Merge workflows into one CI pipeline

- Unit tests, integration tests and the Docker build check run in
  parallel on branches and pull requests
- Integration tests run on every push instead of only manually
- Branch builds only build amd64 and check the arm64 cross-compile in the
  test job; both platforms are built and pushed only for version tags,
  after all tests pass
- Docker layers cached through the runner cache, Go module and build
  caches mounted in the Dockerfile
- A newer push to the same branch cancels the running pipeline

.gitea/workflows/ci.yaml

@@ -0,0 +1,107 @@
+name: CI
+
+# Branches and pull requests: unit tests, integration tests and a check that the image builds (amd64 only).
+# Version tags (v1.2.3): the same tests, then build amd64 + arm64 and push the image.
+on:
+  push:
+    branches:
+      - main
+      - develop
+    tags:
+      - "v*.*.*"
+  pull_request:
+  workflow_dispatch:
+
+# A newer push to the same branch cancels the run that is still going.
+concurrency:
+  group: ci-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Generate templ components
+        run: go tool templ generate
+      - name: Vet
+        run: go vet ./... && go vet -tags integration ./...
+      - name: Unit tests
+        run: go test -race ./...
+      - name: Cross-compile for arm64
+        run: GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -o /dev/null ./cmd
+
+  integration:
+    runs-on: ubuntu-latest
+    env:
+      # The test helper stops its own container, so the reaper container is not needed.
+      TESTCONTAINERS_RYUK_DISABLED: "true"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Generate templ components
+        run: go tool templ generate
+      - name: Integration tests (PostgreSQL via testcontainers)
+        run: go test -tags integration -race -timeout 15m ./internal/db/... ./internal/backend/...
+
+  # Checks that the image builds. Runs in parallel with the tests; nothing is pushed.
+  docker:
+    if: ${{ !startsWith(gitea.ref, 'refs/tags/') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."gitea.sanplex.xyz/sansan"]
+              http = true
+              insecure = true
+      - name: Login to Gitea
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.sanplex.xyz
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.TOKEN }}
+      - name: Build (amd64)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max,ignore-error=true
+
+  # Only for version tags, and only when all tests have passed.
+  publish:
+    if: ${{ startsWith(gitea.ref, 'refs/tags/v') }}
+    needs: [test, integration]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."gitea.sanplex.xyz/sansan"]
+              http = true
+              insecure = true
+      - name: Login to Gitea
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.sanplex.xyz
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.TOKEN }}
+      - name: Build and push (amd64 + arm64)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          cache-from: type=gha
+          tags: |
+            gitea.sanplex.xyz/sansan/musicserver:${{ gitea.ref_name }}
+            gitea.sanplex.xyz/sansan/musicserver:latest