ci.yml

name: CI

on:
  push:
    branches:
      - main
      - staging
  pull_request:
    branches:
      - main
      - staging
  workflow_dispatch:

jobs:
  update-deps:
    uses: SolidOS/solidos/.github/workflows/update-solidos-deps.yml@main
    secrets: inherit

  build:
    needs: update-deps
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [22, 24]
    steps:
      # The update-deps job commits the updated package.json/package-lock.json to the head
      # branch, but `needs` only orders the jobs: without an explicit ref the default
      # checkout uses the SHA of the triggering event, so the build (and the artifact that
      # later gets published) would still carry the pre-update dependencies.
      # Build the branch that received the commit (PR head branch, or the pushed branch);
      # fork PRs keep the default commit, as the updater deliberately does not commit there.
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'pull_request' && (github.event.pull_request.head.repo.fork && github.sha || github.head_ref) || github.ref_name }}
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm ci
      - run: npm test
      - run: npm run build
      - run: npm run doc
      - name: Save build
        if: matrix.node-version == 22
        uses: actions/upload-artifact@v7
        with:
          name: build
          path: |
            .
            !node_modules
          retention-days: 1

  gh-pages:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/staging'
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: build
      - uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: .

  dependabot:
    name: 'Dependabot'
    needs: build # After the E2E and build jobs, if one of them fails, it won't merge the PR.
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'}} # Detect that the PR author is dependabot
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Enable auto-merge for Dependabot PRs
        run: gh pr merge --auto --merge "$PR_URL" # Use Github CLI to merge automatically the PR
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

  npm-publish-dev:
    needs: build
    uses: SolidOS/solidos/.github/workflows/publish-prerelease.yml@main
    with:
      node_version: 22

  npm-publish-latest:
    needs: [build]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    permissions:
      id-token: write  # Required for OIDC
      contents: read
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: build
      - uses: actions/setup-node@v6
        with:
          node-version: 22 # required for OIDC npm@latest
          registry-url: 'https://registry.npmjs.org'
      - name: Update npm to latest (required for OIDC)
        run: npm install -g npm@latest
      - name: Disable publish and install actions
        run: 'sed -i -E "s/\"((pre|post)(publish|install))/\"ignore:\1/" package.json'
      - name: Publish to npm
        if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'
        run: npm publish --tag latest

  github-release:
    needs: [npm-publish-latest]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Create GitHub release with generated notes
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="v$(node -p 'require("./package.json").version')"

          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "Release $TAG already exists. Skipping."
            exit 0
          fi

          if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
            echo "Tag $TAG already exists on origin. Creating release from existing tag."
            gh release create "$TAG" --verify-tag --generate-notes
          else
            echo "Creating tag and release $TAG from commit $GITHUB_SHA."
            gh release create "$TAG" --target "$GITHUB_SHA" --generate-notes
          fi