build.yaml

name: CI/CD
run-name: ${{github.workflow}} (${{github.event_name}} on ${{ github.ref_name}})

on:
  push:
  pull_request:
  workflow_dispatch:
    inputs:
      do_release:
        type: boolean
        default: false
        description: Do a release
      dry_run:
        type: boolean
        default: false
        description: Do a dry-run of the release

concurrency:
  group: 'cicd'
  cancel-in-progress: false

permissions:
  contents: read
  pages: write
  id-token: write
  issues: write
  pull-requests: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: package.json
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Lint source code
        run: npm lint

      - name: Run unit & integration test
        run: npm test

      - name: Build distribution assets
        run: npm build

      - name: Cache Build Assets
        uses: actions/cache@v4
        with:
          path: dist
          key: ${{ runner.os }}-build-${{ github.sha }}

  e2e-tests:
    runs-on: mcr.microsoft.com/playwrite:v1.42.1
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: package.json
          cache: 'npm'

      - name: Install dependencies
        run: npm install

      - name: Run e2e
        run: npm e2e:internal

      - name: Upload E2E Test Results
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: test-results

  release:
    if:
      ${{ github.event_name == 'workflow_dispatch' &&
      github.event.inputs.do_release == 'true'  && needs.build.result ==
      'success'}}
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: package.json
          cache: 'npm'

      - name: Restore Build Assets
        uses: actions/cache@v4
        with:
          path: dist
          key: ${{ runner.os }}-build-${{ github.sha }}

      - name:
          Verify the integrity of provenance attestations and registry
          signatures for installed dependencies
        run: npm audit signatures

      - name: Install dependencies
        run: npm install

      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm exec semantic-release -d ${{ github.event.inputs.dry_run }}