webstudio/.github/workflows/main.yml

name: Main workflow

on:
  push:
    branches:
      - main
  pull_request:
  pull_request_target:
    types: [labeled]

# cancel in-progress runs on new commits to same PR (gitub.event.number)
concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
  cancel-in-progress: true

permissions:
  contents: read # to fetch code (actions/checkout)

jobs:
  checks:
    # Run on push, regular PR (for repo branches), or labeled PR with safe-to-deploy (for forks)
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request' ||
      (github.event_name == 'pull_request_target' && github.event.label.name == 'safe-to-deploy')

    timeout-minutes: 20

    strategy:
      matrix:
        environment:
          - empty
          - development

    environment:
      name: ${{ matrix.environment }}

    env:
      DATABASE_URL: postgres://
      AUTH_SECRET: test

    runs-on: ubuntu-24.04-arm

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      # Will not checkout submodules on empty environment, and will on development
      - uses: ./.github/actions/submodules-checkout
        with:
          submodules-ssh-key: ${{ secrets.PRIVATE_GITHUB_DEPLOY_TOKEN }}

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Pnpm install
        run: |
          pnpm install

      - run: echo ===SHA USED=== ${{ github.event.pull_request.head.sha || github.sha }} # todo: remove after check whats happening on main

      - run: |
          pnpm oxfmt --check

      - name: Lint
        run: |
          pnpm lint

      - name: Package boundaries
        run: |
          pnpm check:package-boundaries

      - name: Generated API contracts
        run: |
          pnpm check:generated-api

      - name: Generated CLI docs
        run: |
          pnpm check:generated-docs

      - name: Cache Playwright browsers
        uses: actions/cache@v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            playwright-${{ runner.os }}-

      - name: Playwright init
        run: |
          pnpm playwright install
        working-directory: packages/sdk-components-animation

      - name: Test
        run: |
          pnpm -r test

      - name: Typecheck
        run: |
          pnpm -r typecheck

  check-size:
    runs-on: ubuntu-24.04-arm

    environment:
      name: development

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - uses: ./.github/actions/submodules-checkout
        with:
          submodules-ssh-key: ${{ secrets.PRIVATE_GITHUB_DEPLOY_TOKEN }}

      - uses: ./.github/actions/ci-setup

      - run: pnpm --filter "{./fixtures/*}..." build

      - uses: actions/github-script@v7
        with:
          script: |
            const assertSize = async (directory, maxSize) => {
              let result = ''
              await exec.exec('du', ['-sk', directory], {
                silent: true,
                listeners: {
                  stdout: (data) => {
                    result += data.toString()
                  }
                }
              })
              const size = Number.parseInt(result, 10)
              return {
                passed: size <= maxSize,
                size,
                diff: size - maxSize,
                directory,
              }
            }
            const results = [
              await assertSize('./fixtures/ssg-cloudflare-pages/dist/client', 356),
              await assertSize('./fixtures/react-router-netlify/build/client', 376),
              await assertSize('./fixtures/webstudio-features/build/client', 3312),
            ]
            for (const result of results) {
              if (result.passed) {
                console.info(`${result.directory}: ${result.size}kB (${result.diff}kB)`)
              } else {
                console.info('')
                console.error(`${result.directory}: ${result.size}kB (+${result.diff}kB)`)
              }
            }
            if (results.some(result => result.passed === false)) {
              console.error('Some fixtures exceeded limits')
              process.exit(1)
            }

  builder-e2e-build:
    name: builder-e2e build
    # Run on push, regular PR (for repo branches), or labeled PR with safe-to-deploy (for forks)
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request' ||
      (github.event_name == 'pull_request_target' && github.event.label.name == 'safe-to-deploy')

    timeout-minutes: 20

    runs-on: ubuntu-24.04

    environment:
      name: development

    outputs:
      shards: ${{ steps.shards.outputs.value }}

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - uses: ./.github/actions/submodules-checkout
        with:
          submodules-ssh-key: ${{ secrets.PRIVATE_GITHUB_DEPLOY_TOKEN }}

      - uses: ./.github/actions/ci-setup
        with:
          run-scripts: "true"

      - name: Discover builder e2e shards
        id: shards
        run: echo "value=$(pnpm --dir apps/builder exec tsx ./e2e/print-shards.ts)" >> "$GITHUB_OUTPUT"

      - name: Build builder and generated preview dependencies
        run: pnpm e2e:builder:build

      # Generate this from the current migrations for this workflow run only.
      # Shards consume the snapshot as a fast, disposable schema cache.
      - name: Generate builder e2e schema snapshot
        run: pnpm e2e:builder:refresh-schema-cache

      - name: Upload builder e2e prerequisites
        uses: actions/upload-artifact@v4
        with:
          name: builder-e2e-build
          retention-days: 1
          path: |
            apps/builder/build/server
            apps/builder/build/client/assets
            packages/*/lib
            .cache/builder-e2e/schema-*.sql

  builder-e2e:
    name: builder-e2e (${{ matrix.shard }})
    # Run on push, regular PR (for repo branches), or labeled PR with safe-to-deploy (for forks)
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request' ||
      (github.event_name == 'pull_request_target' && github.event.label.name == 'safe-to-deploy')

    timeout-minutes: 40

    needs: builder-e2e-build

    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        shard: ${{ fromJSON(needs.builder-e2e-build.outputs.shards) }}

    environment:
      name: development

    env:
      BUILDER_E2E_COMPOSE_ARGS: "--env-file apps/builder/.env -f apps/builder/docker-compose.yaml -f apps/builder/docker-compose.e2e.yaml"

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - uses: ./.github/actions/submodules-checkout
        with:
          submodules-ssh-key: ${{ secrets.PRIVATE_GITHUB_DEPLOY_TOKEN }}

      - uses: ./.github/actions/ci-setup
        with:
          run-scripts: "true"

      - name: Cache Playwright browsers
        uses: actions/cache@v4
        with:
          path: ~/.cache/ms-playwright
          key: builder-e2e-playwright-${{ runner.os }}-${{ hashFiles('apps/builder/package.json', 'pnpm-lock.yaml') }}

      - name: Download builder e2e build
        uses: actions/download-artifact@v4
        with:
          name: builder-e2e-build
          path: .

      - name: Run builder e2e
        env:
          E2E_SKIP_BUILDER_BUILD: true
          E2E_TEST_SHARD: ${{ matrix.shard }}
        run: |
          run_builder_e2e() {
            E2E_TEST_COMMAND_TIMEOUT_SECONDS=300 pnpm e2e:builder
          }

          run_builder_e2e_keep_logs() {
            E2E_SKIP_CLEANUP=true E2E_TEST_COMMAND_TIMEOUT_SECONDS=300 pnpm e2e:builder
          }

          run_builder_e2e || {
            echo "::warning::Builder e2e shard ${E2E_TEST_SHARD} failed; retrying once"
            run_builder_e2e_keep_logs
          }

      - name: Print e2e service logs
        if: failure()
        run: docker compose $BUILDER_E2E_COMPOSE_ARGS logs

      - name: Stop e2e services
        if: always()
        run: docker compose $BUILDER_E2E_COMPOSE_ARGS down --volumes --remove-orphans