fluidd/.github/workflows/ci.yml at develop · fluidd-core/fluidd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
name: CI

on:
  push:
    branches:
      - develop
      - master
  pull_request:
    branches:
      - develop
      - master
  merge_group:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions: {}

jobs:
  build:
    name: Build
    uses: ./.github/workflows/_build.yml
    permissions:
      contents: read

  publish-docker:
    name: Publish
    needs: build
    if: ${{ github.event_name != 'pull_request' }}
    uses: ./.github/workflows/_publish-docker.yml
    permissions:
      id-token: write
      contents: read
      attestations: write
      packages: write
      artifact-metadata: write

  publish-web:
    name: Deploy to Host
    needs: build
    if: ${{ github.repository == 'fluidd-core/fluidd' && github.ref == 'refs/heads/develop' }}
    uses: ./.github/workflows/_publish-web.yml
    secrets:
      bucket: ${{ secrets.DEV_S3_BUCKET_NAME }}
      distribution-id: ${{ secrets.DEV_CF_DISTRIBUTION_ID }}
      aws-role: ${{ secrets.AWS_GITHUB_ACTIONS_ROLE }}
    permissions:
      id-token: write
      contents: read

  bundle-baseline:
    name: Save Bundle Size Baseline
    needs: build
    if: ${{ github.event_name == 'push' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          sparse-checkout: |
            .github/actions
            tools

      - name: Setup pnpm and Node
        uses: ./.github/actions/setup-pnpm-node

      - name: Download dist
        uses: actions/download-artifact@v8
        with:
          name: fluidd-${{ github.sha }}
          path: ./dist

      - name: Generate bundle size manifest
        run: node tools/bundle-size.mjs generate dist bundle-size.base.json

      - name: Cache bundle size manifest
        uses: actions/cache/save@v6
        with:
          path: bundle-size.base.json
          key: bundle-size-${{ hashFiles('tools/bundle-size.mjs') }}-${{ github.sha }}

  bundle-size:
    name: Bundle Size Report
    needs: build
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup pnpm and Node
        uses: ./.github/actions/setup-pnpm-node

      - name: Resolve merge-base
        id: mb
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          MERGE_BASE=$(git merge-base "origin/$BASE_REF" HEAD)
          echo "sha=$MERGE_BASE" >> "$GITHUB_OUTPUT"

      - name: Restore bundle size baseline
        id: cache
        uses: actions/cache/restore@v6
        with:
          path: bundle-size.base.json
          key: bundle-size-${{ hashFiles('tools/bundle-size.mjs') }}-${{ steps.mb.outputs.sha }}

      - name: Build merge-base
        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        env:
          MERGE_BASE: ${{ steps.mb.outputs.sha }}
        run: |
          git worktree add ../base "$MERGE_BASE"
          cd ../base
          pnpm i --frozen-lockfile
          pnpm run build
          node "$GITHUB_WORKSPACE/tools/bundle-size.mjs" generate dist "$GITHUB_WORKSPACE/bundle-size.base.json"

      - name: Save bundle size baseline
        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v6
        with:
          path: bundle-size.base.json
          key: bundle-size-${{ hashFiles('tools/bundle-size.mjs') }}-${{ steps.mb.outputs.sha }}

      - name: Download PR dist
        uses: actions/download-artifact@v8
        with:
          name: fluidd-${{ github.sha }}
          path: ./dist

      - name: Generate PR bundle size manifest
        run: |
          node tools/bundle-size.mjs generate dist bundle-size.head.json

      - name: Compare bundle sizes
        # `shell: bash` for pipefail; the implicit default is `bash -e` without it,
        # so a failing `compare` would be masked by `tee`.
        shell: bash
        run: |
          node tools/bundle-size.mjs compare bundle-size.base.json bundle-size.head.json | tee bundle-size-report.md >> "$GITHUB_STEP_SUMMARY"

      - name: Write PR number
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          echo "$PR_NUMBER" > pr-number.txt

      - name: Upload bundle size report
        uses: actions/upload-artifact@v7
        with:
          name: bundle-size-report
          path: |
            bundle-size-report.md
            pr-number.txt
          retention-days: 7