ci.yml

name: Continuous Integration
on:
  push:
    branches: main
  pull_request:
    branches: main
    paths-ignore:
      - '**/*.md'
concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true
jobs:
  setup:
    name: Setup
    runs-on: ubuntu-latest
    outputs:
      packages: ${{ steps.packages.outputs.packages }}
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v1
      - name: List packages
        id: packages
        run: |
          echo "packages=$(deno eval 'console.log(JSON.stringify([...Deno.readDirSync(`.`)].filter(({name}) => { try { return Deno.openSync(`${name}/deno.jsonc`) } catch { return false } }).map(({name}) => name)))')" >> $GITHUB_OUTPUT
        shell: bash

  package:
    name: Package
    needs: setup
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.setup.outputs.packages) }}
    permissions:
      id-token: write
      contents: write
      packages: write
      security-events: write
    uses: lowlighter/libs/.github/workflows/ci_package.yml@main
    with:
      ref: ${{ github.ref }}
      event: ${{ github.event_name }}
      package: ${{ matrix.package }}
      publish: ${{ github.event_name == 'push' }}
    secrets:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      GH_TOKEN: ${{ secrets.GH_TOKEN }}

  coverage:
    name: Coverage
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    needs:
      - setup
      - package
    environment:
      name: github-pages
      url: ${{ steps.pages.outputs.page_url }}
    permissions:
      id-token: write
      pages: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
      - uses: actions/configure-pages@v5
      - uses: denoland/setup-deno@v1
        with:
          deno-version: 1.x
      - uses: actions/setup-node@v4
        with:
          node-version: 22.x
      - uses: oven-sh/setup-bun@v1
        with:
          bun-version: latest
      - name: Run deno task coverage
        run: |
          PACKAGES=$(echo '${{ needs.setup.outputs.packages }}' | jq -cr '.[]')
          for PACKAGE in $PACKAGES; do
            pushd $PACKAGE
            deno task coverage:html
            popd
          done
          deno run --allow-read --allow-write=coverage --allow-net jsr:@libs/bundle/ts/cli/coverage --root=coverage
          mv coverage _site
        shell: bash
      - uses: actions/upload-pages-artifact@v3
      - id: pages
        uses: actions/deploy-pages@v4

  autogen:
    name: Auto-generate files
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    needs:
      - setup
      - package
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
      - uses: denoland/setup-deno@v1
      - name: Configure git
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
        shell: bash
      - name: Run deno task make:config
        run: |
          deno task make:config
          if [ -n "$(git status --porcelain)" ]; then
            git add .
            git commit -m 'chore: update `deno.jsonc`'
            git pull --rebase
            git push
          fi
        shell: bash
      - name: Run deno task make:readme
        run: |
          deno task make:readme
          if [ -n "$(git status --porcelain)" ]; then
            git add .
            git commit -m 'doc: update `README.md`'
            git pull --rebase
            git push
          fi
        shell: bash

  codeql:
    name: Code quality (global)
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    needs: package
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
      - uses: github/codeql-action/init@v3
        with:
          languages: typescript
      - uses: github/codeql-action/analyze@v3

  publish:
    name: Publish
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    needs:
      - autogen
      - codeql
    permissions:
      id-token: write
      contents: write
    steps:
      # Setup
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: denoland/setup-deno@v1
      - name: Configure git
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
        shell: bash
      # Publish
      - name: Run deno.land/x publish
        run: deno run --allow-all jsr:@libs/bundle/ts/cli/publish deno.jsonc --loglevel debug --x.repository '${{ github.repository }}' --x.token '${{ secrets.GH_TOKEN }}' --x.version "$(date '+%Y.%m.%d')" --x.map deno.jsonc --x.reactive --x.remove