hexcanvas/.github/workflows/ci.yml at main · htcom-code/hexcanvas · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
# The three gates a contributor runs locally (CONTRIBUTING.md): `pnpm check`,
# `pnpm api` and `pnpm test:browser`.
#
# `ci-complete` is the single job to mark as the required status check. Marking them
# individually works until a job becomes conditional, at which point a
# skipped job leaves a required check waiting forever.

name: CI

on:
  push:
    branches: [main]
    # A paths filter is safe here: this runs after the merge, so it gates nothing.
    paths:
      - "packages/**"
      - "demo/**"
      - "test/**"
      - "scripts/**"
      - "config/**"
      - "tools/**"
      - "*.json"
      - "pnpm-lock.yaml"
      - "vitest.config.ts"
      - ".github/workflows/ci.yml"
  # Deliberately no paths filter on pull_request. A filtered PR trigger skips the whole
  # workflow on a docs-only change, which leaves the required check stuck on
  # "Expected — waiting for status" and blocks the merge for anyone who cannot bypass
  # branch protection. Three sibling repositories had to remove this filter after
  # hitting exactly that.
  pull_request:

# The default for every job. `publish` raises its own; nothing else needs more than
# reading the tree.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Build, type-check every package and the playground, then the core suite.
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: enable pnpm
        # corepack rather than an action, so the version comes from the same place the
        # local gate reads it and there is one fewer action to keep pinned.
        run: |
          corepack enable
          corepack prepare pnpm@11.1.3 --activate
      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm check

  # What consumers can see, and whether it changed without anyone saying so.
  #
  # `pnpm api` re-derives the public surface from the built .d.ts and compares it to
  # the report committed under packages/*/etc. A difference is not a failure of the
  # build — it is a change to the API that has to be deliberate, and the fix is
  # `pnpm api:update` plus a sentence in the pull request. It also fails on a type
  # the API names but does not export, which is a thing a consumer cannot work around.
  #
  # `pnpm api:docs` runs typedoc with warnings as errors, so a broken `{@link}` or a
  # symbol the documentation references but the package does not export stops here.
  # It is also what produces the JSON the documentation site reads.
  api:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: enable pnpm
        run: |
          corepack enable
          corepack prepare pnpm@11.1.3 --activate
      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm api
      - run: pnpm api:docs
      - uses: actions/upload-artifact@v7
        with:
          name: api
          path: api/
          retention-days: 14

  # The renderer and the four bindings need a real canvas. The playwright image ships
  # the matching chromium, so this job adds a base image rather than a browser download
  # — the tag has to move with the `playwright` devDependency.
  browser:
    runs-on: ubuntu-latest
    container:
      image: mcr.microsoft.com/playwright:v1.64.1-noble
    env:
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
      # Firefox refuses to start as root when $HOME belongs to someone else, and a
      # container job is root while GitHub sets HOME to /github/home, which this
      # image owns as pwuser: "Running Nightly as root in a regular user's session
      # is not supported." Chromium and WebKit do not care, so this only appeared
      # when Gecko joined the suite. Reproduced in the image both ways before it
      # was written here.
      HOME: /root
    steps:
      - uses: actions/checkout@v7
      - name: install pnpm
        # Not corepack, unlike the other jobs: the image re-published under this tag
        # carries Node 26, which no longer bundles corepack ("corepack: not found"),
        # and `npm install -g corepack` collides with the image's own yarn binaries.
        # The other jobs run setup-node 22, which still has it. Same pinned version.
        run: npm install -g pnpm@11.1.3
      - run: pnpm install --frozen-lockfile
      - run: pnpm test:browser

  # The one required status check. `always()` so it reports even when an upstream job
  # fails — without it the check never appears and the pull request cannot be merged —
  # and the results are then examined explicitly, because `always()` alone would let a
  # failed upstream through. `skipped` counts as passing, so a job that becomes
  # conditional later does not turn into a merge block.
  ci-complete:
    if: always()
    needs: [check, api, browser]
    runs-on: ubuntu-latest
    steps:
      - name: gate on upstream results
        run: |
          echo "check=${{ needs.check.result }} api=${{ needs.api.result }} browser=${{ needs.browser.result }}"
          for result in "${{ needs.check.result }}" "${{ needs.api.result }}" "${{ needs.browser.result }}"; do
            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
              echo "a required job did not pass"
              exit 1
            fi
          done
          echo "all required jobs passed or were skipped"