pgadmin4/.github/workflows/check-deb-build.yml

# Replaces the pgadmin4-deb-qa Jenkins job. That job runs `make debian` on a
# dedicated EC2 VM per distribution; here each distribution is a container on a
# hosted runner instead, which is the same build in a reproducible environment
# and no VMs to maintain.
#
# Triggered on master and by hand rather than on pull requests, matching what
# the Jenkins job does today (it polls git every five minutes). Running the
# full matrix on every PR is a separate decision.

name: Check DEB builds

on:
  # Callable from snapshot.yml, so that what gets published is the
  # same build that runs on every push rather than a second
  # definition of it that can drift.
  workflow_call:

  push:
    branches: [ "master" ]
    paths:
      - 'pkg/debian/**'
      - 'pkg/linux/**'
      - 'web/**'
      # Not the message catalogues: a .po change cannot break a build or a
      # test, and check-translations already compiles them, which is the
      # check that would catch a malformed one.
      - '!web/pgadmin/translations/**'
      - 'docs/**'
      - 'requirements.txt'
      - 'Makefile'
      - 'tools/setup-python-env.sh'
      - '.github/workflows/check-deb-build.yml'

  workflow_dispatch:

concurrency:
  # The workflow's own name, spelled out rather than taken from
  # github.workflow, because in a reusable workflow that expression is
  # the CALLER's name. Every workflow Snapshot calls would otherwise
  # share one group and, with cancel-in-progress, cancel each other.
  # github.event_name is in the key because a called workflow inherits the
  # caller's ref: once this is on master, the nightly Snapshot's deb build
  # and an ordinary push's deb build would otherwise share a group and,
  # with cancel-in-progress, kill each other. A push landing mid-nightly
  # would cancel the snapshot's build and skip the publish entirely.
  group: 'check-deb-build @ ${{ github.ref }} @ ${{ github.event_name }}'
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build-deb:
    runs-on: ubuntu-24.04

    strategy:
      fail-fast: false
      matrix:
        include:
          # "name" exists only because artifact names may not contain a colon.
          - { name: 'debian-12',   image: 'debian:12' }
          - { name: 'debian-13',   image: 'debian:13' }
          - { name: 'ubuntu-2204', image: 'ubuntu:22.04' }
          - { name: 'ubuntu-2404', image: 'ubuntu:24.04' }
          - { name: 'ubuntu-2604', image: 'ubuntu:26.04' }

    container: ${{ matrix.image }}

    steps:
      # Before checkout, so the action has git available and the container has
      # the certificates it needs to fetch anything.
      - name: Install the build environment
        env:
          DEBIAN_FRONTEND: noninteractive
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
              build-essential \
              ca-certificates \
              curl \
              dh-exec \
              dpkg-dev \
              fakeroot \
              git \
              libffi-dev \
              libkrb5-dev \
              libpq-dev \
              libreadline-dev \
              libssl-dev \
              lsb-release \
              python3-dev \
              python3-pip \
              python3-sphinx \
              python3-venv \
              python3-wheel \
              unzip \
              wget \
              zlib1g-dev

      # sphinxcontrib-youtube has no distro package. --break-system-packages is
      # needed from Debian 12 and Ubuntu 24.04 onwards (PEP 668), and is
      # harmless before that, but the flag itself only exists on newer pip, so
      # fall back rather than fail.
      - name: Install the Sphinx extensions
        run: |
          python3 -m pip install --break-system-packages sphinxcontrib-youtube \
              || python3 -m pip install sphinxcontrib-youtube

      - name: Install syft
        run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/v1.52.0/install.sh | sh -s -- -b /usr/local/bin v1.52.0

      - uses: actions/setup-node@v7
        with:
          node-version: '20.x'

      - uses: actions/checkout@v7

      # The container runs as root while the workspace is owned by the runner
      # user, so git refuses to operate on it ("detected dubious ownership").
      # The build shells out to git for the commit hash during `yarn run
      # bundle`, which fails with exit 128 without this.
      - name: Mark the workspace as a safe git directory
        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"

      # Corepack provisions the pinned Yarn from the packageManager field,
      # matching run-javascript-tests.yml. The distro nodejs packages are
      # avoided entirely: on Ubuntu 26.04 the distro node ships without npm,
      # which is why the buildfarm has to pin NodeSource above it.
      - name: Enable Corepack
        run: corepack enable

      - name: Check the DEB build
        run: make debian

      - name: Archive the packages
        uses: actions/upload-artifact@v7
        with:
          name: pgadmin4-deb-build-output-${{ matrix.name }}
          if-no-files-found: error
          path: dist/*.deb