ci.yml

name: CI
on:
  push:
    branches: [main]
  pull_request:
  pull_request_target:
    types: [labeled]
  workflow_dispatch:

jobs:
  build-and-deploy:
    if: >-
      github.event_name != 'pull_request_target'
      || contains(github.event.pull_request.labels.*.name, 'trusted')
    runs-on: ubuntu-latest
    permissions:
      deployments: write
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          fetch-depth: 0
          persist-credentials: false
          # Empty on push/workflow_dispatch — falls back to default ref
          ref: "${{ github.event.pull_request.merge_commit_sha }}"

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: "24"
          cache: "pnpm"

      - name: Install
        id: install
        run: |
          pnpm install --frozen-lockfile

      - name: Commit lockfile
        if: ${{ env.IS_DEPENDABOT == 1 }}
        uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321
        with:
          add: "pnpm-lock.yaml"
          fetch: false
          github_token: "${{ github.token }}"
          message: "Update lockfile"

      - name: Generate types
        run: pnpm astro sync
        env:
          OG_IMAGE_SECRET: ${{ (github.event.pull_request.head.repo.fork == true || github.actor == 'dependabot[bot]') && 'placeholder' || secrets.OG_IMAGE_SECRET }}

      - name: Run linter
        run: pnpm lint --quiet

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build
        env:
          # Falls back only for fork PRs and dependabot runs, which can't read secrets.
          OG_IMAGE_SECRET: ${{ (github.event.pull_request.head.repo.fork == true || github.actor == 'dependabot[bot]') && 'placeholder' || secrets.OG_IMAGE_SECRET }}

      - name: Install Playwright system deps
        run: pnpm exec playwright install-deps chromium
        timeout-minutes: 5
        env:
          DEBIAN_FRONTEND: noninteractive
          NEEDRESTART_MODE: a

      - name: Install Playwright browsers
        run: pnpm exec playwright install chromium
        timeout-minutes: 5

      - name: Run tests
        id: test
        run: pnpm test

      - name: Upload Playwright report
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7

      - name: Deploy Production to Vercel
        if: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == 'main' }}
        run:
          node .github/scripts/deploy.mjs --token=${{ secrets.VERCEL_TOKEN }}
          --prod

      - name: Deploy Preview to Vercel
        if:
          ${{ github.event_name != 'push' && github.event_name != 'workflow_dispatch' &&
          ((!github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]') ||
          (github.event_name == 'pull_request_target' &&
          contains(github.event.pull_request.labels.*.name, 'trusted'))) }}
        run: node .github/scripts/deploy.mjs --token=${{ secrets.VERCEL_TOKEN }}

      - name: Create GitHub Preview Deployment
        if:
          ${{ github.event_name != 'push' && github.event_name != 'workflow_dispatch' &&
          ((!github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]') ||
          (github.event_name == 'pull_request_target' &&
          contains(github.event.pull_request.labels.*.name, 'trusted'))) }}
        uses: chrnorm/deployment-action@500aa6a23c81ffa1acf71072aee3cfa2cc2e556a
        with:
          token: "${{ github.token }}"
          environment-url: https://${{ env.DEPLOYMENT_ALIAS }}
          environment: Preview
          production-environment: false
          initial-status: success
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Create GitHub Production Deployment
        if: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == 'main' }}
        uses: chrnorm/deployment-action@500aa6a23c81ffa1acf71072aee3cfa2cc2e556a
        with:
          token: "${{ github.token }}"
          environment-url: https://${{ env.PRODUCTION_HOSTNAME }}
          environment: Production
          production-environment: true
          initial-status: success
    outputs:
      deployment: ${{ env.DEPLOYMENT_ALIAS || env.PRODUCTION_HOSTNAME }}

  lighthouse:
    needs: build-and-deploy
    runs-on: ubuntu-latest
    if:
      ${{ (!github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]') ||
      (github.event_name == 'pull_request_target' &&
      contains(github.event.pull_request.labels.*.name, 'trusted')) }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          persist-credentials: false
      - name: Audit URLs
        uses: treosh/lighthouse-ci-action@3e7e23fb74242897f95c0ba9cabad3d0227b9b18
        with:
          urls: |
            https://${{ needs.build-and-deploy.outputs.deployment }}/
            https://${{ needs.build-and-deploy.outputs.deployment }}/features/asides/
            https://${{ needs.build-and-deploy.outputs.deployment }}/features/shiki-twoslash/
          budgetPath: ".github/lighthouse-budget.json"
          uploadArtifacts: true
          temporaryPublicStorage: true

  remove-trusted-label:
    needs: lighthouse
    runs-on: ubuntu-latest
    if: always() && contains(github.event.pull_request.labels.*.name, 'trusted')
    steps:
      - name: Remove trusted label
        run: |
          gh api /repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/trusted -X DELETE
        env:
          GITHUB_TOKEN: "${{ github.token }}"

env:
  VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
  VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
  IS_DEPENDABOT: ${{ secrets.IS_DEPENDABOT }}
  REF_NAME: "${{ github.head_ref || github.ref_name }}"
  PRODUCTION_HOSTNAME: zaduma.vercel.app