👷 ci: add matrix testing, typecheck/lint/format gates, and docker test

.github/workflows/ci.yml

@@ -3,19 +3,31 @@ name: CI
 on:
     push:
         branches: ["main"]
+        tags: ["v*.*.*"]
     pull_request:
         branches: ["main"]
 
 jobs:
     test:
         runs-on: ubuntu-latest
+        strategy:
+            fail-fast: false
+            matrix:
+                bun-version: ["latest", "1.2"]
         steps:
             - uses: actions/checkout@v4
             - uses: oven-sh/setup-bun@v2
               with:
-                  bun-version: latest
+                  bun-version: ${{ matrix.bun-version }}
-            - run: bun install
+            - run: bun install --frozen-lockfile
-            - run: bun test
+            - name: Typecheck
+              run: bun run typecheck
+            - name: Lint
+              run: bun run lint
+            - name: Format check
+              run: bunx biome format .
+            - name: Unit tests
+              run: bun test
 
     docker:
         runs-on: ubuntu-latest
@@ -27,16 +39,52 @@ jobs:
             - uses: actions/checkout@v4
             - name: Set lowercase owner
               id: owner
-              run: echo "owner=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+              run: echo "owner=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
+
+            - name: Compute image tags
+              id: meta
+              run: |
+                  TAGS="ghcr.io/${{ steps.owner.outputs.owner }}/test-ip:latest"
+                  if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+                    VERSION="${{ github.ref_name }}"
+                    TAGS="ghcr.io/${{ steps.owner.outputs.owner }}/test-ip:${VERSION},ghcr.io/${{ steps.owner.outputs.owner }}/test-ip:latest"
+                  fi
+                  echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
+
+            - name: Build image (local, for smoke test)
+              uses: docker/build-push-action@v6
+              with:
+                  context: .
+                  load: true
+                  tags: test-ip:ci
+
+            - name: Smoke test image
+              run: |
+                  docker run -d --name test-ip -p 3000:3000 test-ip:ci
+                  for i in $(seq 1 20); do
+                    if curl -fsS -H "Accept: application/json" http://localhost:3000/ > response.json; then
+                      break
+                    fi
+                    sleep 1
+                  done
+                  cat response.json
+                  grep -q '"ip"' response.json
+                  grep -q '"headers"' response.json
+                  docker logs test-ip
+                  docker stop test-ip
+
             - name: Log in to Container Registry
+              if: github.event_name == 'push'
               uses: docker/login-action@v3
               with:
                   registry: ghcr.io
                   username: ${{ steps.owner.outputs.owner }}
                   password: ${{ secrets.GITHUB_TOKEN }}
-            - name: Build and push
+
+            - name: Push image
+              if: github.event_name == 'push'
               uses: docker/build-push-action@v6
               with:
                   context: .
                   push: true
-                  tags: ghcr.io/${{ steps.owner.outputs.owner }}/test-ip:latest
+                  tags: ${{ steps.meta.outputs.tags }}