perf.yml

name: Performance Tracking

on:
  push:
    branches:
      - main

permissions:
  contents: 'read'
  id-token: 'write'

defaults:
  run:
    shell: bash

jobs:
  list:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    outputs:
      workflows: ${{ steps.workflows.outputs.workflows }}
    steps:
      # Because the checkout and setup node action is contained in the dev-infra repo, we must
      # checkout the repo to be able to run the action we have created.  Other repos will skip
      # this step.
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./github-actions/npm/checkout-and-setup-node
      - uses: ./github-actions/bazel/setup
      - run: pnpm install --frozen-lockfile
      - id: workflows
        run: echo "workflows=$(pnpm --silent ng-dev perf workflows --list)" >> "$GITHUB_OUTPUT"

  workflow:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    needs: list
    strategy:
      matrix:
        workflow: ${{ fromJSON(needs.list.outputs.workflows) }}
    steps:
      # Because the checkout and setup node action is contained in the dev-infra repo, we must
      # checkout the repo to be able to run the action we have created.  Other repos will skip
      # this step.
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./github-actions/npm/checkout-and-setup-node
      - uses: ./github-actions/bazel/setup
      - run: pnpm install --frozen-lockfile
      # We utilize the google-github-actions/auth action to allow us to get an active credential using workflow
      # identity federation. This allows us to request short lived credentials on demand, rather than storing
      # credentials in secrets long term. More information can be found at:
      # https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform
      - uses: 'google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed' # v2.1.13
        with:
          project_id: 'internal-200822'
          workload_identity_provider: 'projects/823469418460/locations/global/workloadIdentityPools/measurables-tracking/providers/angular'
          service_account: 'measures-uploader@internal-200822.iam.gserviceaccount.com'
      - run: pnpm ng-dev perf workflows --name ${{ matrix.workflow }} --commit-sha ${{github.sha}}