NGMS/.github/workflows/ci.yml at main · TheDancingDeveloper-org/NGMS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ngms-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    runs-on: [self-hosted, node-b, linux, x64]
    steps:
      - uses: actions/checkout@v7
      # The self-hosted runner image has no Rust toolchain preinstalled,
      # unlike ubuntu-latest. Pinned to match rust-toolchain.toml.
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.95.0"
          components: clippy,rustfmt
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-node@v7
        with:
          node-version: 24
      - name: Build embedded web assets
        run: |
          npm --prefix ui ci --no-audit --no-fund
          npm --prefix ui run build
          npm --prefix client ci --no-audit --no-fund
          npm --prefix client run build
      - name: Verify public dependency boundary
        run: python3 scripts/check_dependency_sources.py
      - name: Verify workspace documentation
        run: python3 scripts/check_workspace_docs.py
      - run: cargo fmt --all -- --check
      - run: cargo clippy --workspace --all-features --locked -- -D warnings

  test:
    runs-on: [self-hosted, node-b, linux, x64]
    steps:
      - uses: actions/checkout@v7
      # The self-hosted runner image has no Rust toolchain preinstalled,
      # unlike ubuntu-latest. Pinned to match rust-toolchain.toml.
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.95.0"
          components: clippy,rustfmt
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-node@v7
        with:
          node-version: 24
      - name: Build embedded web assets
        run: |
          npm --prefix ui ci --no-audit --no-fund
          npm --prefix ui run build
          npm --prefix client ci --no-audit --no-fund
          npm --prefix client run build
      - run: cargo test --workspace --all-features --locked

  build:
    runs-on: [self-hosted, node-b, linux, x64]
    steps:
      - uses: actions/checkout@v7
      # The self-hosted runner image has no Rust toolchain preinstalled,
      # unlike ubuntu-latest. Pinned to match rust-toolchain.toml.
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.95.0"
          components: clippy,rustfmt
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-node@v7
        with:
          node-version: 24
      - name: Build embedded web assets
        run: |
          npm --prefix ui ci --no-audit --no-fund
          npm --prefix ui run build
          npm --prefix client ci --no-audit --no-fund
          npm --prefix client run build
      - run: cargo build --workspace --all-features --locked

  ui:
    runs-on: [self-hosted, node-b, linux, x64]
    strategy:
      matrix:
        project: [ui, client]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: ${{ matrix.project }}/package-lock.json
      - working-directory: ${{ matrix.project }}
        run: npm ci --no-audit --no-fund
      - working-directory: ${{ matrix.project }}
        run: npm run build

  ui-e2e:
    runs-on: [self-hosted, node-b, linux, x64]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: ui/package-lock.json
      - working-directory: ui
        run: npm ci --no-audit --no-fund
      - working-directory: ui
        run: npx playwright install --with-deps chromium
      - working-directory: ui
        run: npm run test:e2e

  container:
    if: github.event_name == 'push'
    needs: [lint, test, build, ui, ui-e2e]
    runs-on: [self-hosted, node-b, linux, x64, publish, docker]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        if: github.event_name == 'push'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile
          push: ${{ github.event_name == 'push' }}
          tags: |
            ghcr.io/thedancingdeveloper-org/ngms:latest
            ghcr.io/thedancingdeveloper-org/ngms:sha-${{ github.sha }}
          cache-from: type=gha
          # The first canonical push uploaded the image successfully, then
          # wedged for more than 20 minutes exporting its optional GHA cache.
          # Keep cache reads, but do not let cache publication hold the image
          # delivery gate open indefinitely on the self-hosted publisher.