build.yml

name: Build and test

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}

jobs:
  build:
    name: ${{ matrix.platform }}-${{ matrix.arch }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            platform: linux
            arch: x64
          - runner: ubuntu-24.04-arm
            platform: linux
            arch: arm64
          - runner: macos-15
            platform: darwin
            arch: arm64
          - runner: macos-15-intel
            platform: darwin
            arch: x64
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .node-version
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Install shell parsers for runtime tests
        if: matrix.platform == 'linux'
        run: sudo apt-get update && sudo apt-get install -y zsh
      - run: pnpm check
      - run: pnpm test
      - name: Check code quality with fresh coverage
        if: matrix.platform == 'linux' && matrix.arch == 'x64'
        run: pnpm quality
      - run: pnpm build:native
      - name: Verify dependency-free native builds
        run: node scripts/test-standalone-build.mjs
      - name: Verify runtime config imports in the native executable
        run: node scripts/test-native-imports.mjs
      - name: Verify native self-update through PATH
        run: node scripts/test-native-update.mjs
      - run: pnpm run docs
      - name: Smoke-test JavaScript and native CLIs
        run: |
          node dist/cli.js --help
          dist/bin/workstation-${{ matrix.platform }}-${{ matrix.arch }} --help
          node dist/cli.js init --config "$RUNNER_TEMP/workstation-js/workstation.config.ts"
          node dist/cli.js build --config "$RUNNER_TEMP/workstation-js/workstation.config.ts"
          node dist/cli.js --config "$RUNNER_TEMP/workstation-js/workstation.config.ts" hi
          dist/bin/workstation-${{ matrix.platform }}-${{ matrix.arch }} init --config "$RUNNER_TEMP/workstation-native/workstation.config.ts"
          dist/bin/workstation-${{ matrix.platform }}-${{ matrix.arch }} build --config "$RUNNER_TEMP/workstation-native/workstation.config.ts"
          dist/bin/workstation-${{ matrix.platform }}-${{ matrix.arch }} --config "$RUNNER_TEMP/workstation-native/workstation.config.ts" hi
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: workstation-${{ matrix.platform }}-${{ matrix.arch }}
          path: dist/bin/workstation-${{ matrix.platform }}-${{ matrix.arch }}
          if-no-files-found: error

  publish:
    name: Publish to npm
    needs: build
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .node-version
          cache: pnpm
      - name: Verify release tag
        run: |
          node --input-type=module -e '
            import { readFileSync } from "node:fs";
            const { name, version } = JSON.parse(readFileSync("package.json", "utf8"));
            if (name !== "@dovocode/workstation" || process.env.GITHUB_REF_NAME !== `v${version}`) {
              throw new Error("Release tag must match @dovocode/workstation package.json version");
            }
          '
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - name: Publish with npm trusted publishing
        run: |
          if [[ "$GITHUB_REF_NAME" == *-* ]]; then
            npm publish --access public --provenance --tag next
          else
            npm publish --access public --provenance --tag latest
          fi

  release-binaries:
    name: Publish native binaries
    needs: build
    if: >-
      github.event_name == 'push' &&
      (startsWith(github.ref, 'refs/tags/v') ||
       (github.ref == 'refs/heads/main' && startsWith(github.event.head_commit.message, 'chore(release-assets):')))
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: workstation-*
          path: release
          merge-multiple: true
      - name: Verify native binaries
        run: |
          test -f release/workstation-linux-x64
          test -f release/workstation-linux-arm64
          test -f release/workstation-darwin-x64
          test -f release/workstation-darwin-arm64
          chmod +x release/workstation-*
      - name: Create GitHub release or upload its binaries
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          release_tag="$GITHUB_REF_NAME"
          if [[ "$GITHUB_REF_TYPE" != "tag" ]]; then
            release_tag="v$(node -p 'require("./package.json").version')"
          fi
          if gh release view "$release_tag" >/dev/null 2>&1; then
            gh release upload "$release_tag" release/workstation-* --clobber
          else
            gh release create "$release_tag" release/workstation-* --verify-tag --generate-notes
          fi