javascript.yml

name: JavaScript

on:
  push:
    branches: [ main ]
  pull_request:
  release:
    types: [published]
  workflow_dispatch:

env:
  FORCE_COLOR: 3

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install mise and tools
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
        with:
          install: true
          install_args: rust node "github:wasm-bindgen/wasm-pack"
          cache: true

      - name: Install dependencies
        working-directory: js
        run: npm ci

      - name: Build WASM package
        working-directory: js
        run: npm run wasm

      - name: Rust -> WASM binding tests
        working-directory: js
        run: wasm-pack test --headless --chrome

      - name: Install Playwright browsers
        working-directory: js
        run: npx playwright install --with-deps chromium

      - name: Vitest API tests
        working-directory: js
        run: npm test

      - name: Playwright demo E2E
        working-directory: js
        run: npm run test:e2e

      - name: Packaged tarball smoke test
        working-directory: js
        run: npm run test:pack

  build:
    name: Build demo
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install mise and tools
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
        with:
          install: true
          install_args: rust "github:wasm-bindgen/wasm-pack"
          cache: true

      - name: Build WASM
        run: |
          # Build WASM package
          cd js
          wasm-pack build --target web

          # Create build directory if not exists (first time)
          mkdir -p build

          # Copy demo files to build directory
          cp index.html index.js build/
          cp -r pkg build/pkg

      - name: Upload build artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wasm-build
          path: js/build

  deploy:
    name: Deploy demo to GitHub Pages
    if: github.ref == 'refs/heads/main'
    needs: [test, build]
    runs-on: ubuntu-latest
    permissions:
      pages: write  # publish the built demo to GitHub Pages
      id-token: write  # OIDC token for the Pages deployment
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - name: Download build artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: wasm-build
          path: dist

      - name: Setup Pages
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

      - name: Upload artifact
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: 'dist'

      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

  # Build the npm package in an unprivileged job and hand it to the publish job
  # as an artifact, so the Rust toolchain / wasm-pack install never run in a job
  # that holds the npm token (mirrors the PyPI pipeline in python.yml).
  build_npm:
    name: Build npm package
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install mise and tools
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
        with:
          install: true
          install_args: rust "github:wasm-bindgen/wasm-pack"
          cache: true

      - name: Build WASM package
        working-directory: js
        run: wasm-pack build --target web

      - name: Upload npm package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-package
          path: js/pkg

  # Compares the .wasm binary size on this PR branch vs the base branch and
  # posts a sticky comment. Reuses the artifact from build_npm (the exact binary
  # that would be published) for the HEAD measurement; builds the base branch
  # from source for the baseline. Fails if the size grows by more than 5%.
  wasm_size:
    name: WASM size check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    needs: build_npm
    permissions:
      contents: read
      pull-requests: write  # post and update the sticky size-report comment
    steps:
      - name: Download built npm package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: head-pkg

      - name: Record head size
        id: head
        run: echo "bytes=$(stat -c%s head-pkg/standard_knowledge_js_bg.wasm)" >> "$GITHUB_OUTPUT"

      - name: Install mise and tools
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
        with:
          install: true
          install_args: rust "github:wasm-bindgen/wasm-pack"
          cache: true

      # The base branch is checked out into its own nested git repo below;
      # mise's config lookup stops at that .git boundary, so the outer
      # mise.toml (and its wasm-pack pin) is invisible from base/js. Write
      # the versions we already installed to mise's global config instead,
      # which applies regardless of cwd/git boundaries.
      - name: Activate mise tools globally
        run: mise use -g rust "github:wasm-bindgen/wasm-pack"

      - name: Checkout base branch
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.base_ref }}
          path: base
          persist-credentials: false

      - name: Build base WASM
        working-directory: base/js
        run: wasm-pack build --target web

      - name: Record base size
        id: base
        run: echo "bytes=$(stat -c%s base/js/pkg/standard_knowledge_js_bg.wasm)" >> "$GITHUB_OUTPUT"

      - name: Post size comment and enforce threshold
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          BASE_REF: ${{ github.base_ref }}
          BASE_BYTES: ${{ steps.base.outputs.bytes }}
          HEAD_BYTES: ${{ steps.head.outputs.bytes }}
        run: |
          DELTA=$(( HEAD_BYTES - BASE_BYTES ))
          BASE_KB=$(awk "BEGIN { printf \"%.1f\", $BASE_BYTES / 1024 }")
          HEAD_KB=$(awk "BEGIN { printf \"%.1f\", $HEAD_BYTES / 1024 }")
          DELTA_KB=$(awk "BEGIN { printf \"%+.1f\", $DELTA / 1024 }")
          PCT=$(awk "BEGIN { printf \"%+.1f\", ($DELTA / $BASE_BYTES) * 100 }")
          THRESHOLD_PCT=5
          EXCEEDS=$(awk "BEGIN { print ($DELTA > 0 && ($DELTA / $BASE_BYTES) * 100 > $THRESHOLD_PCT) ? 1 : 0 }")

          if [ "$EXCEEDS" = "1" ]; then
            VERDICT="❌ Size increased ${PCT}% — exceeds the ${THRESHOLD_PCT}% threshold."
          elif [ "$DELTA" -lt 0 ]; then
            VERDICT="✅ Size decreased ${PCT}%."
          elif [ "$DELTA" = "0" ]; then
            VERDICT="✅ No size change."
          else
            VERDICT="⚠️ Size increased ${PCT}% (within ${THRESHOLD_PCT}% threshold)."
          fi

          {
            echo "<!-- wasm-size-report -->"
            echo "## Javascript size report"
            echo ""
            echo "| | Size |"
            echo "|---|---|"
            echo "| Base (\`${BASE_REF}\`) | ${BASE_KB} KB |"
            echo "| PR | ${HEAD_KB} KB |"
            echo "| Delta | ${DELTA_KB} KB (${PCT}%) |"
            echo ""
            echo "${VERDICT}"
          } > /tmp/comment.md

          COMMENT_ID=$(gh api \
            "repos/$GITHUB_REPOSITORY/issues/${PR_NUMBER}/comments" \
            --jq '[.[] | select(.body | contains("<!-- wasm-size-report -->"))] | first | .id // empty')

          if [ -n "$COMMENT_ID" ]; then
            jq -n --rawfile body /tmp/comment.md '{body: $body}' | \
              gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/${COMMENT_ID}" --input -
          else
            jq -n --rawfile body /tmp/comment.md '{body: $body}' | \
              gh api "repos/$GITHUB_REPOSITORY/issues/${PR_NUMBER}/comments" --input -
          fi

          if [ "$EXCEEDS" = "1" ]; then
            echo "::error::WASM size increased ${PCT}% — exceeds the ${THRESHOLD_PCT}% threshold."
            exit 1
          fi

  upload_npm:
    name: Publish to npm
    needs: [test, build_npm]
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'
    permissions:
      contents: read
      id-token: write  # npm provenance
    steps:
      - name: Checkout mise.toml
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          sparse-checkout: mise.toml
          sparse-checkout-cone-mode: false
          persist-credentials: false

      - name: Read Node version from mise.toml
        id: mise
        run: echo "node-version=$(awk -F'"' '/^node[[:space:]]*=/ {print $2}' mise.toml)" >> "$GITHUB_OUTPUT"

      - name: Download npm package artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: pkg

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ steps.mise.outputs.node-version }}
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false  # never use caching in release builds

      - name: Publish to npm
        run: npm publish ./pkg --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}