ci.yaml

name: CI

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
    tags:
      - '*'

permissions: write-all

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  build:
    name: Build and test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Python 3.11
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"
      - name: Setup fontspector
        uses: fonttools/setup-fontspector@main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Install toolset
        run: |
          sudo apt-get update
          sudo apt-get install ttfautohint libcairo2-dev python3-cairo-dev pkg-config python3-dev
          sudo snap install yq
      - name: Set artifact file name
        id: zip-name
        shell: bash
        # Set the archive name to repo name + "-fonts" e.g "radiocanadafonts-fonts.zip"
        run: echo "ZIP_NAME=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')-fonts" >> $GITHUB_ENV

      # If a new release is cut, use the release tag to auto-bump the source files
      # - name: Bump release
      #   if: github.event_name == 'release'
      #   run: |
      #     . venv/bin/activate
      #     SRCS=$(yq e ".sources[]" sources/config.yaml)
      #     TAG_NAME=${GITHUB_REF/refs\/tags\//}
      #     echo "Bumping $SRCS to $TAG_NAME"
      #     for src in $SRCS
      #     do
      #       bumpfontversion sources/$src --new-version $TAG_NAME;
      #     done

      - name: Build font
        run: make build
      - name: Check with fontspector
        run: make test
        continue-on-error: true
      - name: Generate proofs
        run: make proof
      - name: Set up test result site
        run: cp scripts/index.html out/index.html
      - name: Collect deployment assets
        if: ${{ github.ref == 'refs/heads/main' }}
        uses: actions/upload-pages-artifact@v4
        with:
          path: ./out
      - name: Archive artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ZIP_NAME }}
          path: |
            fonts
            out
      - name: Archive npm release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: geist-font-fonts-npm
          path: |
            geist-font.zip
            packages/next/dist/fonts
    outputs:
      zip_name: ${{ env.ZIP_NAME }}

  deploy:
    name: Deploy results to GitHub Pages
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: build
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4

  # There are two ways a release can be created: either by pushing a tag, or by
  # creating a release from the GitHub UI. Pushing a tag does not automatically
  # create a release, so we have to do that ourselves. However, creating a
  # release from the GitHub UI *does* push a tag, and we don't want to create
  # a new release in that case because one already exists!

  release:
    name: Release bundle
    if: contains(github.ref, 'refs/tags/')
    needs: build
    runs-on: ubuntu-latest
    env:
      ZIP_NAME: ${{ needs.build.outputs.zip_name }}
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@v6
      - name: Use font artifacts from CI
        uses: actions/download-artifact@v5
        with:
          name: ${{ env.ZIP_NAME }}
          path: ${{ env.ZIP_NAME }}
      - name: Copy ARTICLE.en_us.html to release directory
        run: cp documentation/ARTICLE.en_us.html ${{ env.ZIP_NAME }}/ARTICLE.en_us.html
        continue-on-error: true
      - name: Copy OFL.txt to release directory
        run: cp OFL.txt ${{ env.ZIP_NAME }}/OFL.txt
      - name: Remove proof/test outputs from release
        run: rm -rf ${{ env.ZIP_NAME }}/out
      - name: Set release file name
        shell: bash
        run: echo "RELEASE_ZIP_NAME=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')-${{github.ref_name}}" >> $GITHUB_ENV
      - name: Create release bundle
        run: mv ${{ env.ZIP_NAME }} ${{ env.RELEASE_ZIP_NAME }}; zip -r ${{ env.RELEASE_ZIP_NAME }}.zip ${{ env.RELEASE_ZIP_NAME }}
      - name: Check for release
        id: create_release
        run: |
          if ! gh release view ${{ github.ref_name }}; then
          git show -s --format=%B ${{ github.ref_name }} | tail -n +4 | gh release create ${{ github.ref_name }} -t ${{ github.ref_name }} -F -
          fi
      - name: Populate release
        run: |
          gh release upload ${{ github.ref_name }} ${{ env.RELEASE_ZIP_NAME }}.zip --clobber
      - name: Set release live
        run: |
          gh release edit ${{ github.ref_name }} --draft=false

  release-npm:
    name: Release packages
    needs: build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    # contents: write    -> let changesets/action push tags via the GitHub API
    # pull-requests: write -> let changesets/action open the "Version Packages" PR
    # id-token: write    -> required for npm Trusted Publishing (OIDC)
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Download npm artifacts
        uses: actions/download-artifact@v5
        with:
          name: geist-font-fonts-npm
          path: ./artifacts

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      # npm Trusted Publishing requires npm CLI >= 11.5.1; Node 22.x ships with npm 10.x
      - name: Install npm 11
        run: npm install -g npm@11.14.1

      # Hardcoded because we know it works, it would be fine to try to upgrade
      - name: 'Install corepack@0.31'
        shell: bash
        run: |
          npm install -g corepack@0.31
          echo "corepack version after: $(corepack --version)"

      - name: Enable Corepack
        run: corepack enable

      - name: Install dependencies
        working-directory: packages/next
        run: pnpm install --frozen-lockfile

      - name: Move the font files for npm from build artifacts to the npm package
        run: |
          rm -rf packages/next/dist/fonts
          mv artifacts/packages/next/dist/fonts packages/next/dist/fonts

      - name: Create Release Pull Request or Publish
        id: changesets
        uses: changesets/action@v1.8.0
        with:
          publish: pnpm run release
          version: pnpm run version
          cwd: packages/next
          title: "changesets: update versions of packages for release"
          # Sign the "Version Packages" PR commit with GitHub's GPG key
          commitMode: github-api
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # This will upload the font zip and attach it to the existing github release for the npm package,
      # allowing users to download just the font zip files without the source code of the npm package.
      - name: Upload font zip to GitHub Release
        if: steps.changesets.outputs.published == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION=$(jq -r '.version' packages/next/package.json)
          mv artifacts/geist-font.zip "geist-font-v$VERSION.zip"
          gh release upload "v$VERSION" "geist-font-v$VERSION.zip" --clobber