pr.yml

name: Uploady Build

on:
    workflow_dispatch:
    pull_request:
        # `labeled`/`unlabeled` let us trigger an e2e re-run by toggling the
        # "rune2e" label on a PR. Using `pull_request` (NOT `pull_request_target`)
        # keeps untrusted PR code out of the default branch's privileged context,
        # avoiding the cache-poisoning / TOCTOU issues that CodeQL flags for
        # `issue_comment` + `pull_request_target` workflows.
        types:
            - opened
            - synchronize
            - reopened
            - ready_for_review
            - labeled
            - unlabeled
    push:
        branches:
            - master

defaults:
    run:
        shell: bash

permissions:
    contents: read
    pull-requests: read
    actions: read
    checks: read

env:
    RUNE2E_LABEL: rune2e

jobs:
    workflow-gate:
        runs-on: ubuntu-latest
        outputs:
            # Whether the build pipeline should run at all. We ignore `unlabeled`
            # events entirely (nothing to do when a label is removed) and ignore
            # `labeled` events for labels other than the e2e re-run label
            # (to avoid wasteful re-runs on unrelated labels).
            proceed: ${{ steps.gate.outputs.proceed }}
            # Whether this run was triggered specifically by adding the e2e
            # re-run label (used to skip redundant build jobs on label-only runs).
            rune2e_label_added: ${{ steps.gate.outputs.rune2e_label_added }}
            # Whether this is a label-only event (i.e. nothing actually changed
            # on the PR code-wise). Used to skip non-e2e jobs that already ran
            # for the same SHA on the original opened/synchronize event.
            is_label_event: ${{ steps.gate.outputs.is_label_event }}
            # Current PR carries the rune2e label (any pull_request event). When
            # true, prep-e2e and e2e always run, even if watched paths did not change.
            has_rune2e_label: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, env.RUNE2E_LABEL) }}
        steps:
            -   name: Evaluate gate
                id: gate
                env:
                    EVENT_NAME: ${{ github.event_name }}
                    PR_ACTION: ${{ github.event.action }}
                    LABEL_NAME: ${{ github.event.label.name }}
                run: |
                    proceed=true
                    rune2e_label_added=false
                    is_label_event=false

                    if [ "$EVENT_NAME" = "pull_request" ]; then
                      case "$PR_ACTION" in
                        unlabeled)
                          proceed=false
                          ;;
                        labeled)
                          is_label_event=true
                          if [ "$LABEL_NAME" = "$RUNE2E_LABEL" ]; then
                            rune2e_label_added=true
                          else
                            # Some other label was added - nothing to do.
                            proceed=false
                          fi
                          ;;
                      esac
                    fi

                    {
                      echo "proceed=$proceed"
                      echo "rune2e_label_added=$rune2e_label_added"
                      echo "is_label_event=$is_label_event"
                    } >> "$GITHUB_OUTPUT"

    code-changes:
        runs-on: ubuntu-latest
        needs:
            - workflow-gate
        if: needs.workflow-gate.outputs.proceed == 'true'
        outputs:
            IS_CODE_CHANGED: ${{ steps.check-changes.outputs.code_changed }}
        steps:
            -   name: Checkout
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
                with:
                    fetch-depth: 2
            -   name: Check for code changes
                id: check-changes
                run: |
                    if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
                      echo "code_changed=true" >> $GITHUB_OUTPUT
                      exit 0
                    fi

                    if [ "${{ github.event_name }}" == "pull_request" ]; then
                      git fetch origin ${{ github.base_ref }} --depth=1
                      CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}..HEAD)
                    else
                      CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
                    fi

                    echo "Changed files:"
                    echo "$CHANGED_FILES"

                    if echo "$CHANGED_FILES" | grep -q -E '^packages/|^cypress/|^package.json$|^story-helpers/'; then
                      echo "Code changes detected in watched paths"
                      echo "code_changed=true" >> $GITHUB_OUTPUT
                    else
                      echo "No code changes in watched paths"
                      echo "code_changed=false" >> $GITHUB_OUTPUT
                    fi

    prep-e2e:
        runs-on: ubuntu-latest
        needs:
            - workflow-gate
            - code-changes
        if: ${{ needs.workflow-gate.outputs.proceed == 'true' && (needs.code-changes.outputs.IS_CODE_CHANGED == 'true' || needs.workflow-gate.outputs.has_rune2e_label == 'true') }}
        steps:
            -   name: Checkout
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            -   name: Prepare
                uses: ./.github/actions/prepare
                with:
                    with-cypress: true
                    with-frozen: true
            -   name: Install dependencies
                uses: cypress-io/github-action@dace029018fcdf86e0df89a31bc3cfa5b32570d8 # v7.3
                with:
                    runTests: false

    build:
        name: Build Library
        runs-on: ubuntu-latest
        needs:
            - workflow-gate
        # Skip on label-only events: the same SHA already built on the
        # opened/synchronize event, no need to rebuild just because a label
        # was toggled.
        if: ${{ needs.workflow-gate.outputs.proceed == 'true' && needs.workflow-gate.outputs.is_label_event != 'true' }}
        steps:
            -   name: Checkout
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            -   name: Prepare
                uses: ./.github/actions/prepare
                with:
                    with-cypress: true
                    with-frozen: true
            -   name: Build
                run: pnpm build

    bundle:
        name: Create code bundles
        runs-on: ubuntu-latest
        needs:
            - workflow-gate
        if: ${{ needs.workflow-gate.outputs.proceed == 'true' && needs.workflow-gate.outputs.is_label_event != 'true' }}
        permissions:
            pull-requests: write
            contents: write
            actions: read
        steps:
            -   name: Checkout
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            -   name: Prepare
                uses: ./.github/actions/prepare
                with:
                    with-cypress: true
                    with-frozen: true
            -   name: Bundle for Production
                run: |
                    pnpm bundle:prod
            -   name: Cache Bundle Folder
                id: cache-bundle
                uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
                with:
                    path: bundle
                    key: bundle-${{ runner.os }}-${{ hashFiles('bundle/**') }}
            -   name: Bundle Size Check (Overweight)
                uses: yoavniran/overweight@ee294a046ad2637d648b7b9c67e34928c93c7806 # v1
                with:
                    github-token: ${{ secrets.GITHUB_TOKEN }}
                    update-baseline: true
                    report-file: overweight-report.json
                    baseline-protected-branches: "master"
                    comment-on-pr-each-run: true

    sb:
        name: Build Storybook
        runs-on: ubuntu-latest
        needs:
            - workflow-gate
        if: ${{ needs.workflow-gate.outputs.proceed == 'true' && needs.workflow-gate.outputs.is_label_event != 'true' }}
        steps:
            -   name: Checkout
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            -   name: Prepare
                uses: ./.github/actions/prepare
                with:
                    with-cypress: true
                    with-frozen: true
            -   name: build storybook
                run: pnpm sb:build:internal
            -   name: Cache SB Build
                id: cache-sb
                uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
                with:
                    path: .sb-static
                    key: sb-static-${{ hashFiles('lerna.json') }}-${{ github.run_id }}

    lft:
        name: Lint, Flow, Types
        runs-on: ubuntu-latest
        needs:
            - workflow-gate
        if: ${{ needs.workflow-gate.outputs.proceed == 'true' && needs.workflow-gate.outputs.is_label_event != 'true' }}
        steps:
            -   name: Checkout
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            -   name: Prepare
                uses: ./.github/actions/prepare
                with:
                    with-cypress: true
                    with-frozen: true
            -   name: lft
                run: pnpm test:ci

    unit-test:
        name: Unit-Test (Vitest)
        runs-on: ubuntu-latest
        needs:
            - workflow-gate
        if: ${{ needs.workflow-gate.outputs.proceed == 'true' && needs.workflow-gate.outputs.is_label_event != 'true' }}
        environment: "Rpldy-Build"
        permissions:
            contents: read
            pull-requests: write
            checks: write
            actions: read
        steps:
            -   name: Checkout
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            -   name: Prepare
                uses: ./.github/actions/prepare
                with:
                    with-cypress: true
                    with-frozen: true
            -   name: unit-test
                run: pnpm vitest:ci
            -   name: Show Report Coverage
                uses: davelosert/vitest-coverage-report-action@02f3c2e641286b7fa308cd3e430783103ce6103b # v2
            -   name: Test Report
                uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3
                if: success() || failure()
                with:
                    name: Unit-test Report
                    path: reports/junit/js-*.xml
                    reporter: jest-junit
                    badge-title: 'unit tests'
                env:
                    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
            -   name: Upload Coverage (master only)
                uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
                if: ${{ github.ref_name == 'master' }}
                with:
                    token: ${{ secrets.CODECOV_TOKEN }}
                    files: ./coverage/coverage-final.json
                    fail_ci_if_error: true
                    verbose: true

    e2e:
        runs-on: ubuntu-latest
        # DAG: gate → path check → bundle/sb (artifacts) and prep-e2e (deps); e2e
        # restores bundle/sb caches and reuses prep-e2e’s install.
        needs:
            - workflow-gate
            - code-changes
            - bundle
            - sb
            - prep-e2e
        # On a `labeled` event the bundle/sb jobs are skipped (already built on
        # the original opened/synchronize event); skipped status satisfies
        # `needs` since we don't require success() here.
        if: ${{ always() && needs.workflow-gate.outputs.proceed == 'true' && (needs.code-changes.outputs.IS_CODE_CHANGED == 'true' || needs.workflow-gate.outputs.has_rune2e_label == 'true') && needs.prep-e2e.result == 'success' && (needs.bundle.result == 'success' || needs.bundle.result == 'skipped') && (needs.sb.result == 'success' || needs.sb.result == 'skipped') }}
        permissions:
            contents: write
            checks: write
            actions: write
            pull-requests: read
        steps:
            -   name: Checkout
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
                with:
                    fetch-depth: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && 1 || 0 }}

            -   name: Prepare
                uses: ./.github/actions/prepare
                with:
                    with-cypress: true
                    with-frozen: true
            -   name: Restore SB Build Cache
                uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
                with:
                    path: .sb-static
                    key: sb-static-${{ hashFiles('lerna.json') }}-${{ github.run_id }}
                    restore-keys: sb-static-${{ hashFiles('lerna.json') }}-
            -   name: Restore Bundle Cache
                uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
                with:
                    path: bundle
                    key: bundle-${{ runner.os }}-
                    restore-keys: bundle-${{ runner.os }}-
            -   name: Cypress run
                id: cypress-e2e
                uses: cypress-io/github-action@dace029018fcdf86e0df89a31bc3cfa5b32570d8 # v7.3
                with:
                    install: false
                    start: |
                        pnpm sb:serve
                        pnpm bundle:serve
                    wait-on: 'http://127.0.0.1:8001, http://127.0.0.1:8009'
                    command: pnpm cy:parallel:gh
            -   name: Check for GIT Changes (Weights File)
                id: check-weights-changes
                if: ${{ github.event_name == 'pull_request' && steps.cypress-e2e.outcome == 'success' }}
                run: |
                    if [[ `git status --porcelain` ]]; then
                        echo "found changes to weights file!"
                        echo "WEIGHTS_HAS_CHANGES=true" >> $GITHUB_OUTPUT
                    else
                        echo "NO changes to weights file!"
                    fi
            -   name: Commit Weights File (only if there was a change)
                if:  ${{ steps.check-weights-changes.outputs.WEIGHTS_HAS_CHANGES == 'true' }}
                run: |
                    git config user.email "ci@react-uploady.org"
                    git config user.name "Uploady CI"
                    git status
                    git add cypress/e2e-weights.json
                    git commit -m "chore: update e2e weights file"
                    git push
            -   name: Store screenshots
                uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
                if: failure()
                with:
                    name: cypress-screenshots
                    path: cypress/screenshots
                    if-no-files-found: ignore
            -   name: E2E Report
                uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3
                if: success() || failure()
                with:
                    name: E2E Report
                    path: cypress/results/results-*.xml
                    reporter: java-junit
                    badge-title: 'E2E tests'