landing-page-ci.yml

name: landing-page-ci

on:
  pull_request:
    paths:
      # Workflow files
      - .github/workflows/landing-page-ci.yml
      - .github/workflows/landing-page-staging.yml
      - .github/workflows/landing-page-production.yml
      - .github/workflows/blog-indexing-on-deploy.yml
      # Landing page sources
      - apps/landing-page/**
      # Design template source of truth for the homepage.
      - design-templates/open-design-landing/**
      # Content sources globbed by Astro content collections — without
      # these the deploy can be silently skipped when only Markdown
      # content is touched.
      - skills/**
      - design-systems/**
      - craft/**
      - templates/**
      # Plugin manifests power the bundled-plugin catalog and the new
      # `_lib/bundled-plugins.ts` reader; CI must rerun when their
      # `title_i18n` / `description_i18n` maps or other fields change.
      - plugins/**
      # Workspace plumbing
      - package.json
      - pnpm-lock.yaml
      - pnpm-workspace.yaml
  # Merge queue trigger so PRs that touch the same paths can clear
  # `Validate landing page` / `Strict PR visual tests` while queued.
  # Without this branch ruleset blocks merges (the queue waits forever
  # for a check name that never gets dispatched against the merge_group
  # ref), which is the exact deadlock observed during the 5/26 release
  # window.
  merge_group:
    types: [checks_requested]
  push:
    branches:
      - main
    paths:
      - .github/workflows/landing-page-ci.yml
      - .github/workflows/landing-page-staging.yml
      - .github/workflows/landing-page-production.yml
      - .github/workflows/blog-indexing-on-deploy.yml
      - apps/landing-page/**
      - design-templates/open-design-landing/**
      - skills/**
      - design-systems/**
      - craft/**
      - templates/**
      - plugins/**
      - package.json
      - pnpm-lock.yaml
      - pnpm-workspace.yaml
  workflow_dispatch:

permissions:
  contents: read
  # Needed to post/update the preview-URL comment on the PR. Fork PRs run
  # with a read-only token regardless, so the preview steps below are gated
  # to same-repo branches.
  pull-requests: write

concurrency:
  group: landing-page-ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: Validate landing page
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0

      - name: Setup workspace
        uses: ./.github/actions/setup-workspace

      - name: Restore generated previews
        id: previews-cache
        uses: actions/cache/restore@v5
        with:
          path: apps/landing-page/public/previews
          key: landing-page-previews-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'package.json', 'apps/landing-page/package.json', 'apps/landing-page/scripts/generate-previews.ts', 'apps/landing-page/scripts/fallback-preview-card.ts', 'skills/**', 'design-templates/**', 'templates/live-artifacts/**', 'plugins/_official/**') }}
          restore-keys: |
            landing-page-previews-${{ runner.os }}-

      # Cache the Playwright browser binaries between runs. The cache key
      # is pinned to the playwright version we depend on (kept in
      # apps/landing-page/package.json) so a bump invalidates correctly.
      - name: Setup Playwright
        uses: ./.github/actions/setup-playwright
        with:
          package-json-path: apps/landing-page/package.json
          install-command: pnpm --filter @open-design/landing-page exec playwright install --with-deps chromium

      - name: Typecheck landing page
        run: pnpm --filter @open-design/landing-page typecheck

      # Generate the per-skill / per-template thumbnail PNGs *before*
      # the build so they ship in `out/previews/` automatically. The
      # script itself decides what's a soft vs. hard failure: a single
      # broken `example.html` is logged and skipped, but a chromium
      # launch failure or a 100%-failure run exits non-zero so the
      # build stops instead of silently shipping zero thumbnails.
      - name: Generate skill + template previews
        # Exact previews-cache hit ⇒ public/previews already holds the correct
        # thumbnails, skip the slow Playwright render. A restore-keys partial
        # hit keeps cache-hit false, so we still regenerate — no stale-thumbnail
        # drift.
        if: steps.previews-cache.outputs.cache-hit != 'true'
        run: pnpm --filter @open-design/landing-page previews

      # No PUBLIC_GA_MEASUREMENT_ID for PR/CI builds: the per-PR preview must
      # not report into the production GA property. OD_LANDING_NOINDEX=1 keeps
      # the PR preview (pr-<n>.open-design-landing-staging.pages.dev) out of
      # search engines. Only `landing-page-production` builds without these.
      - name: Build landing page
        env:
          OD_LANDING_NOINDEX: '1'
        run: pnpm --filter @open-design/landing-page build:static

      - name: Save generated previews
        if: ${{ steps.previews-cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
        uses: actions/cache/save@v5
        with:
          path: apps/landing-page/public/previews
          key: landing-page-previews-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'package.json', 'apps/landing-page/package.json', 'apps/landing-page/scripts/generate-previews.ts', 'apps/landing-page/scripts/fallback-preview-card.ts', 'skills/**', 'design-templates/**', 'templates/live-artifacts/**', 'plugins/_official/**') }}

      - name: Lint changed blog SEO
        # The build above sets OD_LANDING_NOINDEX=1, so every rendered page in
        # `out/` carries `noindex`. Pass the same flag through so the SEO linter
        # treats that staging-only noindex as expected instead of an
        # indexability blocker (production builds leave the flag unset).
        env:
          OD_LANDING_NOINDEX: '1'
        run: |
          BASE="${{ github.event.pull_request.base.sha || github.event.before || '' }}"
          if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
            # merge_group (and first-push) events have no base SHA. Resolve a
            # concrete commit instead of passing the literal "HEAD^", which the
            # blog-indexing scripts' assertSafeGitRef rejects (no "^" allowed).
            BASE="$(git rev-parse HEAD^)"
          fi
          pnpm --filter @open-design/landing-page exec tsx scripts/blog-indexing/lint-blog-seo.ts \
            --base "$BASE" \
            --head HEAD \
            --rendered-out apps/landing-page/out

      - name: Guard blog URL changes
        run: |
          BASE="${{ github.event.pull_request.base.sha || github.event.before || '' }}"
          if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
            # merge_group (and first-push) events have no base SHA. Resolve a
            # concrete commit instead of passing the literal "HEAD^", which the
            # blog-indexing scripts' assertSafeGitRef rejects (no "^" allowed).
            BASE="$(git rev-parse HEAD^)"
          fi
          pnpm --filter @open-design/landing-page exec tsx scripts/blog-indexing/check-blog-url-changes.ts \
            --base "$BASE" \
            --head HEAD

      - name: Verify zero external JavaScript
        run: |
          node <<'NODE'
          const { readFileSync } = require('node:fs');
          const html = readFileSync('apps/landing-page/out/index.html', 'utf8');
          const forbidden = [
            /<script\b[^>]*\bsrc=/i,
            /type=["']module["']/i,
            /\/_astro\/[^"'<>\s]+\.js/i,
          ];
          for (const pattern of forbidden) {
            if (pattern.test(html)) {
              console.error(`Unexpected client JavaScript matched ${pattern}`);
              process.exit(1);
            }
          }
          NODE

      - name: Verify homepage ships optimized WebP art
        run: |
          node <<'NODE'
          const { readFileSync } = require('node:fs');
          const html = readFileSync('apps/landing-page/out/index.html', 'utf8');
          // The homepage serves its hero / gallery / method art as optimized,
          // origin-hosted WebP (each kept <1MB by the changed-file blob guard)
          // instead of Cloudflare Image Resizing variants — see PR #4158, the
          // local-first homepage design refresh. Require the same floor of 16
          // optimized references so a regression that reintroduces raw,
          // unoptimized art (or drops the gallery) is still caught.
          const webpRefs = html.match(/\/[A-Za-z0-9/_-]+\.webp/g) ?? [];
          if (webpRefs.length < 16) {
            console.error(`Expected at least 16 optimized WebP image references, found ${webpRefs.length}`);
            process.exit(1);
          }
          if (/(?:src|content)=["']\/assets\/[A-Za-z0-9_.-]+\.png/.test(html)) {
            console.error('Found local /assets/*.png image reference in generated landing HTML.');
            process.exit(1);
          }
          NODE

      - name: Verify deploy file count under Cloudflare Pages cap
        run: |
          # Cloudflare Pages rejects deployments over 20,000 files. Localized
          # routes (especially per-locale catalog detail pages) can silently
          # multiply the output, so fail well before the hard cap — a regression
          # is caught here instead of at the wrangler deploy step. `out/`
          # already includes the generated previews at this point.
          count=$(find apps/landing-page/out -type f | wc -l | tr -d '[:space:]')
          echo "landing-page deploy file count: $count"
          if [ "$count" -ge 19000 ]; then
            echo "::error::landing-page build emitted $count files; Cloudflare Pages caps deployments at 20,000. Reduce per-locale page fan-out (see PR #4158)."
            exit 1
          fi

      # --- PR preview deploy -------------------------------------------------
      # Publish this PR's built site to its own preview URL in the STAGING
      # project (`--branch=pr-<number>`) so reviewers see the rendered result
      # before merge. It lands in the staging project, never the production
      # project. Gated to same-repo branches: fork PRs run without the
      # Cloudflare secrets and with a read-only token, so they skip the
      # deploy/comment and keep just the validation above.
      - name: Prepare staging Pages configuration
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
        run: cp apps/landing-page/wrangler.staging.toml apps/landing-page/wrangler.toml

      - name: Apply attribution ledger migrations (staging)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          workingDirectory: apps/landing-page
          packageManager: npm
          wranglerVersion: "4.110.0"
          command: d1 migrations apply open-design-landing-staging-attribution --remote

      - name: Deploy PR preview to Cloudflare Pages
        id: preview
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          workingDirectory: apps/landing-page
          packageManager: npm
          command: >
            pages deploy out
            --project-name=open-design-landing-staging
            --branch=pr-${{ github.event.pull_request.number }}

      - name: Comment preview URL on PR
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/github-script@v7
        env:
          DEPLOY_URL: ${{ steps.preview.outputs.deployment-url }}
          ALIAS_URL: ${{ steps.preview.outputs.pages-deployment-alias-url }}
        with:
          script: |
            const marker = '<!-- landing-preview -->';
            const deploy = process.env.DEPLOY_URL || '';
            const alias =
              process.env.ALIAS_URL ||
              `https://pr-${context.issue.number}.open-design-landing-staging.pages.dev`;
            const sha = context.payload.pull_request.head.sha.slice(0, 7);
            const body = [
              marker,
              '### 🚀 Landing page preview',
              '',
              'This PR is deployed to a Cloudflare Pages preview — **not** staging or production:',
              '',
              `- Stable alias: ${alias}`,
              deploy ? `- This build: ${deploy}` : '',
              '',
              `Updated for commit \`${sha}\`.`,
            ]
              .filter(Boolean)
              .join('\n');
            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              per_page: 100,
            });
            const existing = comments.find((c) => c.body && c.body.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }