pipeline.yml

name: Pipeline
on:
  push:
    branches: [main]
    paths:
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - 'turbo.json'
      - 'packages/**/src/**'
      - 'packages/**/package.json'
      - '.changeset/**'
      - '.github/workflows/pipeline.yml'
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
    paths:
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - 'turbo.json'
      - 'packages/**/src/**'
      - 'packages/**/package.json'
      - '.changeset/**'
      - '.github/workflows/pipeline.yml'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # Cancel in-progress runs on PRs (new push makes old run irrelevant)
  # but never cancel on main (could interrupt a release)
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    name: Building
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: ./.github/actions/node

      - name: Build all packages
        run: pnpm build

      - name: Upload dist artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: packages/*/dist/
          retention-days: 1

  check:
    name: Type Checking
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: ./.github/actions/node

      - name: Download dist artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: packages

      - name: Run the type checker
        run: pnpm check --filter "./packages/*"

  lint:
    name: Linting
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: ./.github/actions/node

      - name: Download dist artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: packages

      - name: Run the linter
        run: pnpm lint

  test:
    name: Testing
    needs: [build]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: ./.github/actions/node

      - name: Download dist artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: packages

      - name: Run tests with coverage
        run: pnpm coverage

      # Single upload of the merged report, tagged with every package flag.
      # Each flag's `paths:` in codecov.yml slices the report server-side, so
      # one upload feeds all the per-package coverage badges.
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: .coverage/lcov.info
          flags: config,format-po,integration,integration-carbon,integration-react,plugin-babel,plugin-unplugin,transform-js,transform-jsx

      - name: Upload coverage artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: .coverage/
          retention-days: 7

  process:
    name: Processing Changesets
    needs: [check, lint, test]
    runs-on: ubuntu-latest
    outputs:
      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    permissions:
      contents: write
      id-token: write
      pull-requests: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: ./.github/actions/node

      # Only maintains the version PR. Publishing is done below so that a
      # release produces one tag and one GitHub release for the whole
      # workspace, rather than one of each per package.
      - name: Process changesets
        id: changesets
        uses: changesets/action@v1
        with:
          version: pnpm run release:version
          title: 'Pending Releases'
          commit: 'Update changelog and release'

      # `changeset publish` skips anything already on the registry, so this is
      # safe to re-run: a rerun after a partial failure publishes the remainder.
      - name: Publish packages
        if: ${{ steps.changesets.outputs.hasChangesets == 'false' }}
        run: pnpm run release:publish

      - name: Build release notes
        id: notes
        if: ${{ steps.changesets.outputs.hasChangesets == 'false' }}
        run: node scripts/release-notes.mjs

      # Driven by the version on disk rather than by whether this run happened
      # to publish, so a rerun can finish a release whose tag or GitHub release
      # was left behind by an earlier failure. Both are no-ops once they exist.
      - name: Tag and create release
        if: ${{ steps.changesets.outputs.hasChangesets == 'false' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.notes.outputs.version }}
        run: |
          if [ -z "$VERSION" ]; then
            echo 'No shared version to release.'
            exit 0
          fi

          if git ls-remote --exit-code --tags origin "v$VERSION" >/dev/null 2>&1; then
            echo "Tag v$VERSION already exists."
          else
            git tag "v$VERSION"
            git push origin "v$VERSION"
          fi

          if gh release view "v$VERSION" >/dev/null 2>&1; then
            echo "Release v$VERSION already exists."
          else
            gh release create "v$VERSION" \
              --title "v$VERSION" \
              --notes-file RELEASE_NOTES.md
          fi

  snapshot:
    name: Releasing Snapshot
    needs: [process]
    runs-on: ubuntu-latest
    # Betas exist to preview changes that are waiting on a release, so this
    # keys off pending changesets rather than off whether a publish happened.
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.process.outputs.hasChangesets == 'true' }}
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: ./.github/actions/node

      - name: Publish snapshot version
        run: |
          pnpm run release:snapshot:version
          pnpm run release:snapshot:publish