Merge pull request #21729 from wireapp/deployoholics #22927
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| # we want to run the CI on every PR targetting those branches | |
| branches: [master, dev, release/*] | |
| merge_group: | |
| branches: [master, dev, release/*] | |
| push: | |
| # We also run CI on dev in order to update the coverage monitoring | |
| branches: [dev] | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| workflow-security: | |
| runs-on: ubuntu-24.04 | |
| name: Workflow security analysis | |
| permissions: | |
| actions: read # required by zizmor online audits in private repositories | |
| contents: read # required for actions/checkout to read the workflow source | |
| security-events: write # required by zizmor-action to upload SARIF to code scanning | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Run zizmor | |
| id: zizmor | |
| uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 | |
| with: | |
| inputs: .github/workflows/ci.yml | |
| version: 1.25.2 | |
| persona: pedantic | |
| min-severity: informational | |
| min-confidence: low | |
| config: .github/zizmor.yml | |
| - name: Fail if zizmor reported findings | |
| env: | |
| sarifFilePath: ${{ steps.zizmor.outputs.output-file }} | |
| run: | | |
| findingsCount="$(jq '[.runs[].results[]] | length' "$sarifFilePath")" | |
| echo "zizmor findings: $findingsCount" | |
| test "$findingsCount" -eq 0 | |
| test: | |
| runs-on: ubuntu-24.04 | |
| needs: [workflow-security] | |
| name: test | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout (pull_request) | |
| if: ${{ github.event_name == 'pull_request' }} | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 1 | |
| # Uses the head commit, not the merge commit. | |
| # Keep this shallow. Nx gets the base branch explicitly in the next step. | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Fetch base branch for Nx checks | |
| if: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| git fetch --no-tags --depth=1 origin \ | |
| "${BASE_REF}:refs/remotes/origin/${BASE_REF}" \ | |
| "${BASE_REF}:${BASE_REF}" | |
| - name: Checkout (non-PR) | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Add repository Yarn wrapper to PATH | |
| run: echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH" | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'yarn' | |
| - name: Install JS dependencies | |
| run: ./bin/yarn --immutable | |
| - name: Restore Nx and ESLint caches | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 | |
| with: | |
| path: | | |
| .nx/cache | |
| node_modules/.cache/eslint | |
| key: lint-${{ runner.os }}-${{ hashFiles('eslint.config.ts', 'yarn.lock') }}-${{ github.sha }} | |
| restore-keys: | | |
| lint-${{ runner.os }}-${{ hashFiles('eslint.config.ts', 'yarn.lock') }}- | |
| - name: Verify generated i18n artifacts are committed | |
| run: | | |
| ./bin/yarn nx run webapp:translate-merge | |
| if ! test -z "$(git status --porcelain)"; then | |
| echo "Repository is not clean after generation. Run generation locally and commit the changes." | |
| git status | |
| exit 1 | |
| fi | |
| - name: Build libraries | |
| run: ./bin/yarn nx run-many -t build --projects=tag:type:lib | |
| - name: Type check | |
| run: ./bin/yarn type-check | |
| - name: Lint file names | |
| run: ./bin/yarn lint:fileNames | |
| - name: Lint (PR) | |
| if: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: ./bin/yarn lint:affected | |
| - name: Lint (non-PR) | |
| if: ${{ github.event_name != 'pull_request' }} | |
| run: ./bin/yarn lint | |
| - name: Test | |
| run: ./bin/run-with-network-isolation.sh ./bin/yarn nx run-many -t test --all --configuration=ci --detectOpenHandles=false | |
| - name: Upload coverage reports | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-reports | |
| if-no-files-found: error | |
| retention-days: 1 | |
| path: | | |
| apps/webapp/coverage | |
| apps/server/coverage | |
| coverage/libraries/core | |
| coverage/libraries/api-client | |
| - name: Build and package | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }} | |
| run: ./bin/yarn nx run server:package | |
| - name: Verify Quay credentials availability | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }} | |
| env: | |
| DOCKER_PASSWORD: ${{ secrets.WEBTEAM_QUAY_PASSWORD }} | |
| DOCKER_USERNAME: ${{ secrets.WEBTEAM_QUAY_USERNAME }} | |
| run: | | |
| if [[ -z "${DOCKER_USERNAME}" || -z "${DOCKER_PASSWORD}" ]]; then | |
| echo "Missing Quay credentials. Configure WEBTEAM_QUAY_USERNAME and WEBTEAM_QUAY_PASSWORD for pull request image publishing." | |
| exit 1 | |
| fi | |
| - name: Push PR Docker image | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }} | |
| env: | |
| DOCKER_PASSWORD: ${{ secrets.WEBTEAM_QUAY_PASSWORD }} | |
| DOCKER_USERNAME: ${{ secrets.WEBTEAM_QUAY_USERNAME }} | |
| PR_TAG: pr-${{ github.event.pull_request.number }} | |
| GITHUB_SHA: ${{ github.event.pull_request.head.sha }} | |
| # The third and fourth positional parameters are uniqueTagOut and commitSha; they are intentionally left empty here. | |
| run: ./bin/yarn docker "$PR_TAG" "" "" --pr |