ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          lfs: true
          # The CLI build runs semantic-release dry-run to bake the next binary version.
          # On main, checkout credentials must match the release token used by that dry-run.
          token: ${{ github.ref == 'refs/heads/main' && secrets.RELEASE_TOKEN || github.token }}
      - uses: ./.github/actions/setup-ci
      # - uses: google/wireit@setup-github-actions-caching/v2
      - name: Run CI checks
        env:
          ELEMENTS_PAGES_BASE_URL: ${{vars.ELEMENTS_PAGES_BASE_URL}}
          ELEMENTS_REGISTRY_URL: ${{vars.ELEMENTS_REGISTRY_URL}}
          ELEMENTS_REPO_BASE_URL: ${{vars.ELEMENTS_REPO_BASE_URL}}
          GITHUB_TOKEN: ${{ github.ref == 'refs/heads/main' && secrets.RELEASE_TOKEN || github.token }}
        run: PAGES_BASE_URL="/elements/" pnpm run ci && PAGES_BASE_URL="/elements/" node ./projects/internals/ci/cache-validate.js ci
      - name: Write CI job summary
        if: always()
        run: node ./projects/internals/ci/ci-summary.js >> "$GITHUB_STEP_SUMMARY"
      - name: Upload build artifacts
        if: github.event_name == 'push'
        uses: actions/upload-artifact@v7
        with:
          name: build-artifacts
          retention-days: 1
          path: |
            projects/core/dist
            projects/core/package.json
            projects/forms/dist
            projects/forms/package.json
            projects/styles/dist
            projects/styles/package.json
            projects/themes/dist
            projects/themes/package.json
            projects/lint/dist
            projects/lint/package.json
            projects/cli/dist
            projects/cli/package.json
            projects/code/dist
            projects/code/package.json
            projects/create/dist
            projects/create/package.json
            projects/markdown/dist
            projects/markdown/package.json
            projects/media/dist
            projects/media/package.json
            projects/monaco/dist
            projects/monaco/package.json
            projects/pages/dist
      - name: Upload pages artifact
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        uses: actions/upload-pages-artifact@v5
        with:
          path: projects/pages/dist

  lighthouse:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          lfs: true
      - uses: ./.github/actions/setup-ci
      # - uses: google/wireit@setup-github-actions-caching/v2
      - name: Run Lighthouse tests
        run: WIREIT_FAILURES=kill pnpm run lighthouse && node ./projects/internals/ci/cache-validate.js lighthouse && node ./projects/internals/ci/metrics.lighthouse.js
      - name: Write lighthouse job summary
        if: always()
        run: node ./projects/internals/ci/lighthouse-summary.js >> "$GITHUB_STEP_SUMMARY"

  release:
    needs: ci
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      issues: write
      deployments: write
      pull-requests: write
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          lfs: true
          ref: main
          # Use RELEASE_TOKEN so the persisted git credentials match the token
          # semantic-release pushes with — otherwise the default GITHUB_TOKEN's
          # http.extraheader overrides @semantic-release/git's push auth.
          token: ${{secrets.RELEASE_TOKEN}}
      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d
        with:
          version: 11.0.8
          run_install: false
      - uses: actions/setup-node@v6
        with:
          node-version-file: './.nvmrc'
          registry-url: 'https://registry.npmjs.org'
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile
      - name: Download build artifacts
        uses: actions/download-artifact@v8
        with:
          name: build-artifacts
          path: projects
      - name: Release
        env:
          # RELEASE_TOKEN must be a PAT or GitHub App token with contents:write and
          # bypass permission for main's branch protection rules. The default
          # GITHUB_TOKEN cannot push tags/release commits to a protected branch.
          GITHUB_TOKEN: ${{secrets.RELEASE_TOKEN}}
          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
        run: WIREIT_PARALLEL=1 WIREIT_LOGGER=metrics pnpm run release

  deploy-pages:
    needs: ci
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{steps.deployment.outputs.page_url}}
    concurrency:
      group: pages
      cancel-in-progress: false
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v5