name: CI

on:
  push:
    paths-ignore:
      - "docs/**"
      - "*.md"
    branches:
      - main
  pull_request:
    paths-ignore:
      - "docs/**"
      - "*.md"
    branches:
      - main
      - "!v[0-9]*"

# https://github.com/vitejs/vite/blob/main/.github/workflows/ci.yml
env:
  # 7 GiB by default on GitHub, setting to 6 GiB
  # https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources
  NODE_OPTIONS: --max-old-space-size=6144
  # install playwright binary manually (because pnpm only runs install script once)
  PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"


# Remove default permissions of GITHUB_TOKEN for security
# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
  cancel-in-progress: ${{ github.event_name != 'push' }}

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - run: corepack enable
      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Build (stub)
        run: pnpm build:stub

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

      - name: Cache dist
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          retention-days: 3
          name: dist
          path: packages/*/dist

  codeql:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      security-events: write
    needs:
     - build

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - run: corepack enable
      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Initialize CodeQL
        uses: github/codeql-action/init@004c5de30b6423267685b897a3d595e944f7fed5 # v2.20.2
        with:
          languages: javascript
          queries: +security-and-quality

      - name: Restore dist cache
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: dist
          path: packages

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@004c5de30b6423267685b897a3d595e944f7fed5 # v2.20.2
        with:
          category: "/language:javascript"

  typecheck:
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        module: ['bundler', 'node']
        base: ['with-base-url', 'without-base-url']

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - run: corepack enable
      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: dist
          path: packages

      - name: Test (types)
        run: pnpm test:types
        env:
          MODULE_RESOLUTION: ${{ matrix.module }}
          TS_BASE_URL: ${{ matrix.base }}

  lint:
    # autofix workflow will be triggered instead for PRs
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - run: corepack enable
      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Build (stub)
        run: pnpm build:stub

      - name: Lint
        run: pnpm lint

  test-fixtures:
    runs-on: ${{ matrix.os }}
    needs:
      - build

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        env: ['dev', 'built']
        builder: ['vite', 'webpack']
        payload: ['json', 'js']
        node: [16]
        exclude:
          - env: 'dev'
            builder: 'webpack'

    timeout-minutes: 10

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - run: corepack enable
      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: ${{ matrix.node }}
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      # Install playwright's binary under custom directory to cache
      - name: (non-windows) Set Playwright path and Get playwright version
        if: runner.os != 'Windows'
        run: |
          echo "PLAYWRIGHT_BROWSERS_PATH=$HOME/.cache/playwright-bin" >> $GITHUB_ENV
          PLAYWRIGHT_VERSION="$(pnpm ls --depth 0 --json -w playwright | jq --raw-output '.[0].unsavedDependencies["playwright"].version')"
          echo "PLAYWRIGHT_VERSION=$PLAYWRIGHT_VERSION" >> $GITHUB_ENV

      - name: (windows) Set Playwright path and Get playwright version
        if: runner.os == 'Windows'
        run: |
          echo "PLAYWRIGHT_BROWSERS_PATH=$HOME\.cache\playwright-bin" >> $env:GITHUB_ENV
          $env:PLAYWRIGHT_VERSION="$(pnpm ls --depth 0 --json -w playwright | jq --raw-output '.[0].unsavedDependencies[\"playwright\"].version')"
          echo "PLAYWRIGHT_VERSION=$env:PLAYWRIGHT_VERSION" >> $env:GITHUB_ENV

      - name: Cache Playwright's binary
        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
        with:
          key: ${{ runner.os }}-playwright-bin-v1-${{ env.PLAYWRIGHT_VERSION }}
          path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}
          restore-keys: |
            ${{ runner.os }}-playwright-bin-v1-

      - name: Install Playwright
        # does not need to explicitly set chromium after https://github.com/microsoft/playwright/issues/14862 is solved
        run: pnpm playwright install chromium

      - name: Restore dist cache
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: dist
          path: packages

      - name: Test (unit)
        run: pnpm test:unit

      - name: Test (runtime unit)
        run: pnpm test:runtime

      - name: Test (fixtures)
        run: pnpm test:fixtures
        env:
          TEST_ENV: ${{ matrix.env }}
          TEST_BUILDER: ${{ matrix.builder }}
          TEST_PAYLOAD: ${{ matrix.payload }}
          SKIP_BUNDLE_SIZE: ${{ github.event_name != 'push' || matrix.env == 'dev' || matrix.builder == 'webpack' || matrix.payload == 'js' || runner.os == 'Windows' }}

  build-release:
    permissions:
      id-token: write
    if: |
      github.event_name == 'push' &&
      !contains(github.event.head_commit.message, '[skip-release]') &&
      !contains(github.event.head_commit.message, 'chore') &&
      !contains(github.event.head_commit.message, 'docs')
    needs:
      - lint
      - build
      - test-fixtures
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0
      - run: corepack enable
      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: dist
          path: packages

      - name: Release Edge
        run: ./scripts/release-edge.sh
        env:
          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}
          NPM_CONFIG_PROVENANCE: true

  release-pr:
    permissions:
      id-token: write
      pull-requests: write
    if: |
      github.event_name == 'pull_request' &&
      contains(github.event.pull_request.labels.*.name, '🧷 edge release')
    needs:
      - lint
      - build
      - test-fixtures
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0
      - run: corepack enable
      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: dist
          path: packages

      - name: Release Edge
        run: ./scripts/release-edge.sh pr-${{ github.event.issue.number }}
        env:
          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}
          NPM_CONFIG_PROVENANCE: true