          git config user.name  "Gitea Actions Bot"
          git config user.email "fishconfig-bot@git.rootiest.dev"
          git config user.signingkey CAA082C2F3467E1F7217AD492075C120312D23F4
          git config commit.gpgsign true
          git add docs/fish-config.md docs/fish-config.1 conf.d/__fish_config_op_registry.fish
          git diff --cached --quiet && echo "No changes to commit" && exit 0
          git commit -m "chore(docs): regenerate manual, man page, and component registry"
          git push

  # Stand-in for the GitHub mirror so the commit gets a completed status
  # instead of the real jobs above sitting queued forever for a
  # self-hosted runner that only exists on the Gitea instance.
  github-mirror:
    if: github.server_url == 'https://github.com'
    runs-on: ubuntu-latest
    steps:
      - name: Note that CI runs on Gitea
        run: |
          echo "This repository mirrors from Gitea (git.rootiest.dev), where CI actually runs."
          echo "See the commit's status on the Gitea instance for the real test/build-docs results."