main.yml

name: Main

on:
  push:
    branches:
      - main
  pull_request:
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ !contains(github.ref, 'refs/heads/main') }}

jobs:
  check-skip-merge-queue:
    name: Check if pull request can skip merge queue
    runs-on: ubuntu-latest
    outputs:
      skip-merge-queue: ${{ steps.check-skip-merge-queue.outputs.up-to-date }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        if: github.event_name == 'merge_group'

      - name: Check pull request merge queue status
        id: check-skip-merge-queue
        if: github.event_name == 'merge_group'
        uses: MetaMask/github-tools/.github/actions/check-skip-merge-queue@v1

  check-workflows:
    name: Check workflows
    runs-on: ubuntu-latest
    needs: check-skip-merge-queue
    if: github.event_name != 'merge_group' || needs.check-skip-merge-queue.outputs.skip-merge-queue != 'true'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Download actionlint
        id: download-actionlint
        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) 1.7.7
        shell: bash
      - name: Check workflow files
        run: ${{ steps.download-actionlint.outputs.executable }} -color
        shell: bash

  analyse-code:
    name: Analyse code
    needs: check-workflows
    uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@v2
    with:
      scanner-ref: v2
      paths-ignored: |
        .storybook/
        **/__snapshots__/
        **/*.snap
        **/*.stories.js
        **/*.stories.tsx
        **/*.test.browser.ts*
        **/*.test.js*
        **/*.test.ts*
        **/fixtures/
        **/__fixtures__/
        **/jest.config.js
        **/jest.environment.js
        **/mocks/
        **/__mocks__/
        **/test*/
        docs/
        e2e/
        merged-packages/
        node_modules/
        storybook/
        test*/
    secrets:
      project-metrics-token: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
      slack-webhook: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}
    permissions:
      actions: read
      contents: read
      security-events: write

  update-pull-request:
    name: Update pull request
    needs: check-workflows
    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' && github.actor != 'metamaskbot' }}
    uses: ./.github/workflows/update-pull-request.yml
    with:
      dependabot: true
      pull-request: ${{ github.event.pull_request.number }}
      pull-request-title: ${{ github.event.pull_request.title }}
    secrets:
      PULL_REQUEST_UPDATE_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}

  lint-build-test:
    name: Build, lint, and test
    needs: check-workflows
    uses: ./.github/workflows/build-lint-test.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  is-release:
    name: Determine whether this is a release merge commit
    needs: lint-build-test
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    outputs:
      IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
    steps:
      - id: is-release
        uses: MetaMask/action-is-release@v2
        with:
          commit-starts-with: 'Release [version],Release `[version]`,release: [version],release: `[version]`'

  publish-release:
    name: Publish release
    needs: is-release
    if: needs.is-release.outputs.IS_RELEASE == 'true'
    permissions:
      id-token: write
      contents: write
    uses: ./.github/workflows/publish-release.yml
    with:
      slack-subteam: S05RL9W7H54 # @metamask-snaps-publishers
    secrets:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      PUBLISH_PAGES_TOKEN: ${{ secrets.PUBLISH_PAGES_TOKEN }}
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  all-jobs-complete:
    name: All jobs complete
    runs-on: ubuntu-latest
    needs:
      - analyse-code
      - lint-build-test
    outputs:
      passed: ${{ steps.set-output.outputs.passed }}
    steps:
      - name: Set passed output
        id: set-output
        run: echo "passed=true" >> "$GITHUB_OUTPUT"

  all-jobs-pass:
    name: All jobs pass
    if: ${{ always() }}
    runs-on: ubuntu-latest
    needs:
      - all-jobs-complete
      - check-skip-merge-queue
    steps:
      - name: Check that all jobs have passed
        env:
          PASSED: ${{ needs.all-jobs-complete.outputs.passed == 'true' || needs.check-skip-merge-queue.outputs.skip-merge-queue == 'true' }}
        run: |
          if [[ "$PASSED" != "true" ]]; then
            exit 1
          fi