ci-pnpm-node.yml

name: Common CI for Node (pnpm)

on:
  workflow_call:
    inputs:
      node-version:
        description: Node version to use
        required: true
        type: string
      extra-commands:
        description: Extra setup commands to run before lint/test/build
        required: false
        type: string
      app-directory:
        description: Application subdirectory for lint/test/build
        required: false
        type: string
        default: "."
      typecheck:
        description: Run type checking
        required: false
        type: boolean
        default: false
      upload-artifacts:
        description: Upload build artifacts
        required: false
        type: boolean
        default: false
      skip-sonar:
        description: Skip SonarQube
        required: false
        type: boolean
        default: false
      skip-build:
        description: Skip build phase
        required: false
        type: boolean
        default: false
      working-directory:
        description: Working directory for install/build/test jobs
        required: false
        type: string
        default: "."
      ignore-scripts:
        description: Pass --ignore-scripts to pnpm install
        required: false
        type: boolean
        default: true
      pnpm-version:
        description: >
          pnpm version to use (passed to pnpm/action-setup).
          If empty, pnpm/action-setup reads the version from the
          packageManager field in package.json.
        required: false
        type: string
        default: ""
      commitlint-config-file:
        description: 'Path to commitlint config file'
        required: false
        type: string
        default: './commitlint.config.mjs'
    secrets:
      SONAR_TOKEN:
        description: 'SonarQube Cloud token'
        required: false
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: read

jobs:
  commitlint:
    name: Check commit messages
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Run commitlint
        uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
        with:
          configFile: ${{ inputs.commitlint-config-file }}

  build:
    name: Lint and build
    if: ${{ !inputs.skip-build }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: ${{ inputs.pnpm-version }}

      - name: Setup Node.js with dependency path
        if: ${{ inputs.working-directory != '.' }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ inputs.node-version }}
          cache: pnpm
          cache-dependency-path: ${{ inputs.working-directory }}/pnpm-lock.yaml

      - name: Setup Node.js without dependency path
        if: ${{ inputs.working-directory == '.' }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ inputs.node-version }}
          cache: pnpm

      - name: Install dependencies
        run: |
          IGNORE_SCRIPTS="${{ inputs.ignore-scripts == true && '--ignore-scripts' || '' }}"
          pnpm install --frozen-lockfile $IGNORE_SCRIPTS

      - name: Run extra commands
        if: ${{ inputs.extra-commands != '' }}
        run: ${{ inputs.extra-commands }}

      - name: Typecheck application
        if: ${{ inputs.typecheck }}
        working-directory: ${{ inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory }}
        run: pnpm typecheck

      - name: Lint application
        working-directory: ${{ inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory }}
        run: pnpm lint

      - name: Build application
        working-directory: ${{ inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory }}
        run: pnpm build

      - name: Upload build
        if: ${{ inputs.upload-artifacts }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: build-artifacts-${{ inputs.node-version }}
          path: |
            ${{ inputs.app-directory }}/dist
            ${{ inputs.app-directory }}/build
            ${{ inputs.app-directory }}/lib
          retention-days: 1

      - name: Check browser bundle size limits
        if: ${{ hashFiles(format('{0}/.size-limit.js', inputs.app-directory)) != '' }}
        working-directory: ${{ inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory }}
        run: pnpm check-size

      - name: Check ecmascript checks for build files
        if: ${{ hashFiles(format('{0}/.escheckrc', inputs.app-directory)) != '' }}
        working-directory: ${{ inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory }}
        run: pnpm check-dist

  tests:
    name: Test
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: ${{ inputs.pnpm-version }}

      - name: Setup Node.js with dependency path
        if: ${{ inputs.working-directory != '.' }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ inputs.node-version }}
          cache: pnpm
          cache-dependency-path: ${{ inputs.working-directory }}/pnpm-lock.yaml

      - name: Setup Node.js without dependency path
        if: ${{ inputs.working-directory == '.' }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ inputs.node-version }}
          cache: pnpm

      - name: Install dependencies
        run: |
          IGNORE_SCRIPTS="${{ inputs.ignore-scripts == true && '--ignore-scripts' || '' }}"
          pnpm install --frozen-lockfile $IGNORE_SCRIPTS

      - name: Run extra commands
        if: ${{ inputs.extra-commands != '' }}
        run: ${{ inputs.extra-commands }}

      - name: Run tests
        working-directory: ${{ inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory }}
        run: pnpm test:coverage
        env:
          CI: true

      # Coverage path logic (keep in sync with sonarcloud job's cache/restore step):
      # Resolves the effective directory (app-directory if set, else working-directory),
      # then prefixes 'coverage' with '<dir>/' when running in a subdirectory.
      - name: Store coverage report
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ (inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) && format('{0}/', inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) || ''}}coverage
          key: cache-${{ github.run_id }}-${{ github.run_attempt }}

  sonarcloud:
    name: Run SonarQube Cloud Scan
    if: ${{ !inputs.skip-sonar }}
    runs-on: ubuntu-latest
    needs: tests
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      # Coverage path logic (keep in sync with tests job's cache/save step):
      # Resolves the effective directory (app-directory if set, else working-directory),
      # then prefixes 'coverage' with '<dir>/' when running in a subdirectory.
      - name: Restore coverage report
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ (inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) && format('{0}/', inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) || ''}}coverage
          key: cache-${{ github.run_id }}-${{ github.run_attempt }}
          fail-on-cache-miss: true

      # Without this workaround, SonarQube Cloud reports a warning about an incorrect source path.
      - name: Override coverage report source path for SonarQube Cloud
        working-directory: ${{ inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory }}
        run: |
          find coverage -type f \( -name '*.info' -o -name 'lcov.info' \) 2>/dev/null | xargs -r sed -i 's@SF:'$GITHUB_WORKSPACE'@SF:/github/workspace/@g' || true
          find coverage -type f -name '*.json' 2>/dev/null | xargs -r sed -i 's@'$GITHUB_WORKSPACE'@/github/workspace/@g' || true

      - name: SonarQube Cloud Scan
        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
        with:
          projectBaseDir: ${{ inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory }}
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  dependency-review:
    name: Dependency Review
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: moderate
          fail-on-scopes: runtime, development, unknown
          license-check: false
          vulnerability-check: true
          comment-summary-in-pr: on-failure
          show-patched-versions: true