name: ci

on:
  push:
    paths-ignore:
      - "docs/**"
      - "*.md"
    branches:
      - main
      - 3.x
  pull_request:
    paths-ignore:
      - "docs/**"
      - "*.md"
    branches:
      - main
      - 3.x
      - "!v[0-9]*"

# https://github.com/vitejs/vite/blob/main/.github/workflows/ci.yml
env:
  # 7 GiB by default on GitHub, setting to 6 GiB
  # https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources
  NODE_OPTIONS: --max-old-space-size=6144

# Remove default permissions of GITHUB_TOKEN for security
# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
  cancel-in-progress: ${{ github.event_name != 'push' }}

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: corepack enable
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Build (stub)
        run: pnpm dev:prepare

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

      - name: Cache dist
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          retention-days: 3
          name: dist
          path: packages/*/dist

  codeql:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Initialize CodeQL
        uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
        with:
          config: |
            paths:
            - 'packages/*/src/**'
            - 'packages/nuxt/bin/**'
            - 'packages/schema/schema/**'
            paths-ignore:
            - 'test/**'
            - '**/*.spec.ts'
            - '**/*.test.ts'
            - '**/__snapshots__/**'
          languages: javascript-typescript
          queries: +security-and-quality

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
        with:
          category: "/language:javascript-typescript"

  typecheck:
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        module: ["bundler", "node"]

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: corepack enable
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: dist
          path: packages

      - name: Test (types)
        run: pnpm test:types
        env:
          MODULE_RESOLUTION: ${{ matrix.module }}

      - name: Typecheck (docs)
        run: pnpm typecheck:docs

  lint:
    # autofix workflow will be triggered instead for PRs
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: corepack enable
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Build (stub)
        run: pnpm dev:prepare

      - name: Lint
        run: pnpm lint

  test-unit:
    # autofix workflow will be triggered instead for PRs
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs:
      - build
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: corepack enable
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Build (stub)
        run: pnpm dev:prepare

      - name: Test (unit)
        run: pnpm test:unit

      - name: Test (runtime unit)
        run: pnpm test:runtime

  test-fixtures:
    runs-on: ${{ matrix.os }}
    needs:
      - build

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        env: ["dev", "built"]
        builder: ["vite", "rspack", "webpack"]
        context: ["async", "default"]
        manifest: ["manifest-on", "manifest-off"]
        version: ["v4", "v3"]
        payload: ["json", "js"]
        node: [18]
        exclude:
          - builder: "webpack"
            payload: "js"
          - builder: "rspack"
            payload: "js"
          - manifest: "manifest-off"
            payload: "js"
          - context: "default"
            payload: "js"
          - os: windows-latest
            payload: "js"
          - env: "dev"
            builder: "rspack"
          - manifest: "manifest-off"
            builder: "rspack"
          - env: "dev"
            builder: "webpack"
          - manifest: "manifest-off"
            builder: "webpack"

    timeout-minutes: 15

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: corepack enable
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: ${{ matrix.node }}
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Install Playwright
        run: pnpm playwright-core install chromium

      - name: Restore dist cache
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: dist
          path: packages

      - name: Test (fixtures)
        run: pnpm test:fixtures
        env:
          TEST_ENV: ${{ matrix.env }}
          TEST_BUILDER: ${{ matrix.builder }}
          TEST_MANIFEST: ${{ matrix.manifest }}
          TEST_CONTEXT: ${{ matrix.context }}
          TEST_V4: ${{ matrix.version == 'v4' }}
          TEST_PAYLOAD: ${{ matrix.payload }}
          SKIP_BUNDLE_SIZE: ${{ github.event_name != 'push' || matrix.env == 'dev' || matrix.builder == 'webpack' || matrix.context == 'default' || matrix.payload == 'js' || runner.os == 'Windows' }}

      - uses: codecov/codecov-action@985343d70564a82044c1b7fcb84c2fa05405c1a2 # v5.0.4
        if: github.event_name != 'push' && matrix.env == 'built' && matrix.builder == 'vite' && matrix.context == 'default' && matrix.os == 'ubuntu-latest' && matrix.manifest == 'manifest-on'
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  build-release:
    concurrency:
      group: release
    permissions:
      id-token: write
    if: |
      github.event_name == 'push' &&
      github.repository == 'nuxt/nuxt' &&
      !contains(github.event.head_commit.message, '[skip-release]') &&
      !startsWith(github.event.head_commit.message, 'docs')
    needs:
      - lint
      - build
      - test-fixtures
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - run: corepack enable
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: dist
          path: packages

      - name: Release Edge
        run: ./scripts/release-edge.sh ${{ github.ref == 'refs/heads/main' && 'latest' || '3x' }}
        env:
          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}
          NPM_CONFIG_PROVENANCE: true

  release-pr:
    concurrency:
      group: release
    permissions:
      id-token: write
      pull-requests: write
    if: |
      github.event_name == 'pull_request' &&
      contains(github.event.pull_request.labels.*.name, '🧷 edge release')
    needs:
      - lint
      - build
      - test-fixtures
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - run: corepack enable
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: dist
          path: packages

      - name: Release Edge
        run: ./scripts/release-edge.sh pr-${{ github.event.issue.number }}
        env:
          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}
          NPM_CONFIG_PROVENANCE: true