pull-request.yml

name: Build and Deploy

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

jobs:
  build:
    name: Build with Node.js
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [24.x, 26.x]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: "npm"

      - run: npm ci
      - run: npm run build
      - run: npm run coverage

  sonarqube:
    name: SonarQube Analysis
    needs: build
    runs-on: ubuntu-latest

    if: ${{ github.actor != 'dependabot[bot]' }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24.x
          cache: "npm"

      - run: npm ci && npm run build && npm run coverage

      - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  docker:
    name: Docker Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: false

  deploy:
    name: Deploy to Cloudflare Pages
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

      # Only deploy for PRs created by non-dependabot users from the main repository (not forks)
    if: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false }}
    outputs:
      deployment-url: ${{ steps.deploy.outputs.deployment-url }}
      alias-url: ${{ steps.deploy.outputs.pages-deployment-alias-url }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24.x
          cache: "npm"

      - run: npm ci && npm run build-artifact

      - name: Get branch names
        id: branch-names
        uses: tj-actions/branch-names@5250492686b253f06fa55861556d1027b067aeb5 # v9.0.2

      - name: Prepare deployment with different configuration
        run: |
          sed -i 's|useDynamicContentInTitle: false,|useDynamicContentInTitle: true,|' packages/pxweb2/dist/config/config.js

      - name: Deploy
        id: deploy
        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: |
            pages deploy --branch=${{ steps.branch-names.outputs.current_branch }}

      - name: Prepare alternative deployment with different configuration
        run: |
          mkdir dist
          cp -r packages/pxweb2/dist dist/statbank
          mv dist/statbank/_headers dist/
          mv dist/statbank/index.html dist/
          mv dist/statbank/icons/topicIconMapNO.json dist/statbank/icons/topicIconMap.json
          echo "/ /statbank/ 301" > dist/_redirects
          curl -s -o dist/statbank/config/config.js https://www.ssb.no/statbank/config/config.js
          sed -i 's|<base href="/"|<base href="/statbank/"|' dist/index.html

      - name: Alternative Deploy
        id: alt-deploy
        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: |
            pages deploy dist --branch=alternative-${{ steps.branch-names.outputs.current_branch }}

      - name: Add deployment info to PR description
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          DEPLOY_URL: ${{ steps.deploy.outputs.deployment-url }}
          DEPLOY_ALIAS_URL: ${{ steps.deploy.outputs.pages-deployment-alias-url }}
          ALT_DEPLOY_URL: ${{ steps.alt-deploy.outputs.deployment-url }}
          ALT_DEPLOY_ALIAS_URL: ${{ steps.alt-deploy.outputs.pages-deployment-alias-url }}
        run: |
          set -euo pipefail

          for required_var in REPO PR_NUMBER DEPLOY_URL DEPLOY_ALIAS_URL ALT_DEPLOY_URL ALT_DEPLOY_ALIAS_URL; do
            if [ -z "${!required_var}" ]; then
              echo "::error::Missing required value: ${required_var}"
              exit 1
            fi
          done

          comment_body="$(printf '%s\n' \
            '## Branch Deployment to Cloudflare Pages' \
            ":articulated_lorry: Preview URL: ${DEPLOY_URL}" \
            ":construction: Branch preview URL: ${DEPLOY_ALIAS_URL}" \
            ":truck: Alternative Preview URL: ${ALT_DEPLOY_URL}" \
            ":construction_worker: Alternative Branch preview URL: ${ALT_DEPLOY_ALIAS_URL}")"

          gh pr comment "${PR_NUMBER}" \
            --repo "${REPO}" \
            --body "$comment_body" \
            --edit-last \
            --create-if-none

  test:
    name: Run Mabl tests
    needs: deploy
    runs-on: ubuntu-latest

    if: ${{ github.event.pull_request.draft == false && github.actor != 'dependabot[bot]' }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Regression test against feature branch
        id: mabl-test-deployment
        uses: mablhq/github-run-tests-action@e46db148f0124be267acff561cd4d9303375852a # v1.16
        env:
          # Use a "CI/CD Integration" type of mabl API key
          MABL_API_KEY: ${{ secrets.MABL_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          plan-labels: |
            PxWeb 2.0 Regression Test
          browser-types: |
            firefox
          application-id: ${{ secrets.MABL_APPLICATION_ID}}
          environment-id: ${{ secrets.MABL_ENVIRONMENT_ID}}
          app-url: ${{needs.deploy.outputs.deployment-url}}