ci.yml

name: ci

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:
    inputs:
      MANUAL_FORCE_DEPLOY_AFFECTED:
        type: boolean
        required: true
        default: false

permissions:
  actions: read
  contents: read
  id-token: write
  attestations: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
  cancel-in-progress: true

jobs:
  main:
    runs-on: ubuntu-latest
    env:
      ARTIFACT_REGISTRY: docker.io
      IMAGE_AFFECTED: docker.io/leblancmeneses/actions-affected
      NX_CLOUD: false
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Connect your workspace on nx.app and uncomment this to enable task distribution.
      # The "--stop-agents-after" is optional, but allows idle agents to shut down once the "build" targets have been requested
      # - run: npx nx-cloud start-ci-run --distribute-on="5 linux-medium-js" --stop-agents-after="build"

      - uses: actions/setup-node@v4
        with:
          node-version: 20.11

      - name: set up gcloud auth
        uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: '${{ secrets.GCP_GITHUB_SERVICE_ACCOUNT }}'

      - name: install dependencies
        run: |
          npm install -g pnpm
          pnpm install --frozen-lockfile

      - uses: nrwl/nx-set-shas@v4

      # Prepend any command with "nx-cloud record --" to record its logs to Nx Cloud
      # - run: npx nx-cloud record -- echo Hello World
      # - run: npx nx affected -t lint test build

      - name: calculate version-autopilot
        id: version-autopilot
        uses: ./apps/version-autopilot
        with:
          major: 0
          minor: 0
          shift: 50 # remove if this is a brand new application. Otherwise, use this to match your current version.

      - name: version-autopilot output
        run: |
          echo "github.run_number: ${{ github.run_number }}"
          echo "version_autopilot_string_recommended: ${{ steps.version-autopilot.outputs.version_autopilot_string_recommended }}"
          echo "version_autopilot_string: ${{ steps.version-autopilot.outputs.version_autopilot_string }}"
          echo "version_autopilot_code: ${{ steps.version-autopilot.outputs.version_autopilot_code }}"

      - name: calculate pragma
        id: pragma
        uses: ./apps/pragma
        with:
          variables: |
            lint-appname-ui = 'skip'
            force = false
            deploy = "${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/prod' }}"

      - name: calculate affected
        id: affected
        uses: ./apps/affected
        with:
          changed-files-output-file: ./.artifacts/changed.json
          rules-file: .github/affected.rules
          recommended-imagetags-tag-remove-target: true
          recommended-imagetags-tag-format: '{sha|10}'
          recommended-imagetags-tag-format-whenchanged: ${{ github.event_name == 'pull_request' && format('pr-{0}-{1}', github.event.number, '{sha|10}') || '{sha}' }}
          recommended-imagetags-registry: ${{ env.IMAGE_AFFECTED }}

      - name: calculate gcp cache
        id: cache
        uses: ./apps/gcp-build-cache
        with:
          affected: ${{steps.affected.outputs.affected}}
          pragma: ${{steps.pragma.outputs.pragma}}
          gcs-root-path: gs://opensource-github-integration/build-cache
          additional-keys: |
            { "affected": ["build", "docker"] }

      - name: task outputs
        run: |
          echo "pragma: "
          echo '${{ steps.pragma.outputs.pragma }}' | jq .

          echo "==========="
          echo "affected: "
          echo '${{ steps.affected.outputs.affected }}' | jq .
          echo "==========="
          cat ./.artifacts/changed.json

          echo "==========="
          echo "gcp-build-cache: "
          echo '${{ steps.cache.outputs.cache }}' | jq .

      - name: incomplete parser changes
        if: ${{ !failure() && !cancelled() && fromJson(steps.affected.outputs.affected).peggy-parser-checkIf-incomplete.changes }}
        run: |
          echo "Missing parser.ts or parser.spec.ts in changeset."
          exit 1

      - name: check if parser changes are incomplete
        if: ${{ !failure() && !cancelled() && fromJson(steps.affected.outputs.affected).peggy-parser.changes }}
        run: |
          pnpm apps:affected:generate-parser
          sed -i '1i /* eslint-disable @typescript-eslint/ban-ts-comment */\n// @ts-nocheck' apps/affected/src/parser.ts
          git diff --exit-code -- ./

      - name: ensure pr version bump
        if: |
          !failure() && !cancelled() && github.event_name == 'pull_request' && (
            fromJson(steps.affected.outputs.affected).affected.changes ||
            fromJson(steps.affected.outputs.affected).version-autopilot.changes ||
            fromJson(steps.affected.outputs.affected).pragma.changes ||
            fromJson(steps.affected.outputs.affected).gcp-build-cache.changes
          )
        run: |
          # package.json bump required by affected.
          git diff ${{ github.event.pull_request.base.sha }} ${{ github.sha }} package.json | grep version

      - name: version bump to env
        if: |
          !failure() && !cancelled() && (
            inputs.MANUAL_FORCE_DEPLOY_AFFECTED ||
            fromJson(steps.affected.outputs.affected).affected.changes ||
            fromJson(steps.affected.outputs.affected).version-autopilot.changes ||
            fromJson(steps.affected.outputs.affected).pragma.changes ||
            fromJson(steps.affected.outputs.affected).gcp-build-cache.changes
          )
        run: |
          SHORT_SHA=$(echo "${{ fromJson(steps.affected.outputs.affected_shas).affected }}" | cut -c 1-7)
          VERSION=$(jq -r '.version' package.json)
          PACKAGE_VERSION="v${VERSION}-${SHORT_SHA}"
          echo "PACKAGE_VERSION=${PACKAGE_VERSION}" >> $GITHUB_ENV
          echo "${PACKAGE_VERSION}"

      - name: build affected
        if: |
         !failure() && !cancelled()
           && fromJson(steps.affected.outputs.affected).affected.changes
           && fromJson(steps.cache.outputs.cache).affected-build.cache-hit == false
        run: |
          npx nx run affected:lint
          npx nx run affected:test
          npx nx run affected:build:production

      - name: write affected-build cache
        uses: ./apps/gcp-build-cache
        with:
          write-on: immediate
          cache_key_path: ${{fromJson(steps.cache.outputs.cache).affected-build.path}}

      - name: build version-autopilot
        if: |
          !failure() && !cancelled()
            && fromJson(steps.affected.outputs.affected).version-autopilot.changes
            && fromJson(steps.cache.outputs.cache).version-autopilot.cache-hit == false
        run: |
          npx nx run version-autopilot:lint
          npx nx run version-autopilot:test
          npx nx run version-autopilot:build:production

      - name: write version-autopilot cache
        uses: ./apps/gcp-build-cache
        with:
          write-on: immediate
          cache_key_path: ${{fromJson(steps.cache.outputs.cache).version-autopilot.path}}

      - name: build pragma
        if: |
          !failure() && !cancelled()
            && fromJson(steps.affected.outputs.affected).pragma.changes
            && fromJson(steps.cache.outputs.cache).pragma.cache-hit == false
        run:  |
          npx nx run pragma:lint
          npx nx run pragma:test
          npx nx run pragma:build:production

      - name: write pragma cache
        uses: ./apps/gcp-build-cache
        with:
          write-on: immediate
          cache_key_path: ${{fromJson(steps.cache.outputs.cache).pragma.path}}

      - name: build gcp-build-cache
        if: |
          !failure() && !cancelled()
            && fromJson(steps.affected.outputs.affected).gcp-build-cache.changes
            && fromJson(steps.cache.outputs.cache).gcp-build-cache.cache-hit == false
        run:  |
          npx nx run gcp-build-cache:lint
          npx nx run gcp-build-cache:test
          npx nx run gcp-build-cache:build:production

      - name: write affected gcp-build-cache
        uses: ./apps/gcp-build-cache
        with:
          write-on: immediate
          cache_key_path: ${{fromJson(steps.cache.outputs.cache).gcp-build-cache.path}}

      - name: assert dist is deterministic
        run: git diff --exit-code -- ./dist

      - name: Log in to Docker Hub
        if: |
          !failure() && !cancelled() && (
            inputs.MANUAL_FORCE_DEPLOY_AFFECTED || (
              fromJson(steps.affected.outputs.affected).affected.changes &&
              fromJson(steps.cache.outputs.cache).affected-docker.cache-hit == false
            )
          )
        uses: docker/login-action@v3
        with:
          registry: ${{ env.ARTIFACT_REGISTRY }}
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: build and push Docker image
        id: push
        if: |
          !failure() && !cancelled() && (
            inputs.MANUAL_FORCE_DEPLOY_AFFECTED || (
              fromJson(steps.affected.outputs.affected).affected.changes &&
              fromJson(steps.cache.outputs.cache).affected-docker.cache-hit == false
            )
          )
        uses: docker/build-push-action@v3
        with:
          context: .
          file: ./apps/affected/Dockerfile
          push: true
          tags: ${{github.event_name == 'pull_request' && fromJson(steps.affected.outputs.affected).affected.recommended_imagetags[0] || format('{0}:{1}', env.IMAGE_AFFECTED, env.PACKAGE_VERSION)}}
          labels: |
            org.opencontainers.image.created=${{ github.event.created_at }}
            org.opencontainers.image.version=${{ env.PACKAGE_VERSION }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=${{ github.repository }}
            org.opencontainers.image.authors=Leblanc Meneses
            org.opencontainers.image.licenses=MIT
            org.opencontainers.image.title=Actions Affected
            org.opencontainers.image.description=Allows you to calculate affected externally of GitHub
            org.opencontainers.image.url=https://github.com/${{ github.repository }}
            org.opencontainers.image.documentation=https://github.com/${{ github.repository }}/README.md
            org.opencontainers.image.vendor=Improving Startups LLC

      - name: write affected-docker cache
        uses: ./apps/gcp-build-cache
        with:
          write-on: immediate
          cache_key_path: ${{fromJson(steps.cache.outputs.cache).affected-docker.path}}

      # - name: generate artifact attestation
      #   if: ${{ !failure() && !cancelled() && fromJson(steps.affected.outputs.affected).affected.changes && github.event_name != 'pull_request' }}
      #   uses: actions/attest-build-provenance@v2
      #   with:
      #     subject-name: ${{ env.IMAGE_AFFECTED }}
      #     subject-digest: ${{ steps.push.outputs.digest }}
      #     push-to-registry: true

      - name: debug
        if: ${{ (failure() && !cancelled()) || github.event_name == 'workflow_dispatch'}}
        shell: bash
        run: |
          echo ''
          echo 'inputs:'
          jq -r . <<EOF
          ${{ toJson(inputs) }}
          EOF
          echo '============================'
          echo 'github:'
          jq -r . <<EOF
          ${{ toJson(github) }}
          EOF
          echo '============================'
          printenv