job "ci" {
  build {
    containerfile ".ci/Containerfile"
    context ".ci"
  }
  trigger {
    push {
      branch "trunk"
      tag "v*"
    }
  }
  mount "cache" "toolchains" "/cache/toolchains"
  mount "cache" "npm" "/cache/npm"
  run "export HOME=/tmp/pi-ext-home MISE_DATA_DIR=/cache/toolchains/mise MISE_CACHE_DIR=/cache/toolchains/downloads GOCACHE=/cache/toolchains/go-build GOPATH=/cache/toolchains/go NPM_CONFIG_CACHE=/cache/npm PI_EXT_CI_CACHE_ROOT=/cache/toolchains && mkdir -p \"$HOME\" /cache/toolchains/bin"
  run "export PATH=\"/cache/toolchains/bin:$HOME/.local/bin:$PATH\""
  run "command -v mise >/dev/null 2>&1 || { curl -fsSL https://mise.run | sh && cp \"$HOME/.local/bin/mise\" /cache/toolchains/bin/mise; }"
  run "mise trust"
  run "mise install"
  // Luci's capability-free container replaces Firefox's incompatible content sandbox.
  run "CI=true MOZ_DISABLE_CONTENT_SANDBOX=1 xvfb-run -a mise run //:ci"
  artifact "release" {
    path "release-manifest.json"
    required true
  }
  publish "pkg" {
    from ".pi/tmp/release-artifacts"
    to "releases/pi-ext/${rev}"
  }
}