name: ci

on:
  push:
    paths-ignore:
      - "docs/**"
      - "*.md"
    branches:
      - main
  pull_request:
    paths-ignore:
      - "docs/**"
      - "*.md"
    branches:
      - main
      - "!v[0-9]*"

# https://github.com/vitejs/vite/blob/main/.github/workflows/ci.yml
env:
  # 7 GiB by default on GitHub, setting to 6 GiB
  # https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources
  NODE_OPTIONS: --max-old-space-size=6144
  # install playwright binary manually (because pnpm only runs install script once)
  PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"

# Remove default permissions of GITHUB_TOKEN for security
# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
  cancel-in-progress: ${{ github.event_name != 'push' }}

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - run: corepack enable
      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Build (stub)
        run: pnpm dev:prepare

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

      - name: Cache dist
        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
        with:
          retention-days: 3
          name: dist
          path: packages/*/dist

  codeql:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      security-events: write
    needs:
      - build

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - run: corepack enable
      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Initialize CodeQL
        uses: github/codeql-action/init@b374143c1149a9115d881581d29b8390bbcbb59c # v3.22.11
        with:
          languages: javascript
          queries: +security-and-quality

      - name: Restore dist cache
        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
        with:
          name: dist
          path: packages

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@b374143c1149a9115d881581d29b8390bbcbb59c # v3.22.11
        with:
          category: "/language:javascript"

  typecheck:
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        module: ["bundler", "node"]

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - run: corepack enable
      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
        with:
          name: dist
          path: packages

      - name: Test (types)
        run: pnpm test:types
        env:
          MODULE_RESOLUTION: ${{ matrix.module }}

  lint:
    # autofix workflow will be triggered instead for PRs
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - run: corepack enable
      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Build (stub)
        run: pnpm dev:prepare

      - name: Lint
        run: pnpm lint

  test-unit:
    # autofix workflow will be triggered instead for PRs
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs:
      - build
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - run: corepack enable
      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Build (stub)
        run: pnpm dev:prepare

      - name: Test (unit)
        run: pnpm test:unit

      - name: Test (runtime unit)
        run: pnpm test:runtime

  test-fixtures:
    runs-on: ${{ matrix.os }}
    needs:
      - build

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        env: ["dev", "built"]
        builder: ["vite", "webpack"]
        context: ["async", "default"]
        manifest: ["manifest-on", "manifest-off"]
        node: [18]
        exclude:
          - env: "dev"
            builder: "webpack"
          - manifest: "manifest-off"
            builder: "webpack"

    timeout-minutes: 15

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - run: corepack enable
      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
          node-version: ${{ matrix.node }}
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      # Install playwright's binary under custom directory to cache
      - name: (non-windows) Set Playwright path and Get playwright version
        if: runner.os != 'Windows'
        run: |
          echo "PLAYWRIGHT_BROWSERS_PATH=$HOME/.cache/playwright-bin" >> $GITHUB_ENV
          PLAYWRIGHT_VERSION="$(pnpm ls --depth 0 --json -w playwright | jq --raw-output '.[0].unsavedDependencies["playwright"].version')"
          echo "PLAYWRIGHT_VERSION=$PLAYWRIGHT_VERSION" >> $GITHUB_ENV

      - name: (windows) Set Playwright path and Get playwright version
        if: runner.os == 'Windows'
        run: |
          echo "PLAYWRIGHT_BROWSERS_PATH=$HOME\.cache\playwright-bin" >> $env:GITHUB_ENV
          $env:PLAYWRIGHT_VERSION="$(pnpm ls --depth 0 --json -w playwright | jq --raw-output '.[0].unsavedDependencies[\"playwright\"].version')"
          echo "PLAYWRIGHT_VERSION=$env:PLAYWRIGHT_VERSION" >> $env:GITHUB_ENV

      - name: Cache Playwright's binary
        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
        with:
          key: ${{ runner.os }}-playwright-bin-v1-${{ env.PLAYWRIGHT_VERSION }}
          path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}
          restore-keys: |
            ${{ runner.os }}-playwright-bin-v1-

      - name: Install Playwright
        run: pnpm playwright-core install chromium

      - name: Restore dist cache
        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
        with:
          name: dist
          path: packages

      - name: Test (fixtures)
        run: pnpm test:fixtures
        env:
          TEST_ENV: ${{ matrix.env }}
          TEST_BUILDER: ${{ matrix.builder }}
          TEST_MANIFEST: ${{ matrix.manifest }}
          TEST_CONTEXT: ${{ matrix.context }}
          SKIP_BUNDLE_SIZE: ${{ github.event_name != 'push' || matrix.env == 'dev' || matrix.builder == 'webpack' || matrix.context == 'default' || runner.os == 'Windows' }}

      - uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
        if: github.event_name != 'push' && matrix.env == 'built' && matrix.builder == 'vite' && matrix.context == 'default' && matrix.os == 'ubuntu-latest' && matrix.manifest == 'manifest-on'
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  build-release:
    permissions:
      id-token: write
    if: |
      github.event_name == 'push' &&
      !contains(github.event.head_commit.message, '[skip-release]') &&
      !startsWith(github.event.head_commit.message, 'chore') &&
      !startsWith(github.event.head_commit.message, 'docs')
    needs:
      - lint
      - build
      - test-fixtures
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0
      - run: corepack enable
      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
        with:
          name: dist
          path: packages

      - name: Release Edge
        run: ./scripts/release-edge.sh
        env:
          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}
          NPM_CONFIG_PROVENANCE: true

  release-pr:
    permissions:
      id-token: write
      pull-requests: write
    if: |
      github.event_name == 'pull_request' &&
      contains(github.event.pull_request.labels.*.name, '🧷 edge release')
    needs:
      - lint
      - build
      - test-fixtures
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0
      - run: corepack enable
      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install

      - name: Restore dist cache
        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
        with:
          name: dist
          path: packages

      - name: Release Edge
        run: ./scripts/release-edge.sh pr-${{ github.event.issue.number }}
        env:
          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}
          NPM_CONFIG_PROVENANCE: true