trolley/.github/workflows/aggregate.yml at main · ammarphp/trolley · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: Update anonymous run aggregates
on:
  schedule:
    - cron: '23 * * * *'
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: pages
  cancel-in-progress: false
jobs:
  snapshot:
    runs-on: ubuntu-latest
    outputs:
      publish: ${{ steps.release_guard.outputs.publish }}
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
      - uses: pnpm/action-setup@v4
        with:
          version: '11.19.0'
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck
      - run: pnpm test
      - run: pnpm inspect:content
      - name: Build static application
        run: pnpm build
        env:
          COLLECTOR_URL: ${{ vars.COLLECTOR_URL }}
          COLLECTOR_V2_ENABLED: ${{ vars.COLLECTOR_V2_ENABLED }}
          REPOSITORY_URL: https://github.com/ammarphp/trolley
          OPERATOR_NAME: ammarphp
          CONTACT_URL: https://github.com/ammarphp/trolley/issues
      - run: pnpm exec playwright install --with-deps chromium
      - run: pnpm test:browser
      - name: Enforce the source-controlled release profile
        id: release_guard
        run: |
          node --input-type=module <<'NODE'
          import { appendFileSync, readFileSync } from 'node:fs';
          appendFileSync(process.env.GITHUB_OUTPUT, 'publish=false\n');
          let manifest;
          try {
            manifest = JSON.parse(readFileSync('dist/build-manifest.json', 'utf8'));
          } catch {
            const reason = 'Publication blocked: the build manifest is missing or invalid.';
            appendFileSync(process.env.GITHUB_STEP_SUMMARY, `## Publication blocked\n\n${reason}\n`);
            console.error(`::error::${reason}`);
            process.exit(1);
          }
          if (manifest?.profile !== 'production') {
            const reason = 'Publication held: this build is not the reviewed production profile. Development slices are never uploaded or deployed.';
            appendFileSync(process.env.GITHUB_STEP_SUMMARY, `## Publication held\n\n${reason}\n\nSee docs/operations/RELEASE_HOLD.md. Manual dispatch and repository variables do not bypass this hold.\n`);
            console.log(`::notice::${reason}`);
          } else {
            appendFileSync(process.env.GITHUB_OUTPUT, 'publish=true\n');
            appendFileSync(process.env.GITHUB_STEP_SUMMARY, '## Publication profile accepted\n\nThe source-controlled build declares production. Normal release checks and environment protections still apply.\n');
          }
          NODE
      - name: Fetch aggregate-only snapshot into deployment artifact
        run: node scripts/sync-aggregates.mjs
        if: steps.release_guard.outputs.publish == 'true' && vars.COLLECTOR_URL != ''
        env:
          COLLECTOR_URL: ${{ vars.COLLECTOR_URL }}
      - name: Fetch published v2 cells
        if: steps.release_guard.outputs.publish == 'true' && vars.COLLECTOR_V2_ENABLED == 'true'
        run: node scripts/sync-v2-aggregates.mjs
        env:
          COLLECTOR_URL: ${{ vars.COLLECTOR_URL }}
      - uses: actions/configure-pages@v5
        if: steps.release_guard.outputs.publish == 'true'
      - uses: actions/upload-pages-artifact@v4
        if: steps.release_guard.outputs.publish == 'true'
        with:
          path: dist
  deploy:
    needs: snapshot
    if: needs.snapshot.outputs.publish == 'true'
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/deploy-pages@v4
        id: deployment