CI.yml

# This is a basic workflow to help you get started with Actions

name: CI

# Controls when the action will run. Triggers the workflow on push or pull request
on:
  push:
    branches: [ main ]
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_call:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  cache-apt:
    runs-on: ubuntu-latest
    steps:
      - uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          version: 1.0
          packages: build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

  prepare:
    needs: [cache-apt]
    # The type of runner that the job will run on
    runs-on: ubuntu-latest
    steps:
      - uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          version: 1.0
          packages: build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        id: pnpm-install
        with:
          run_install: true
          version: 8

      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - uses: actions/cache@v4
        name: Setup pnpm cache
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install

  list-packages:
    needs: [cache-apt]
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          version: 1.0
          packages: build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        name: Install pnpm
        id: pnpm-install
        with:
          run_install: true
          version: 8
      - id: set-matrix
        run: |
          export MATRIX=$(pnpm -s m ls --depth -1 -F "./packages/**" --json | jq -c)
          echo "matrix=${MATRIX}" | tee -a $GITHUB_OUTPUT


  tests:
    needs: [prepare, list-packages]
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.list-packages.outputs.matrix) }}
        node-version: [ lts/*, 16, 18, 20, latest ]
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    name: Test package ${{ matrix.package.name }} with node ${{ matrix.node-version }}

    permissions:
      checks: write
    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      - uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          version: 1.0
          packages: build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

      - name: Checkout
        uses: actions/checkout@v4
      - uses: ./.github/workflows/build_and_test
        with:
          node-version: ${{ matrix.node-version }}
          package_path: ${{ matrix.package.path }}
          package_name: ${{ matrix.package.name }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  metrics:
    needs: [prepare, list-packages]
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.list-packages.outputs.matrix) }}
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    name: Test and send metrics

    permissions:
      checks: write
    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      - uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          version: 1.0
          packages: build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - uses: ./.github/workflows/build_and_test
        with:
          node-version: ${{ matrix.node-version }}
          package_path: ${{ matrix.package.path }}
          check: "true"
          package_name: ${{ matrix.package.name }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

#  security:
#    permissions:
#      actions: read
#      contents: read
#      security-events: write
#    runs-on: ubuntu-latest
#    steps:
#      - uses: actions/checkout@master
#
#      - name: Install Node.js
#        uses: actions/setup-node@v4
#        with:
#          node-version: lts/*
#
#      - uses: pnpm/action-setup@v4
#        name: Install pnpm
#        id: pnpm-install
#        with:
#          run_install: true
#          version: 8
#
#      - name: Get pnpm store directory
#        id: pnpm-cache
#        shell: bash
#        run: |
#          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
#
#      - uses: actions/cache@v4
#        name: Setup pnpm cache
#        with:
#          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
#          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
#          restore-keys: |
#            ${{ runner.os }}-pnpm-store-
#
#      - name: Install dependencies
#        run: pnpm install
#      - name: Run Snyk to check for vulnerabilities
#        uses: snyk/actions/node@master
#        env:
#          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
#        with:
#          args: --sarif-file-output=snyk.sarif  --all-projects --exclude=examples,dev
#      - name: Upload result to GitHub Code Scanning
#        uses: github/codeql-action/upload-sarif@v2
#        with:
#          sarif_file: snyk.sarif