build-dev-app.yml

# This workflow builds the dev-app for pull requests when a certain label is applied.
# The actual deployment happens as part of a dedicated second workflow to avoid security
# issues where the building would otherwise occur in an authorized context where secrets
# could be leaked. More details can be found here:

# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.

name: Build dev-app for deployment

on:
  pull_request:
    types: [synchronize, labeled]

permissions: read-all

jobs:
  dev-app-build:
    runs-on: ubuntu-latest
    # We only want to build and deploy the dev-app if the `dev-app preview` label has been
    # added, or if the label is already applied and new changes have been made in the PR.
    if: |
      (github.event.action == 'labeled' && github.event.label.name == 'dev-app preview') ||
      (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'dev-app preview'))
    steps:
      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2.0.0
      - uses: ./.github/actions/yarn-install

      - uses: angular/dev-infra/github-actions/setup-bazel-remote-exec@fb30926790c6225d553b91a4818cab2fdde4fb4e
        with:
          bazelrc: ./.bazelrc.user

      # Build the web package. Note: We run Bazel from a low-resource Github action container,
      # so we manually need to instruct Bazel to run more actions concurrently as by default
      # the number of concurrent actions is determined based on the host resources.
      - run: bazel build //src/dev-app:web_package --symlink_prefix=dist/ --jobs=32

      - uses: angular/dev-infra/github-actions/previews/pack-and-upload-artifact@fb30926790c6225d553b91a4818cab2fdde4fb4e
        with:
          workflow-artifact-name: 'dev-app'
          pull-number: '${{github.event.pull_request.number}}'
          artifact-build-revision: '${{github.event.pull_request.head.sha}}'
          deploy-directory: './dist/bin/src/dev-app/web_package/'