ci.yml

name: CI

on:
  pull_request:
    types:
    - opened
    - reopened
    - synchronize
    - ready_for_review
    branches:
    - "**"
  workflow_dispatch:

env:
  NODE_VERSION: 22.11.0
  PNPM_VERSION: 9.12.3
  NPM_VERSION: latest
  BUN_VERSION: latest
  REGISTRY_NAMESPACE: ghcr.io/${{ github.repository_owner }}
  MULTI_ARCH: true
  USE_QEMU: true

jobs:
  expose-vars:
    runs-on: ubuntu-latest
    if: ${{ !github.event.pull_request.draft }}
    outputs:
      NODE_VERSION: ${{ env.NODE_VERSION }}
      PNPM_VERSION: ${{ env.PNPM_VERSION }}
      BUN_VERSION: ${{ env.BUN_VERSION }}
      REGISTRY_NAMESPACE: ${{ env.REGISTRY_NAMESPACE }}
      MULTI_ARCH: ${{ env.MULTI_ARCH }}
      USE_QEMU: ${{ env.USE_QEMU }}
    steps:
    - name: Exposing env vars
      run: echo "Exposing env vars"

  lint:
    uses: ./.github/workflows/lint.yml
    needs:
    - expose-vars
    with:
      NODE_VERSION: ${{ needs.expose-vars.outputs.NODE_VERSION }}
      PNPM_VERSION: ${{ needs.expose-vars.outputs.PNPM_VERSION }}

  tests-unit:
    uses: ./.github/workflows/tests-unit.yml
    needs:
    - expose-vars
    with:
      NODE_VERSION: ${{ needs.expose-vars.outputs.NODE_VERSION }}
      PNPM_VERSION: ${{ needs.expose-vars.outputs.PNPM_VERSION }}

  tests-cli:
    uses: ./.github/workflows/tests-cli.yml
    needs:
    - expose-vars
    with:
      NODE_VERSION: ${{ needs.expose-vars.outputs.NODE_VERSION }}
      PNPM_VERSION: ${{ needs.expose-vars.outputs.PNPM_VERSION }}
      BUN_VERSION: ${{ needs.expose-vars.outputs.BUN_VERSION }}

  build-docker:
    uses: ./.github/workflows/docker.yml
    needs:
    - expose-vars
    permissions:
      packages: write
    with:
      REGISTRY_NAMESPACE: ${{ needs.expose-vars.outputs.REGISTRY_NAMESPACE }}
      PR_NUMBER: ${{ github.event.pull_request.number || github.event.number || null }}
      MULTI_ARCH: ${{ needs.expose-vars.outputs.MULTI_ARCH == 'true' }}
      USE_QEMU: ${{ needs.expose-vars.outputs.USE_QEMU == 'true' }}

  tests-docker:
    uses: ./.github/workflows/tests-docker.yml
    needs:
    - expose-vars
    - build-docker
    with:
      PNPM_VERSION: ${{ needs.expose-vars.outputs.PNPM_VERSION }}
      DOCKER_IMAGE: ${{ (github.event.pull_request.number || github.event.number) && format('{0}/{1}:pr-{2}', needs.expose-vars.outputs.REGISTRY_NAMESPACE, 'docpress', (github.event.pull_request.number || github.event.number)) }}

  scan-vuln:
    uses: ./.github/workflows/scan.yml
    if: ${{ !github.event.pull_request.draft && (github.base_ref == 'main' || github.base_ref == 'develop') }}
    needs:
    - expose-vars
    - build-docker
    permissions:
      pull-requests: write
    with:
      REGISTRY_NAMESPACE: ${{ needs.expose-vars.outputs.REGISTRY_NAMESPACE }}
      TAG: pr-${{ github.event.pull_request.number || github.event.number }}

  # Workaround for required status check in protection branches (see. https://github.com/orgs/community/discussions/13690)
  all-jobs-passed:
    name: Check jobs status
    runs-on: ubuntu-latest
    if: ${{ always() }}
    needs:
    - expose-vars
    - lint
    - tests-unit
    - tests-cli
    - build-docker
    - tests-docker
    - scan-vuln
    steps:
    - name: Check status of all required jobs
      run: |-
        NEEDS_CONTEXT='${{ toJson(needs) }}'
        JOB_IDS=$(echo "$NEEDS_CONTEXT" | jq -r 'keys[]')
        for JOB_ID in $JOB_IDS; do
          RESULT=$(echo "$NEEDS_CONTEXT" | jq -r ".[\"$JOB_ID\"].result")
          echo "$JOB_ID job result: $RESULT"
          if [[ $RESULT != "success" && $RESULT != "skipped" ]]; then
            echo "***"
            echo "Error: The $JOB_ID job did not pass."
            exit 1
          fi
        done
        echo "All jobs passed or were skipped."