main.yml

# release.yaml is dependant on this name being "main"
name: 'main'

# Ensures that only one workflow is run per branch at a time.
concurrency:
  cancel-in-progress: true
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}

on:
  push:
    branches:
      - master
      - release-[0-9]+.[0-9]+
  pull_request:
    types:
      - opened
      - reopened
      - synchronize

permissions:
  contents: read # for checking out the repository (e.g. actions/checkout)

jobs:
  lint-actions:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: zgosalvez/github-actions-ensure-sha-pinned-actions@3db98c0363e2fa5df3e1c4c471777a7c10b24cc9 # v5.0.5

  install-dependencies:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    needs:
      - lint-actions
    outputs:
      spec_groups: ${{ steps.set-groups.outputs.result }}
      packages: ${{ steps.meta.outputs.packages }}
      unit: ${{ steps.meta.outputs.unit }}
      preview: ${{ steps.meta.outputs.preview }}
      e2e: ${{ steps.meta.outputs.e2e }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: ./.github/actions/bootstrap/
        with:
          install-cmd: |
            make install
      - id: meta
        run: |
          echo "packages<<EOF" >> $GITHUB_OUTPUT
            make meta/packages >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
          echo "unit<<EOF" >> $GITHUB_OUTPUT
            make meta/unit >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
          echo "preview<<EOF" >> $GITHUB_OUTPUT
            make meta/preview >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
          echo "e2e<<EOF" >> $GITHUB_OUTPUT
            make meta/e2e >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

  lint-tests:
    timeout-minutes: 30
    needs:
      - install-dependencies
    runs-on: ubuntu-latest
    strategy:
      matrix:
        package: ${{ fromJSON(needs.install-dependencies.outputs.packages) }}
    name: |
      Linting ${{ matrix.package.name }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: ./.github/actions/bootstrap/
      - run: |
          make -C ${{ matrix.package.path }} lint

  cli-tests:
    timeout-minutes: 30
    needs:
      - install-dependencies
    runs-on: ubuntu-latest
    strategy:
      matrix:
        package: ${{ fromJSON(needs.install-dependencies.outputs.unit) }}
    name: |
      Unit tests: ${{ matrix.package.name }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: ./.github/actions/bootstrap/
      - run: |
          make -C ${{ matrix.package.path }} test/unit

  browser-tests:
    timeout-minutes: 30
    needs:
      - install-dependencies
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJSON(needs.install-dependencies.outputs.e2e) }}
        container: [1, 2, 3, 4]
    name: |
      Browser tests: ${{ matrix.package.name }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: ./.github/actions/bootstrap/
      - env:
          KUMA_BASE_URL: 'http://localhost:5681/gui'
          KUMA_API_URL: 'http://localhost:5681'
          KUMA_E2E_SHARD_CURRENT: ${{ matrix.container }}
          KUMA_E2E_SHARD_TOTAL: 4
        run: |
          make -C ${{ matrix.package.path }} run/e2e &
          make -C ${{ matrix.package.path }} test/e2e
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: failure()
        with:
          name: e2e-artifacts-${{ matrix.package.slug }}-${{ matrix.container }}
          retention-days: ${{ github.event_name == 'pull_request' && 3 || 30 }}
          path: |
            ${{ matrix.package.path }}/test-results
            ${{ matrix.package.path }}/playwright-report

  post-checks:
    # There is a branch protection rule on the repo that requires "branch-protection" to
    # be successful in order to merge a PR
    name: branch-protection
    #
    needs:
      - lint-tests
      - cli-tests
      - browser-tests
    runs-on: ubuntu-latest
    if: |
      always()
    steps:
      - name: Check for failures
        if: |
          contains(needs.*.result, 'failure') ||
          contains(needs.*.result, 'cancelled')
        run: echo '${{toJSON(needs)}}' && exit 1
      - run: echo "Successful"
  # when everything is successful on the main branch run the release.yml
  # workflow
  release:
    needs:
      - post-checks
    if: ${{ github.event_name != 'pull_request' }}
    uses: ./.github/workflows/release.yml
    secrets:
      APP_ID: ${{ secrets.APP_ID }}
      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}