deploy.yml

# Do not rename this file. The name "deploy.yml" is known to
# npm for trusted OIDC publishing.
name: Deploy

on:
  # Run on push and not `workflow_run` after tests finish.
  # Specifically because `workflow_run` only runs from the context
  # of the default branch, regardless of which branch triggered the tests.
  # That means no non-default branches could deploy.
  push:
    branches:
      - master
      - develop

concurrency:
  group: deploy/${{ github.ref_name }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  # Since we can't run against `workflow_run`, we have to
  # wait for for the Tests to succeed first before any
  # processing can happen.
  wait-for-tests:
    name: Wait for Tests to Pass
    if: github.repository_owner == 'dequelabs'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      actions: read
      statuses: read
    timeout-minutes: 15
    steps:
      - &checkout
        name: Checkout repository
        timeout-minutes: 2
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Wait for Tests workflow to complete
        timeout-minutes: 13
        env:
          SHA: ${{ github.sha }}
          REPOSITORY: ${{ github.repository }}
          BRANCH: ${{ github.ref_name }}
          WORKFLOW_NAME: Tests
          DEBUG: ${{ runner.debug == '1' }}
          # One minute less than the job timeout to allow for the script to do cleanup work.
          TIMEOUT_MINUTES: 12
          GH_TOKEN: ${{ github.token }}
        run: ./.github/bin/wait-for-workflow-success.sh
  deploy-next:
    name: Deploy "next" to npm
    needs: wait-for-tests
    if: ${{ github.ref_name == 'develop' }}
    environment:
      name: registry.npmjs.org
    permissions:
      contents: read
      id-token: write # Required for OIDC
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.determine-version.outputs.version }}
      packageName: ${{ steps.determine-version.outputs.name }}
    steps:
      - *checkout
      # Must precede setup-node so its `cache: pnpm` can resolve the store path.
      - &setup-pnpm
        name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - &setup-node
        name: Setup NodeJS
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: .nvmrc
          cache: pnpm
      - &install-project-deps
        name: Install Project Dependencies
        shell: bash
        run: pnpm ci
      - &build
        name: Build
        run: pnpm run build
      - name: Determine prerelease version
        id: determine-version
        run: ./.github/bin/determine-version.sh
      # `pnpm version` has no --ignore-scripts, and the `version` script here
      # intentionally exits 1, so write the manifest field directly.
      - name: Bump version
        env:
          NEW_VERSION: ${{ steps.determine-version.outputs.version }}
        run: pnpm pkg set version="$NEW_VERSION"
      - &validate-package
        name: Validate package is consumable
        run: node .github/bin/validate-package.mjs
      # --no-git-checks: pnpm otherwise refuses to publish from a non-master
      # branch with the uncommitted version bump above.
      - name: Publish "next" version to npm
        run: pnpm publish --tag=next --no-git-checks
  validate-next-deploy:
    name: Validate Next Deployment
    needs: deploy-next
    runs-on: ubuntu-24.04
    steps:
      - *checkout
      - *setup-pnpm
      - *setup-node
      # In theory since this is a new job now, by the time
      # this would kick off the package should be available.
      # But, to be safe in case of delays in propagation,
      # we'll implement a retry mechanism.
      - name: Wait for package to be available on npm
        env:
          VERSION: ${{ needs.deploy-next.outputs.version }}
          PACKAGE_NAME: ${{ needs.deploy-next.outputs.packageName }}
        run: ./.github/bin/wait-for-npm-ready.sh
      - name: Validate installation of "next" version
        env:
          PACKAGE_NAME: ${{ needs.deploy-next.outputs.packageName }}
          VERSION: ${{ needs.deploy-next.outputs.version }}
        run: ./.github/bin/validate-npm-deploy.sh
  prod-hold:
    name: Await approval to deploy to production
    needs: wait-for-tests
    if: ${{ github.ref_name == 'master' }}
    environment:
      name: production-hold
    runs-on: ubuntu-24.04
    steps:
      - name: Awaiting approval to deploy to production
        run: echo "Approval granted to proceed to production deployment."
  prod-deploy:
    name: Deploy stable to npm
    needs: prod-hold
    if: ${{ needs.prod-hold.result == 'success' }}
    environment:
      name: registry.npmjs.org
    permissions:
      contents: read
      id-token: write # Required for OIDC
    outputs:
      version: ${{ steps.get-data.outputs.version }}
      packageName: ${{ steps.get-data.outputs.name }}
    runs-on: ubuntu-24.04
    steps:
      - *checkout
      - *setup-pnpm
      - *setup-node
      - *install-project-deps
      - *build
      - *validate-package
      - name: Publish stable version to npm
        run: pnpm publish --no-git-checks
      - name: Get published package data
        id: get-data
        run: |
          VERSION=$(pnpm pkg get version | tr -d '"')
          NAME=$(pnpm pkg get name | tr -d '"')
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "name=$NAME" >> $GITHUB_OUTPUT
  create-github-release:
    name: Create GitHub Release
    needs: prod-deploy
    runs-on: ubuntu-24.04
    permissions:
      contents: write # Required to create releases
    steps:
      - *checkout
      - name: Extract release notes
        id: release-notes
        run: ./.github/bin/extract-release-notes.sh
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.prod-deploy.outputs.version }}
          NOTES: ${{ steps.release-notes.outputs.notes }}
        run: |
          gh release create "v${VERSION}" \
            --title "Release ${VERSION}" \
            --target ${{ github.sha }} \
            --notes "$NOTES"
  validate-deploy:
    name: Validate Deployment
    needs: prod-deploy
    runs-on: ubuntu-24.04
    steps:
      - *checkout
      - *setup-pnpm
      - *setup-node
      # In theory since this is a new job now, by the time
      # this would kick off the package should be available.
      # But, to be safe in case of delays in propagation,
      # we'll implement a retry mechanism.
      - name: Wait for package to be available on npm
        env:
          VERSION: ${{ needs.prod-deploy.outputs.version }}
          PACKAGE_NAME: ${{ needs.prod-deploy.outputs.packageName }}
        run: ./.github/bin/wait-for-npm-ready.sh
      - name: Validate installation of stable version
        env:
          PACKAGE_NAME: ${{ needs.prod-deploy.outputs.packageName }}
          VERSION: ${{ needs.prod-deploy.outputs.version }}
        run: ./.github/bin/validate-npm-deploy.sh