ci.yml

name: "Continuous Integration"

on:
  push:
    branches: [ master ]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  AREA: liechtenstein
  ACTIONLINT_VERSION: 1.7.12

jobs:

  changes:
    name: Check changed files
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      runtime: ${{ steps.filter.outputs.runtime }}

    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0

    - name: Check for runtime changes
      id: filter
      shell: bash
      env:
        BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
      run: |
        set -euo pipefail

        if [[ -z "${BASE_SHA}" || "${BASE_SHA}" =~ ^0+$ ]] ||
           ! git cat-file -e "${BASE_SHA}^{commit}" ||
           ! git cat-file -e "${HEAD_SHA}^{commit}"; then
          echo "runtime=true" >> "$GITHUB_OUTPUT"
          {
            echo "### Changed file check"
            echo ""
            echo "Unable to determine the changed files, so the full CI matrix will run."
          } >> "$GITHUB_STEP_SUMMARY"
          exit 0
        fi

        runtime=false
        changed_count=0
        while IFS= read -r -d '' path; do
          changed_count=$((changed_count + 1))
          case "$path" in
            .github/workflows/ci.yml)
              runtime=true
              ;;
            CMakeLists.txt|Makefile|Dockerfile|action.yml)
              runtime=true
              ;;
            get-coastline.sh|get-landcover.sh|get-monaco.sh)
              runtime=true
              ;;
            cmake/*|include/*|resources/*|server/*|src/*|test/*)
              runtime=true
              ;;
          esac
        done < <(git diff --name-only -z "${BASE_SHA}" "${HEAD_SHA}")

        echo "runtime=${runtime}" >> "$GITHUB_OUTPUT"
        {
          echo "### Changed file check"
          echo ""
          echo "Changed files: ${changed_count}"
          echo "Runtime-impacting changes: ${runtime}"
          if [[ "${runtime}" != "true" ]]; then
            echo ""
            echo "Only non-runtime files changed, so build and tile-generation jobs were skipped."
          fi
        } >> "$GITHUB_STEP_SUMMARY"

  static-validation:
    name: Static validation
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: changes
    if: ${{ needs.changes.outputs.runtime == 'true' }}

    steps:
    - uses: actions/checkout@v6

    - name: Install static validation tools
      run: |
        sudo apt-get update
        sudo apt-get install -y lua5.4 shellcheck
        mkdir -p "${RUNNER_TEMP}/bin"
        GOBIN="${RUNNER_TEMP}/bin" go install "github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION}"

    - name: Validate GitHub workflows
      run: |
        git ls-files -z -- '.github/workflows/*.yml' '.github/workflows/*.yaml' |
          xargs -0 -r "${RUNNER_TEMP}/bin/actionlint"

    - name: Validate shell scripts
      run: |
        git ls-files -z -- '*.sh' |
          xargs -0 -r shellcheck

    - name: Validate JSON files
      run: |
        python3 <<'PY'
        import json
        import pathlib
        import subprocess

        files = subprocess.check_output([
            "git", "ls-files", "-z", "--", "*.json"
        ]).decode().split("\0")

        for filename in sorted(filter(None, files)):
            path = pathlib.Path(filename)
            with path.open(encoding="utf-8") as handle:
                json.load(handle)
            print(path)
        PY

    - name: Validate Lua profiles
      run: |
        git ls-files -z -- 'resources/*.lua' |
          xargs -0 -r luac5.4 -p

    - name: Validate Python CI scripts
      run: |
        git ls-files -z -- '.github/scripts/*.py' |
          xargs -0 -r python3 -m py_compile

  download-pbf:
    name: Download PBF fixture
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs:
      - changes
      - static-validation
    if: ${{ needs.changes.outputs.runtime == 'true' }}
    outputs:
      pbf-available: ${{ steps.fixture.outputs.pbf-available }}

    steps:
    - name: Resolve Geofabrik fixture metadata
      id: metadata
      env:
        PBF_URL: https://download.geofabrik.de/europe/${{ env.AREA }}-latest.osm.pbf
      run: |
        python3 <<'PY'
        import hashlib
        import os
        import sys
        import urllib.request

        url = os.environ["PBF_URL"]
        output_path = os.environ["GITHUB_OUTPUT"]

        try:
            request = urllib.request.Request(url, method="HEAD")
            with urllib.request.urlopen(request, timeout=30) as response:
                headers = response.headers
                effective_url = response.geturl()
                etag = headers.get("ETag", "")
                last_modified = headers.get("Last-Modified", "")
                content_length = headers.get("Content-Length", "")

            if not etag and not last_modified:
                raise RuntimeError("Geofabrik response did not include ETag or Last-Modified")

            metadata = "\n".join([
                f"url={url}",
                f"effective-url={effective_url}",
                f"etag={etag}",
                f"last-modified={last_modified}",
                f"content-length={content_length}",
            ])
            cache_key = hashlib.sha256(metadata.encode("utf-8")).hexdigest()

            with open("geofabrik-fixture-metadata.txt", "w", encoding="utf-8") as metadata_file:
                metadata_file.write(metadata)
                metadata_file.write("\n")

            with open(output_path, "a", encoding="utf-8") as output:
                output.write("metadata-available=true\n")
                output.write(f"cache-key={cache_key}\n")
                output.write(f"effective-url={effective_url}\n")
                output.write(f"etag={etag}\n")
                output.write(f"last-modified={last_modified}\n")
                output.write(f"content-length={content_length}\n")

            print(metadata)
        except Exception as error:
            print(f"::warning::Geofabrik PBF fixture metadata could not be resolved: {error}")
            with open(output_path, "a", encoding="utf-8") as output:
                output.write("metadata-available=false\n")
            sys.exit(0)
        PY

    - name: Restore PBF fixture cache
      id: pbf-cache
      if: ${{ steps.metadata.outputs.metadata-available == 'true' }}
      uses: actions/cache@v5
      with:
        path: ${{ env.AREA }}.osm.pbf
        key: geofabrik-${{ env.AREA }}-${{ steps.metadata.outputs.cache-key }}

    - name: Download and verify PBF file
      id: fixture
      env:
        PBF_URL: https://download.geofabrik.de/europe/${{ env.AREA }}-latest.osm.pbf
        MD5_URL: https://download.geofabrik.de/europe/${{ env.AREA }}-latest.osm.pbf.md5
      run: |
        set -u

        if [ "${{ steps.metadata.outputs.metadata-available }}" != "true" ]; then
          echo "::warning::Geofabrik PBF fixture metadata could not be resolved; fixture-dependent jobs will be skipped."
          echo "pbf-available=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        if [ -s "${AREA}.osm.pbf" ]; then
          echo "Using cached ${AREA}.osm.pbf"
        else
          echo "Downloading ${PBF_URL}"
          if ! curl -fsSL "${PBF_URL}" -o "${AREA}.osm.pbf"; then
            echo "::warning::Geofabrik PBF fixture could not be downloaded; fixture-dependent jobs will be skipped."
            rm -f "${AREA}.osm.pbf"
            echo "pbf-available=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
        fi

        if curl -fsSL "${MD5_URL}" -o "${AREA}-latest.osm.pbf.md5"; then
          expected_md5="$(awk '{ print $1 }' "${AREA}-latest.osm.pbf.md5")"
        else
          echo "::warning::Geofabrik PBF fixture MD5 file could not be downloaded; fixture-dependent jobs will be skipped."
          rm -f "${AREA}.osm.pbf"
          echo "pbf-available=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        if printf '%s  %s\n' "${expected_md5}" "${AREA}.osm.pbf" | md5sum -c -; then
          echo "pbf-available=true" >> "$GITHUB_OUTPUT"
        else
          echo "::warning::Geofabrik PBF fixture did not match the published MD5; fixture-dependent jobs will be skipped."
          rm -f "${AREA}.osm.pbf"
          echo "pbf-available=false" >> "$GITHUB_OUTPUT"
        fi

    - name: Report unavailable PBF fixture
      if: ${{ steps.fixture.outputs.pbf-available != 'true' }}
      run: |
        echo "::warning title=Tile generation not verified::Geofabrik PBF fixture could not be downloaded or verified. Fixture-dependent jobs were skipped."
        {
          echo "### Tile generation not verified"
          echo ""
          echo "The Geofabrik PBF fixture could not be downloaded or did not match the published MD5, so jobs that generate MBTiles/PMTiles were skipped."
          echo "This does not indicate a code failure, but this run did not verify tile generation."
        } >> "$GITHUB_STEP_SUMMARY"

    - name: Upload PBF fixture
      if: ${{ steps.fixture.outputs.pbf-available == 'true' }}
      uses: actions/upload-artifact@v7
      with:
        name: pbf-fixture
        retention-days: 1
        path: ${{ env.AREA }}.osm.pbf

  Windows-Build:
    name: Windows (CMake)
    runs-on: windows-latest
    timeout-minutes: 120
    needs: download-pbf
    if: ${{ needs.download-pbf.outputs.pbf-available == 'true' }}
    env:
      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}\vcpkg-binary-cache,readwrite

    steps:
    - uses: actions/checkout@v6

    - name: Download PBF fixture
      uses: actions/download-artifact@v8
      with:
        name: pbf-fixture

    - name: Detect runner image
      id: runner-image
      shell: pwsh
      run: |
        $imageOS = if ($env:ImageOS) { $env:ImageOS } else { "unknown" }
        $imageVersion = if ($env:ImageVersion) { $env:ImageVersion } else { "unknown" }
        "image-os=$imageOS" >> $env:GITHUB_OUTPUT
        "image-version=$imageVersion" >> $env:GITHUB_OUTPUT

    - name: Enable vcpkg binary cache
      uses: actions/cache@v5
      with:
        path: ${{ github.workspace }}\vcpkg-binary-cache
        key: vcpkg-binary-${{ runner.os }}-${{ steps.runner-image.outputs.image-os }}-${{ steps.runner-image.outputs.image-version }}-x64-windows-static-md-${{ hashFiles('.github/workflows/ci.yml') }}
        restore-keys: vcpkg-binary-${{ runner.os }}-${{ steps.runner-image.outputs.image-os }}-${{ steps.runner-image.outputs.image-version }}-x64-windows-static-md-

    - name: Build dependencies
      run: |
        vcpkg install --triplet=x64-windows-static-md lua shapelib zlib protobuf[zlib] sqlite3 boost-program-options boost-filesystem boost-geometry boost-system boost-asio boost-interprocess boost-iostreams boost-sort rapidjson

    - name: Build tilemaker
      run: |
        mkdir ${{ github.workspace }}\build
        cd ${{ github.workspace }}\build && cmake -DTILEMAKER_BUILD_STATIC=ON -DVCPKG_TARGET_TRIPLET="x64-windows-static-md" -DCMAKE_TOOLCHAIN_FILE="${env:VCPKG_INSTALLATION_ROOT}/scripts/buildsystems/vcpkg.cmake" ..
        cd ${{ github.workspace }}\build && cmake --build . --config RelWithDebInfo

    - name: Build openmaptiles-compatible mbtiles files of Liechtenstein
      run: |
        $tilemaker = "${{ github.workspace }}\build\RelWithDebInfo\tilemaker.exe"
        function Invoke-Tilemaker {
          param([string] $Output, [string[]] $Arguments)
          Write-Host "::group::Build $Output"
          & $tilemaker @Arguments
          $status = $LASTEXITCODE
          Write-Host "::endgroup::"
          if ($status -ne 0) {
            Write-Error "tilemaker failed while writing $Output with exit code $status"
            exit $status
          }
          if (!(Test-Path -LiteralPath $Output) -or (Get-Item -LiteralPath $Output).Length -eq 0) {
            Write-Error "tilemaker did not create $Output"
            exit 1
          }
        }

        Invoke-Tilemaker "${{ env.AREA }}.pmtiles" @("${{ env.AREA }}.osm.pbf", "--config=resources/config-openmaptiles.json", "--process=resources/process-openmaptiles.lua", "--output=${{ env.AREA }}.pmtiles", "--verbose")
        Invoke-Tilemaker "${{ env.AREA }}-repeat.pmtiles" @("${{ env.AREA }}.osm.pbf", "--config=resources/config-openmaptiles.json", "--process=resources/process-openmaptiles.lua", "--output=${{ env.AREA }}-repeat.pmtiles", "--verbose")
        Invoke-Tilemaker "${{ env.AREA }}.mbtiles" @("${{ env.AREA }}.osm.pbf", "--config=resources/config-openmaptiles.json", "--process=resources/process-openmaptiles.lua", "--output=${{ env.AREA }}.mbtiles", "--store", "${{ runner.temp }}\osm_store", "--verbose")
        Invoke-Tilemaker "${{ env.AREA }}-repeat.mbtiles" @("${{ env.AREA }}.osm.pbf", "--config=resources/config-openmaptiles.json", "--process=resources/process-openmaptiles.lua", "--output=${{ env.AREA }}-repeat.mbtiles", "--store", "${{ runner.temp }}\osm_store_repeat", "--verbose")

    - name: Upload generated tiles
      uses: actions/upload-artifact@v7
      with:
        name: tile-outputs-windows-cmake
        retention-days: 14
        path: |
          ${{ env.AREA }}.mbtiles
          ${{ env.AREA }}.pmtiles
          ${{ env.AREA }}-repeat.mbtiles
          ${{ env.AREA }}-repeat.pmtiles

    - name: 'Upload compiled executable'
      uses: actions/upload-artifact@v7
      with:
        name: tilemaker-windows
        retention-days: 14
        path: |
          ${{ github.workspace }}\resources
          ${{ github.workspace }}\build\RelWithDebInfo\tilemaker.exe
          ${{ github.workspace }}\build\RelWithDebInfo\*.pdb

  unix-build:  
    strategy:  
      fail-fast: false
      matrix: 
        include:
          - os: ubuntu-22.04
            triplet: x64-linux
            executable: tilemaker
    name: ${{ matrix.os }} (CMake)
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    needs: download-pbf
    if: ${{ needs.download-pbf.outputs.pbf-available == 'true' }}
    env:
      VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-binary-cache,readwrite

    steps:
    - uses: actions/checkout@v6

    - name: Download PBF fixture
      uses: actions/download-artifact@v8
      with:
        name: pbf-fixture

    - name: Detect runner image
      id: runner-image
      run: |
        echo "image-os=${ImageOS:-unknown}" >> "$GITHUB_OUTPUT"
        echo "image-version=${ImageVersion:-unknown}" >> "$GITHUB_OUTPUT"

    - name: Enable vcpkg binary cache
      uses: actions/cache@v5
      with:
        path: ${{ github.workspace }}/vcpkg-binary-cache
        key: vcpkg-binary-${{ runner.os }}-${{ steps.runner-image.outputs.image-os }}-${{ steps.runner-image.outputs.image-version }}-${{ matrix.triplet }}-${{ hashFiles('.github/workflows/ci.yml') }}
        restore-keys: vcpkg-binary-${{ runner.os }}-${{ steps.runner-image.outputs.image-os }}-${{ steps.runner-image.outputs.image-version }}-${{ matrix.triplet }}-

    - name: Build dependencies
      run: |
        vcpkg install --triplet="${{ matrix.triplet }}" lua shapelib zlib protobuf[zlib] sqlite3 boost-program-options boost-filesystem boost-geometry boost-system boost-asio boost-interprocess boost-iostreams boost-sort rapidjson

    - name: Build tilemaker
      run: |
        mkdir build
        cd build
        cmake -DTILEMAKER_BUILD_STATIC=ON -DCMAKE_BUILD_TYPE=Release -DVCPKG_TARGET_TRIPLET="${{ matrix.triplet }}" -DCMAKE_TOOLCHAIN_FILE="$VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake" -DCMAKE_CXX_COMPILER=g++ ..
        cmake --build . 
        strip tilemaker

    - name: Build openmaptiles-compatible mbtiles files of Liechtenstein
      run: |
        run_tilemaker() {
          output="$1"
          shift
          echo "::group::Build ${output}"
          if "$@"; then
            echo "::endgroup::"
          else
            status="$?"
            echo "::endgroup::"
            echo "::error title=Tile generation failed::tilemaker failed while writing ${output} with exit code ${status}"
            exit "${status}"
          fi
          if [ ! -s "${output}" ]; then
            echo "::error title=Tile output missing::tilemaker did not create ${output}"
            exit 1
          fi
        }

        tilemaker="${{ github.workspace }}/build/${{ matrix.executable }}"
        run_tilemaker "${{ env.AREA }}.pmtiles" "${tilemaker}" "${{ env.AREA }}.osm.pbf" --config=resources/config-openmaptiles.json --process=resources/process-openmaptiles.lua --output="${{ env.AREA }}.pmtiles" --verbose
        run_tilemaker "${{ env.AREA }}-repeat.pmtiles" "${tilemaker}" "${{ env.AREA }}.osm.pbf" --config=resources/config-openmaptiles.json --process=resources/process-openmaptiles.lua --output="${{ env.AREA }}-repeat.pmtiles" --verbose
        run_tilemaker "${{ env.AREA }}.mbtiles" "${tilemaker}" "${{ env.AREA }}.osm.pbf" --config=resources/config-openmaptiles.json --process=resources/process-openmaptiles.lua --output="${{ env.AREA }}.mbtiles" --verbose --store "${{ runner.temp }}/store"
        run_tilemaker "${{ env.AREA }}-repeat.mbtiles" "${tilemaker}" "${{ env.AREA }}.osm.pbf" --config=resources/config-openmaptiles.json --process=resources/process-openmaptiles.lua --output="${{ env.AREA }}-repeat.mbtiles" --verbose --store "${{ runner.temp }}/store-repeat"

    - name: Upload generated tiles
      uses: actions/upload-artifact@v7
      with:
        name: tile-outputs-${{ matrix.os }}-cmake
        retention-days: 14
        path: |
          ${{ env.AREA }}.mbtiles
          ${{ env.AREA }}.pmtiles
          ${{ env.AREA }}-repeat.mbtiles
          ${{ env.AREA }}-repeat.pmtiles

    - name: 'Upload compiled executable'
      uses: actions/upload-artifact@v7
      with:
        name: tilemaker-${{ matrix.os }}
        retention-days: 14
        path: |
          ${{ github.workspace }}/resources
          ${{ github.workspace }}/build/${{ matrix.executable }}

  unix-makefile-build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
          - os: macos-latest
          - os: macos-14

    name: ${{ matrix.os }} (Makefile)
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    needs: download-pbf
    if: ${{ needs.download-pbf.outputs.pbf-available == 'true' }}

    steps:
    - uses: actions/checkout@v6

    - name: Download PBF fixture
      uses: actions/download-artifact@v8
      with:
        name: pbf-fixture

    - name: Install Linux dependencies
      if: ${{ matrix.os == 'ubuntu-22.04' }}
      run: |
        sudo apt install build-essential libboost-dev libboost-filesystem-dev libboost-iostreams-dev libboost-program-options-dev libboost-system-dev luajit libluajit-5.1-dev liblua5.1-0-dev libshp-dev libsqlite3-dev rapidjson-dev zlib1g-dev

    - name: Install Mac OS X dependencies
      if: ${{ matrix.os == 'macos-latest' || matrix.os == 'macos-14' }}
      run: |
        c++ --version
        brew install boost lua shapelib rapidjson

    - name: Build tilemaker
      run: |
        make -j4
        make test

    - name: Build openmaptiles-compatible mbtiles files of Liechtenstein
      run: |
        run_tilemaker() {
          output="$1"
          shift
          echo "::group::Build ${output}"
          if "$@"; then
            echo "::endgroup::"
          else
            status="$?"
            echo "::endgroup::"
            echo "::error title=Tile generation failed::tilemaker failed while writing ${output} with exit code ${status}"
            exit "${status}"
          fi
          if [ ! -s "${output}" ]; then
            echo "::error title=Tile output missing::tilemaker did not create ${output}"
            exit 1
          fi
        }

        run_tilemaker "${{ env.AREA }}.pmtiles" ./tilemaker "${{ env.AREA }}.osm.pbf" --config=resources/config-openmaptiles.json --process=resources/process-openmaptiles.lua --output="${{ env.AREA }}.pmtiles" --verbose
        run_tilemaker "${{ env.AREA }}-repeat.pmtiles" ./tilemaker "${{ env.AREA }}.osm.pbf" --config=resources/config-openmaptiles.json --process=resources/process-openmaptiles.lua --output="${{ env.AREA }}-repeat.pmtiles" --verbose
        run_tilemaker "${{ env.AREA }}.mbtiles" ./tilemaker "${{ env.AREA }}.osm.pbf" --config=resources/config-openmaptiles.json --process=resources/process-openmaptiles.lua --output="${{ env.AREA }}.mbtiles" --verbose --store "${{ runner.temp }}/store"
        run_tilemaker "${{ env.AREA }}-repeat.mbtiles" ./tilemaker "${{ env.AREA }}.osm.pbf" --config=resources/config-openmaptiles.json --process=resources/process-openmaptiles.lua --output="${{ env.AREA }}-repeat.mbtiles" --verbose --store "${{ runner.temp }}/store-repeat"

    - name: Upload generated tiles
      uses: actions/upload-artifact@v7
      with:
        name: tile-outputs-${{ matrix.os }}-makefile
        retention-days: 14
        path: |
          ${{ env.AREA }}.mbtiles
          ${{ env.AREA }}.pmtiles
          ${{ env.AREA }}-repeat.mbtiles
          ${{ env.AREA }}-repeat.pmtiles


  Github-Action:
    name: Generate mbtiles with Github Action
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs:
      - download-pbf
      - docker-publish
    if: ${{ github.ref == 'refs/heads/master' && needs.download-pbf.outputs.pbf-available == 'true' }}

    steps:
    - name: Check out repository
      uses: actions/checkout@v6

    - name: Download PBF file
      uses: actions/download-artifact@v8
      with:
        name: pbf-fixture

    - name: Build openmaptiles-compatible pmtiles file
      uses: ./
      with:
        input: ${{ env.AREA }}.osm.pbf
        output: ${{ env.AREA }}.pmtiles

    - name: Build repeat openmaptiles-compatible pmtiles file
      uses: ./
      with:
        input: ${{ env.AREA }}.osm.pbf
        output: ${{ env.AREA }}-repeat.pmtiles

    - name: Build openmaptiles-compatible mbtiles file
      uses: ./
      with:
        input: ${{ env.AREA }}.osm.pbf
        output: ${{ env.AREA }}.mbtiles

    - name: Build repeat openmaptiles-compatible mbtiles file
      uses: ./
      with:
        input: ${{ env.AREA }}.osm.pbf
        output: ${{ env.AREA }}-repeat.mbtiles

    - name: Check generated tile files
      run: |
        for output in \
          "${AREA}.mbtiles" \
          "${AREA}.pmtiles" \
          "${AREA}-repeat.mbtiles" \
          "${AREA}-repeat.pmtiles"; do
          if [ ! -s "${output}" ]; then
            echo "::error title=Tile output missing::tilemaker did not create ${output}"
            exit 1
          fi
        done

    - name: Upload generated tiles
      uses: actions/upload-artifact@v7
      with:
        name: tile-outputs-github-action
        retention-days: 14
        path: |
          ${{ env.AREA }}.mbtiles
          ${{ env.AREA }}.pmtiles
          ${{ env.AREA }}-repeat.mbtiles
          ${{ env.AREA }}-repeat.pmtiles

  verify-generated-tiles:
    name: Verify generated tiles
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs:
      - Windows-Build
      - unix-build
      - unix-makefile-build
    env:
      PMTILES_VERSION: 1.30.2

    steps:
    - uses: actions/checkout@v6
      with:
        sparse-checkout: .github/scripts/verify-generated-tiles.py
        sparse-checkout-cone-mode: false

    - name: Download generated tiles
      uses: actions/download-artifact@v8
      with:
        pattern: tile-outputs-*
        path: generated-tiles

    - name: Install pmtiles
      run: |
        curl -fsSL -o pmtiles.tar.gz "https://github.com/protomaps/go-pmtiles/releases/download/v${PMTILES_VERSION}/go-pmtiles_${PMTILES_VERSION}_Linux_x86_64.tar.gz"
        tar -xzf pmtiles.tar.gz
        chmod +x pmtiles
        sudo mv pmtiles /usr/local/bin/pmtiles
        pmtiles version

    - name: Verify generated tile archives
      run: |
        python3 .github/scripts/verify-generated-tiles.py generated-tiles

  docker-build:
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository }}

    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs:
      - changes
      - static-validation
    if: ${{ needs.changes.outputs.runtime == 'true' && github.ref != 'refs/heads/master' }}
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  docker-publish:
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository }}

    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs:
      - changes
      - static-validation
    if: ${{ needs.changes.outputs.runtime == 'true' && github.ref == 'refs/heads/master' }}
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max