test-build.yml

name: Test and Build

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

concurrency:
  # https://stackoverflow.com/a/72408109
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}

env:
  python-version-file: ".python-version"
  node-version-file: ".nvmrc"
  RUN_ALL_TESTS: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}

permissions: {}

jobs:
  set-build-info:
    runs-on: ubuntu-latest
    outputs:
      branch: ${{ steps.build-info.outputs.branch }}
      trigger-sha: ${{ steps.build-info.outputs.trigger-sha }}
      head-sha: ${{ steps.build-info.outputs.head-sha }}
      pr-number: ${{ steps.build-info.outputs.pr-number }}
    steps:
      - name: Save build info (pull_request)
        if: github.event_name == 'pull_request'
        run: |
          echo "${{ github.event.pull_request.head.ref }}" > branch
          echo "${{ github.event.pull_request.head.sha }}" > head-sha
          echo "${{ github.sha }}" > trigger-sha
          echo "${{ github.event.pull_request.number }}" > pr-number
      - name: Save build info (push, branch)
        if: github.event_name == 'push' && github.ref_type == 'branch'
        run: |
          echo "${{ github.ref_name }}" > branch
          echo "${{ github.sha }}" > head-sha
          echo "${{ github.sha }}" > trigger-sha
          echo "" > pr-number
      - name: Output build info
        id: build-info
        run: |
          echo "branch=$(cat branch)" >> $GITHUB_OUTPUT
          echo "trigger-sha=$(cat trigger-sha)" >> $GITHUB_OUTPUT
          echo "head-sha=$(cat head-sha)" >> $GITHUB_OUTPUT
          echo "pr-number=$(cat pr-number)" >> $GITHUB_OUTPUT
      - name: Upload build info
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: build-info
          path: |
            branch
            head-sha
            trigger-sha
            pr-number

  changesets:
    if: ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          submodules: true
          # `fetch-depth: 0` is required to create tags for new releases by Changesets.
          fetch-depth: 0
          # `persist-credentials: false` is important not only for security reasons
          # but also to ensure that `git push --follow-tags` run by the Changesets action in the later step
          # don't use the default GITHUB_TOKEN, which doesn't trigger other workflows such as the release workflow.
          # Ref: https://github.com/orgs/community/discussions/26220
          persist-credentials: false

      - uses: ./.github/actions/init-all
        with:
          node-version-file: ".nvmrc"
          protoc: false

      - name: Generate a token
        id: generate-token
        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
        with:
          app-id: ${{ vars.CHANGESETS_APP_ID }}
          private-key: ${{ secrets.CHANGESETS_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

      - name: Create Release Pull Request or Tag
        id: changesets
        uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1.5.3
        with:
          publish: npm run changeset:release
        env:
          # PRs created using `GITHUB_TOKEN` doesn't trigger CI workflows, so we need to use a PAT or app token.
          # - The PAT should be fine-grained and its permissions are properly configured (R/W for Contents and Pull Requests).
          # - The app token should be generated using a GitHub App that has proper permissions (R/W for Contents and Pull Requests).
          # Ref: https://github.com/orgs/community/discussions/55906
          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          # GITHUB_TOKEN: ${{ secrets.CHANGESETS_PAT }}

      - name: Save published packages info
        if: steps.changesets.outputs.published == 'true'
        run: echo '${{ steps.changesets.outputs.publishedPackages }}' > changesets-published-packages

      - name: Upload published packages info
        if: steps.changesets.outputs.published == 'true'
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: changesets-published-packages
          path: changesets-published-packages

  changes:  # See https://github.com/dorny/paths-filter#examples
    runs-on: ubuntu-latest
    outputs:
      common: ${{ steps.filter.outputs.common == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
      kernel: ${{ steps.filter.outputs.kernel == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
      # stlite-lib: ${{ steps.filter.outputs.stlite-lib == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
      stlite-lib: 'true'  # This step does not detect changes in the `streamlit` submodule that is needed to trigger the test-stlite-lib job (https://github.com/dorny/paths-filter/issues/143), so skip checking and make it always return true as a workaround.
      react: ${{ steps.filter.outputs.react == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
      browser: ${{ steps.filter.outputs.browser == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
      sharing: ${{ steps.filter.outputs.sharing == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
      sharing-editor: ${{ steps.filter.outputs.sharing-editor == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
      sharing-common: ${{ steps.filter.outputs.sharing-common == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
      desktop: ${{ steps.filter.outputs.desktop == 'true' || steps.filter.outputs.gha == 'true' || env.RUN_ALL_TESTS == 'true' }}
    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        persist-credentials: false
    - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
      id: filter
      with:
        filters: |
          gha:
            - '.github/workflows/**/*'
            - '.github/actions/**/*'
          common:
            - 'packages/common/**/*'
          kernel:
            - 'packages/kernel/**/*'
            # - '!packages/kernel/py/**/*'  # Not supported by paths-filter now: https://github.com/dorny/paths-filter/issues/106
          # stlite-lib:  # We run this job anytime. See above.
          #   - 'packages/kernel/py/stlite-lib/**/*'
          #   - 'streamlit/**/*'
          react:
            - 'packages/react/**/*'
          browser:
            - 'packages/browser/**/*'
          sharing:
            - 'packages/sharing/**/*'
          sharing-editor:
            - 'packages/sharing-editor/**/*'
          sharing-common:
            - 'packages/sharing-common/**/*'
          desktop:
            - 'packages/desktop/**/*'

  test-build-common:
    needs: changes
    if: ${{ needs.changes.outputs.common == 'true' }}

    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: packages/common

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false

    - uses: ./.github/actions/init-all
      with:
        node-version-file: ${{ env.node-version-file }}
        protoc: false

    - name: Lint
      run: |
        yarn check:eslint
        yarn check:prettier
    - run: yarn test
    - run: yarn build

  test-kernel:
    needs: changes
    if: ${{ needs.changes.outputs.kernel == 'true' }}

    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: packages/kernel

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        python-version-file: ${{ env.python-version-file }}
        node-version-file: ${{ env.node-version-file }}

    - name: Lint
      run: |
        yarn check:eslint
        yarn check:prettier

    - run: make kernel-test
      working-directory: .

  test-stlite-lib:
    needs: changes
    if: ${{ needs.changes.outputs.stlite-lib == 'true' }}

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        python-version-file: ${{ env.python-version-file }}
        node-version-file: ${{ env.node-version-file }}

    - name: Install dependencies
      shell: bash
      run: |
        . .venv/bin/activate
        cd packages/kernel/py/stlite-lib
        uv sync

    - name: Set up Streamlit and build proto
      run: |
        . .venv/bin/activate
        make streamlit-proto

    - name: Run Ruff
      run: |
        . .venv/bin/activate
        cd packages/kernel/py/stlite-lib
        uv run ruff check --output-format=github .
        uv run ruff format . --check

    - name: Run pyright
      run: |
        . .venv/bin/activate
        cd packages/kernel/py/stlite-lib
        uv run pyright

    - name: Run pytest
      shell: bash
      run: |
        . .venv/bin/activate
        cd packages/kernel/py/stlite-lib
        uv run pytest -v

  test-browser:
    needs: changes
    if: ${{ needs.changes.outputs.browser == 'true' }}

    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: packages/browser

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        python-version-file: ${{ env.python-version-file }}
        node-version-file: ${{ env.node-version-file }}

    - name: Lint
      run: |
        yarn check:eslint
        yarn check:prettier
    - run: yarn test

  test-react:
    needs: changes
    if: ${{ needs.changes.outputs.react == 'true' }}

    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: packages/react

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        python-version-file: ${{ env.python-version-file }}
        node-version-file: ${{ env.node-version-file }}

    - name: Lint
      run: |
        yarn check:eslint
        yarn check:prettier
    - run: yarn test

  test-sharing:
    needs: changes
    if: ${{ needs.changes.outputs.sharing == 'true' }}

    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: packages/sharing

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false

    - uses: ./.github/actions/init-all
      with:
        node-version-file: ${{ env.node-version-file }}
        protoc: false

    - name: Lint
      run: |
        yarn check:eslint
        yarn check:prettier
    # - run: yarn test

  test-sharing-editor:
    needs: changes
    if: ${{ needs.changes.outputs.sharing-editor == 'true' }}

    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: packages/sharing-editor

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        node-version-file: ${{ env.node-version-file }}

    - run: make sharing-common
      working-directory: .

    - name: Lint
      run: |
        yarn check:eslint
        yarn check:prettier
    - run: yarn test

  test-sharing-common:
    needs: changes
    if: ${{ needs.changes.outputs.sharing-common == 'true' }}

    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: packages/sharing-common

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        node-version-file: ${{ env.node-version-file }}

    - name: Lint
      run: |
        yarn check:eslint
        yarn check:prettier
    - run: yarn build:proto
    - run: yarn test

  test-desktop:
    needs: changes
    if: ${{ needs.changes.outputs.desktop == 'true' }}

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]  # The desktop package contains OS-dependent file paths manipulations differing between POSIX and Windows.

    runs-on: ${{ matrix.os }}

    defaults:
      run:
        working-directory: packages/desktop

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false

    - uses: ./.github/actions/init-all
      with:
        node-version-file: ${{ env.node-version-file }}
        protoc: false

    - name: Lint
      if: ${{ matrix.os == 'ubuntu-latest' }}  # The glob pattern passed to ESLint is hardcoded as POSIX, so it does not work on Windows.
      run: |
        yarn check:eslint
        yarn check:prettier
    - run: yarn test

  build-browser:
    if: ${{ ! failure() }}  # This job should run even if the depending jobs are skipped, but not when those jobs failed: https://qiita.com/abetomo/items/d9ede7dbeeb24f723fc5#%E8%A8%AD%E5%AE%9A%E4%BE%8B4
    needs: [set-build-info, build-react, test-kernel, test-stlite-lib, test-build-common, test-browser]

    runs-on: ubuntu-latest

    permissions:
      pull-requests: write
      id-token: write
      attestations: write

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        python-version-file: ${{ env.python-version-file }}
        node-version-file: ${{ env.node-version-file }}

    - name: Download build cache for @stlite/react dependents
      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
      with:
        name: stlite-react-build-cache
        path: artifacts/react

    - name: Restore cached builds for dependencies
      run: |
        tar -xzf artifacts/react/react-build-cache.tar.gz
        touch .make/common/.built .make/kernel/.built .make/streamlit-frontend-lib/.built .make/react/.built

    # PUBLIC_URL here is set as a relative path, which is possible to the trick introduced at https://github.com/whitphx/stlite/pull/143.
    - name: Set PUBLIC_URL
      run: echo "PUBLIC_URL=." >> $GITHUB_ENV
    - name: Build @stlite/browser
      run: |
        . .venv/bin/activate
        make browser

    - name: Upload bundle visualizer report (@stlite/browser)
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/browser/stats/browser.html
        name: visualizer-browser
        if-no-files-found: error

    - name: Package
      working-directory: packages/browser
      run: yarn pack

    - name: Upload the built tar ball as an artifact
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/browser/package.tgz
        name: stlite-browser

    - name: Generate artifact attestation
      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
      with:
        subject-path: packages/browser/package.tgz
      # This step may fail when the PR is created by an external contributor and the CI is run in their scope.
      # We can ignore such failures because the following jobs such as E2E-testing in the post-build workflow don't necessarily need the attestation,
      # while the verification is done when publishing the artifact.
      continue-on-error: true

    - name: "Inform the package stats of @stlite/browser"
      uses: ./.github/actions/set-package-stats
      continue-on-error: true
      with:
        key: browser
        name: "@stlite/browser"
        input-path: packages/browser/package.tgz

    # Also get stats of the built wheel files of stlite-lib and streamlit in this job.
    - name: Get the built wheel file path
      id: get-wheel-file-path
      run: |
        pushd packages/kernel/py/stlite-lib/dist
        echo "STLITE_LIB_WHEEL_FILEPATH=$(find $(pwd) -name "stlite_lib-*-py3-none-any.whl" -print -quit)" >> $GITHUB_OUTPUT
        popd
        pushd packages/kernel/py/streamlit/lib/dist
        echo "STREAMLIT_WHEEL_FILEPATH=$(find $(pwd) -name "streamlit-*.whl" -print -quit)" >> $GITHUB_OUTPUT
        popd
    - name: "Inform the package stats of stlite-lib wheel"
      uses: ./.github/actions/set-package-stats
      continue-on-error: true
      with:
        key: stlite-lib-wheel
        name: "stlite-lib wheel (built as a part of @stlite/browser)"
        input-path: ${{ steps.get-wheel-file-path.outputs.STLITE_LIB_WHEEL_FILEPATH }}
    - name: "Inform the package stats of streamlit wheel"
      uses: ./.github/actions/set-package-stats
      continue-on-error: true
      with:
        key: streamlit-wheel
        name: "streamlit wheel (built as a part of @stlite/browser)"
        input-path: ${{ steps.get-wheel-file-path.outputs.STREAMLIT_WHEEL_FILEPATH }}

  build-react:
    if: ${{ ! failure() }}  # This job should run even if the depending jobs are skipped, but not when those jobs failed.
    needs: [set-build-info, test-kernel, test-stlite-lib, test-build-common, test-react]

    runs-on: ubuntu-latest

    permissions:
      pull-requests: write
      id-token: write
      attestations: write

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        python-version-file: ${{ env.python-version-file }}
        node-version-file: ${{ env.node-version-file }}

    - name: Build @stlite/react
      run: |
        . .venv/bin/activate
        make react

    - name: Package
      working-directory: packages/react
      run: yarn pack

    - name: Upload the built tar ball as an artifact
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/react/package.tgz
        name: stlite-react

    - name: Generate artifact attestation
      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
      with:
        subject-path: packages/react/package.tgz
      continue-on-error: true

    - name: "Inform the package stats of @stlite/react"
      uses: ./.github/actions/set-package-stats
      continue-on-error: true
      with:
        key: react
        name: "@stlite/react"
        input-path: packages/react/package.tgz

    - name: Archive build cache for dependents
      run: |
        tar -czf react-build-cache.tar.gz \
          .make/common/.built \
          .make/kernel/.built \
          .make/react/.built \
          .make/streamlit-frontend-lib/.built \
          packages/common/dist \
          packages/kernel/dist \
          packages/kernel/py/stlite-lib/dist \
          packages/kernel/py/streamlit/lib/dist \
          packages/react/build \
          packages/react/vite-plugin/dist \
          streamlit/frontend/connection/dist \
          streamlit/frontend/protobuf/proto.d.ts \
          streamlit/frontend/utils/dist

    - name: Upload build cache for dependents
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: react-build-cache.tar.gz
        name: stlite-react-build-cache

  build-sharing:
    if: ${{ ! failure() }}  # This job should run even if the depending jobs are skipped, but not when those jobs failed: https://qiita.com/abetomo/items/d9ede7dbeeb24f723fc5#%E8%A8%AD%E5%AE%9A%E4%BE%8B4
    needs: [set-build-info, build-react, test-kernel, test-stlite-lib, test-sharing-common, test-sharing]

    runs-on: ubuntu-latest

    permissions:
      pull-requests: write

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false

    - uses: ./.github/actions/init-all
      with:
        python-version-file: ${{ env.python-version-file }}
        node-version-file: ${{ env.node-version-file }}

    - name: Download build cache for @stlite/react dependents
      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
      with:
        name: stlite-react-build-cache
        path: artifacts/react

    - name: Restore cached builds for dependencies
      run: |
        tar -xzf artifacts/react/react-build-cache.tar.gz
        touch .make/common/.built .make/kernel/.built .make/streamlit-frontend-lib/.built .make/react/.built
    ## Build and upload @stlite/sharing
    - name: Set EDITOR_APP_ORIGIN (preview)
      if: ${{ needs.set-build-info.outputs.branch != github.event.repository.default_branch }}
      run: echo "EDITOR_APP_ORIGIN_REGEX=^https://[a-z0-9-]+\.stlite-sharing-editor\.pages\.dev$" >> $GITHUB_ENV
    - name: Set EDITOR_APP_ORIGIN (main branch)
      if: ${{ needs.set-build-info.outputs.branch == github.event.repository.default_branch }}
      run: echo "EDITOR_APP_ORIGIN=https://edit.share.stlite.net" >> $GITHUB_ENV
    - name: Build @stlite/sharing
      run: |
        . .venv/bin/activate
        make sharing

    - name: Upload bundle visualizer report (@stlite/sharing)
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/sharing/stats/sharing.html
        name: visualizer-sharing
        if-no-files-found: error

    - name: Upload the built directory as an artifact
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/sharing/build
        name: stlite-sharing

    - name: "Inform the package stats"
      uses: ./.github/actions/set-package-stats
      continue-on-error: true
      with:
        key: sharing
        name: "stlite sharing"
        input-path: packages/sharing/build

  build-sharing-editor:
    if: ${{ ! failure() }}  # This job should run even if the depending jobs are skipped, but not when those jobs failed: https://qiita.com/abetomo/items/d9ede7dbeeb24f723fc5#%E8%A8%AD%E5%AE%9A%E4%BE%8B4
    needs: [set-build-info, test-build-common, test-sharing-editor, test-sharing-common]

    runs-on: ubuntu-latest

    permissions:
      pull-requests: write

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: recursive
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        node-version-file: ${{ env.node-version-file }}

    - name: Set build option envvar for the preview build
      if: ${{ needs.set-build-info.outputs.branch != github.event.repository.default_branch }}
      run: echo "RESOLVE_SHARING_APP_URL_RUNTIME_FROM_EXTERNAL_FILE=true" >> $GITHUB_ENV
    - name: Set SHARING_APP_URL (main branch)
      if: ${{ needs.set-build-info.outputs.branch == github.event.repository.default_branch }}
      run: echo "SHARING_APP_URL=https://share.stlite.net/" >> $GITHUB_ENV
    - run: make sharing-editor

    - name: Upload bundle visualizer report (@stlite/sharing-editor)
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/sharing-editor/stats/sharing-editor.html
        name: visualizer-sharing-editor
        if-no-files-found: error

    - name: Upload the built directory as an artifact
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/sharing-editor/dist
        name: stlite-sharing-editor

    - name: "Inform the package stats"
      uses: ./.github/actions/set-package-stats
      continue-on-error: true
      with:
        key: sharing-editor
        name: "stlite sharing editor"
        input-path: packages/sharing-editor/dist

  build-desktop:
    if: ${{ ! failure() }}  # This job should run even if the depending jobs are skipped, but not when those jobs failed: https://qiita.com/abetomo/items/d9ede7dbeeb24f723fc5#%E8%A8%AD%E5%AE%9A%E4%BE%8B4
    needs: [set-build-info, build-react, test-build-common, test-kernel, test-stlite-lib, test-desktop]

    runs-on: ubuntu-latest

    permissions:
      pull-requests: write
      id-token: write
      attestations: write

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        submodules: true
        persist-credentials: false
    - uses: ./.github/actions/init-all
      with:
        python-version-file: ${{ env.python-version-file }}
        node-version-file: ${{ env.node-version-file }}

    - name: Download build cache for @stlite/react dependents
      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
      with:
        name: stlite-react-build-cache
        path: artifacts/react

    - name: Restore cached builds for dependencies
      run: |
        tar -xzf artifacts/react/react-build-cache.tar.gz
        touch .make/common/.built .make/kernel/.built .make/streamlit-frontend-lib/.built .make/react/.built

    - name: Build @stlite/desktop
      run: |
        . .venv/bin/activate
        make desktop

    - name: Upload bundle visualizer report (@stlite/desktop)
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/desktop/stats/desktop.html
        name: visualizer-desktop
        if-no-files-found: error

    - name: Package
      working-directory: packages/desktop
      run: yarn pack

    - name: Upload the built tar ball as an artifact
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        path: packages/desktop/package.tgz
        name: stlite-desktop

    - name: Generate artifact attestation
      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
      with:
        subject-path: packages/desktop/package.tgz
      # This step may fail when the PR is created by an external contributor and the CI is run in their scope.
      # We can ignore such failures because the following jobs such as E2E-testing in the post-build workflow don't necessarily need the attestation,
      # while the verification is done when publishing the artifact.
      continue-on-error: true

    - name: "Inform the package stats of @stlite/desktop"
      uses: ./.github/actions/set-package-stats
      continue-on-error: true
      with:
        key: desktop
        name: "@stlite/desktop"
        input-path: packages/desktop/package.tgz