tokenoverflow/.github/workflows/pr.yml at b3d0487f5f6436a55e3e85bfe083542abf5de942 · ozturkberkay/tokenoverflow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
name: PR

on:
  pull_request:
    branches: [ main ]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  actions: read

jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 5
    outputs:
      # Per-surface filter outputs, passed as `with:` inputs to reusables.
      rust: ${{ steps.filter.outputs.rust }}
      ts: ${{ steps.filter.outputs.ts }}
      landing: ${{ steps.filter.outputs.landing }}
      web: ${{ steps.filter.outputs.web }}
      api: ${{ steps.filter.outputs.api }}
      embedding: ${{ steps.filter.outputs.embedding }}
      docker: ${{ steps.filter.outputs.docker }}
      workflows: ${{ steps.filter.outputs.workflows }}
      terraform: ${{ steps.filter.outputs.terraform }}
      shell: ${{ steps.filter.outputs.shell }}
      markdown: ${{ steps.filter.outputs.markdown }}
      openapi: ${{ steps.filter.outputs.openapi }}
      astro: ${{ steps.filter.outputs.astro }}
      lint_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.shell == 'true' || steps.filter.outputs.markdown == 'true' || steps.filter.outputs.terraform == 'true' || steps.filter.outputs.astro == 'true' || steps.filter.outputs.openapi == 'true' || steps.filter.outputs.workflows == 'true' }}
      type_check_needed: ${{ steps.filter.outputs.ts == 'true' || steps.filter.outputs.workflows == 'true' }}
      unit_test_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.shell == 'true' || steps.filter.outputs.workflows == 'true' }}
      integration_test_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.workflows == 'true' }}
      security_audit_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true' || steps.filter.outputs.workflows == 'true' }}
      lhci_needed: ${{ steps.filter.outputs.landing == 'true' || steps.filter.outputs.workflows == 'true' }}
      docker_build_needed: ${{ (steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true') && github.event.pull_request.head.repo.full_name == github.repository }}
      e2e_test_needed: ${{ (steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true') && github.event.pull_request.head.repo.full_name == github.repository }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Per-surface inclusions
        id: filter
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
        with:
          # dorny/paths-filter evaluates each list entry as an independent
          # picomatch pattern and OR's the results, so a standalone negation
          # like '!**/*.md' fires as a positive match on every non-`.md` file.
          # Embed the negation as an extglob suffix on the parent path instead
          # so it constrains that one pattern's filename match.
          filters: |
            rust:
              - 'apps/api/**/!(*.md|*.mdx)'
              - 'apps/embedding_service/**/!(*.md|*.mdx)'
              - 'apps/so_tag_sync/**/!(*.md|*.mdx)'
              - 'integrations/**'
              - 'Cargo.toml'
              - 'Cargo.lock'
            ts:
              - 'apps/web/**/!(*.md|*.mdx)'
              - 'apps/landing/**/!(*.md|*.mdx)'
              - 'packages/**/!(*.md|*.mdx)'
              - 'apps/api/openapi.json'
              - 'package.json'
              - 'bun.lock'
              - 'bunfig.toml'
              - 'turbo.json'
            landing:
              - 'apps/landing/**/!(*.md|*.mdx)'
            web:
              - 'apps/web/**/!(*.md|*.mdx)'
            api:
              - 'apps/api/**/!(*.md|*.mdx)'
            embedding:
              - 'apps/embedding_service/**/!(*.md|*.mdx)'
            docker:
              - 'docker-compose.yml'
              - 'apps/*/Dockerfile'
              - 'infra/docker/**/!(*.md|*.mdx)'
            workflows:
              - '.github/workflows/**/!(*.md|*.mdx)'
              - '.github/actions/**/!(*.md|*.mdx)'
            terraform:
              - 'terraform/**'
              - '**/*.tf'
              - '**/*.tftpl'
            shell:
              - '**/*.sh'
              - 'scripts/**'
            markdown:
              - '**/*.md'
              - '**/*.mdx'
            openapi:
              - 'apps/api/openapi.json'
            astro:
              - 'apps/landing/**/*.astro'

  lint:
    needs: prepare
    if: needs.prepare.outputs.lint_needed == 'true'
    uses: ./.github/workflows/lint.yml
    with:
      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }}
      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }}
      shell: ${{ needs.prepare.outputs.shell == 'true' || needs.prepare.outputs.workflows == 'true' }}
      markdown: ${{ needs.prepare.outputs.markdown == 'true' || needs.prepare.outputs.workflows == 'true' }}
      terraform: ${{ needs.prepare.outputs.terraform == 'true' || needs.prepare.outputs.workflows == 'true' }}
      astro: ${{ needs.prepare.outputs.astro == 'true' || needs.prepare.outputs.workflows == 'true' }}
      openapi: ${{ needs.prepare.outputs.openapi == 'true' || needs.prepare.outputs.workflows == 'true' }}
      workflows: ${{ needs.prepare.outputs.workflows == 'true' }}
    secrets: inherit

  type_check:
    needs: prepare
    if: needs.prepare.outputs.type_check_needed == 'true'
    uses: ./.github/workflows/type_check.yml
    with:
      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }}
    secrets: inherit

  unit_test:
    needs: prepare
    if: needs.prepare.outputs.unit_test_needed == 'true'
    uses: ./.github/workflows/unit_test.yml
    with:
      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }}
      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }}
      shell: ${{ needs.prepare.outputs.shell == 'true' || needs.prepare.outputs.workflows == 'true' }}
    secrets: inherit

  integration_test:
    needs: prepare
    if: needs.prepare.outputs.integration_test_needed == 'true'
    uses: ./.github/workflows/integration_test.yml
    with:
      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }}
    secrets: inherit

  security_audit:
    needs: prepare
    if: needs.prepare.outputs.security_audit_needed == 'true'
    uses: ./.github/workflows/security_audit.yml
    with:
      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }}
      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }}
      docker: ${{ needs.prepare.outputs.docker == 'true' || needs.prepare.outputs.workflows == 'true' }}
    secrets: inherit

  lhci:
    needs: prepare
    if: needs.prepare.outputs.lhci_needed == 'true'
    uses: ./.github/workflows/lhci.yml
    secrets: inherit

  # Same-repo only: forks cannot write to GHCR via `secrets.GITHUB_TOKEN`.
  docker_build:
    needs: [ prepare, lint, type_check, unit_test, integration_test, security_audit ]
    if: needs.prepare.outputs.docker_build_needed == 'true'
    # Job-level permissions override the workflow-level ceiling so the called
    # reusable can declare `packages: write` without it being capped to `none`.
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/docker_build.yml
    secrets: inherit

  # Same-repo only: forks cannot pull from GHCR via `secrets.GITHUB_TOKEN`.
  e2e_test:
    needs: [ prepare, docker_build ]
    if: needs.prepare.outputs.e2e_test_needed == 'true'
    permissions:
      contents: read
      packages: read
    uses: ./.github/workflows/e2e_test.yml
    secrets: inherit

  required:
    name: Required
    needs: [ prepare, lint, type_check, unit_test, integration_test, security_audit, lhci, docker_build, e2e_test ]
    if: always()
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 5
    steps:
      - name: Fail if conditional jobs failed
        if: |
          needs.prepare.result != 'success' ||
          (needs.prepare.outputs.lint_needed == 'true' && needs.lint.result != 'success') ||
          (needs.prepare.outputs.type_check_needed == 'true' && needs.type_check.result != 'success') ||
          (needs.prepare.outputs.unit_test_needed == 'true' && needs.unit_test.result != 'success') ||
          (needs.prepare.outputs.integration_test_needed == 'true' && needs.integration_test.result != 'success') ||
          (needs.prepare.outputs.security_audit_needed == 'true' && needs.security_audit.result != 'success') ||
          (needs.prepare.outputs.lhci_needed == 'true' && needs.lhci.result != 'success') ||
          (needs.prepare.outputs.docker_build_needed == 'true' && needs.docker_build.result != 'success') ||
          (needs.prepare.outputs.e2e_test_needed == 'true' && needs.e2e_test.result != 'success')
        run: exit 1