node.yml

# SPDX-FileCopyrightText: 2026 Etherpad contributors
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# Modeled on https://github.com/nextcloud/notes/blob/main/.github/workflows/node.yml
# Runs vitest plus a production build to catch regressions in the frontend bundle.

name: Node

on: pull_request

permissions:
  contents: read

concurrency:
  group: node-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read

    outputs:
      src: ${{ steps.changes.outputs.src }}

    steps:
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        continue-on-error: true
        with:
          filters: |
            src:
              - '.github/workflows/node.yml'
              - 'package.json'
              - 'package-lock.json'
              - 'vite.config.*'
              - 'vitest.config.*'
              - 'src/**'
              - 'js/**'
              - 'tests/js/**'

  build-and-test:
    runs-on: ubuntu-latest

    needs: changes
    if: needs.changes.outputs.src != 'false'

    name: npm build + vitest

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Read package.json node and npm engines
        id: versions
        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
        with:
          fallbackNode: '^20'
          fallbackNpm: '^10'

      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ steps.versions.outputs.nodeVersion }}
          cache: npm

      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

      - name: Install dependencies
        run: npm ci

      - name: Run vitest
        run: npm test

      - name: Production build
        run: npm run build

      - name: Fail if built assets are stale
        # The committed js/ bundles must match a fresh build of src/.
        # Use `git status --porcelain` (not `git diff`) so a brand-new,
        # still-untracked chunk/entry point also fails the check.
        # If this fails, run `npm run build` locally and commit js/.
        run: |
          changes="$(git status --porcelain -- js/)"
          if [ -n "$changes" ]; then
            echo "Built js/ assets are out of date with src/. Run 'npm run build' and commit js/:" >&2
            echo "$changes" >&2
            exit 1
          fi