node-docker-simple-fast-pnpm.yaml

# This workflow will build and upload nodejs application on the github's npm registry.

name: Build and Upload NodeJS PNPM Applications

on:
  workflow_call:
    inputs:
      #
      # Common settings
      #
      app-name:
        description: |
          Application name in human-readable form.
          As it is supposed to be shown in messages
        type: string
        required: false
        default: ${{ github.repository }}

      app-name-slug:
        description: |
          Application name slug (part of release file name)
        type: string
        required: true

      #
      # Checkout settings
      #
      checkout-submodules:
        description: |
          'Submodules' mode for 'actions/checkout' action
          '', 'false' - disable submodules support
          'true' - checkout submodules
          'recursive' - checkout submodules recursive
        type: string
        required: false
        default: ""

      #
      # Environment settings
      #
      env:
        description: |
          custom environment variables to set for all jobs in workflow
          as JSON-encoded map:
            { "MY_VAR_1": "awesome value",
              "VARIABLE_2": "not so awesome :)" }

          This input's envs are merged with secrets.env
          This input's envs have lower priority compared than secrets.env
        type: string
        required: false
        default: "{}"

      #
      # NodeJS settings
      #
      node-version:
        description: |
          Node version to use
        type: string
        required: true

      #
      # Cache control
      #
      cache-version:
        description: |
          Simple hack, that allows to 'reset' cache for particular job.

          Just change the value of this parameter and the next run will
          not find build cache and will have to start from scratch.

        type: string
        required: false
        default: "v1"

      cache-hashfiles-search-path:
        description: |
          Hashfiles search path for pnpm-lock.yaml
        type: string
        required: false
        default: "pnpm-lock.yaml"

      #
      # PNPM settings
      #
      pnpm-version:
        description: |
          Version of pnpm to install.
        type: string
        required: false
        default: "latest"

      pnpm-recursive-build:
        description: |
          Run pnpm build with -r flag.
        type: boolean
        required: true

      pnpm-recursive-tests:
        description: |
          Run pnpm tests with -r flag.
        type: boolean
        required: true

      pnpm-build-args:
        description: |
          Additional pnpm build arguments to pass
          for none --recursive pnpm invocations.
        type: string
        required: false

      pnpm-tests-args:
        description: |
          Additional pnpm tests arguments to pass
          for none --recursive pnpm invocations.
        type: string
        required: false
      #
      # Build control
      #
      build-script-name:
        description: |
          The name of a build script
        type: string
        required: true
        default: "build"
      is-electron-application:
        description: |
          If 'true' enables cache for an Electron application,
          if 'false', enables cache for a generic NodeJS application.
        type: string
        required: false
        default: "true"

      #
      # Test control
      #
      test:
        description: |
          Run tests
        type: boolean
        required: false
        default: false
      test-script-name:
        description: |
          The name of a test
        type: string
        required: false
        default: "test"

      #
      # NPM registry settings
      #
      npmrc-config:
        description: |
          Generates a .npmrc file based on provided configuration.
        type: string
        required: true

      #
      # Distribution control
      #
      publish-to-public:
        description: |
          Whether or not the npm package should be published as public.
        type: string
        required: false
        default: "false"
      #
      # AWS ECR settings
      #
      aws-login-enable:
        description: |
          Enables the creation of AWS credentials during the GitHub Action workflow.
        type: boolean
        required: false
        default: true

      aws-region:
        description: |
          The AWS region
        type: string
        required: false
        default: "eu-central-1"

      #
      # GCP sign control
      #
      gcp-login-enable:
        description: |
          Enables the creation of Google cloud credentials during the GitHub Action workflow.
        type: boolean
        required: false
        default: false

      gcp-sdk-version:
        description: |
          Version or version constraint of the gcloud SDK to install. If
          unspecified, it will accept any installed version of the gcloud SDK. If
          set to "latest", it will download the latest available SDK. If set to a
          version constraint, it will download the latest available version that
          matches the constraint. Examples: "290.0.1" or ">= 197.0.1".
        type: string
        required: false
        default: "latest"

      # We do not put version into secrets because it has very short value.
      #  '1' in secrets may cause '1' to be replaced with '*' everywhere in github workflow logs
      gcp-kms-key-version:
        description: |
          Version of KMS key.
        type: string
        required: false
        default: "1"

      gcp-kms-digest-algorithm:
        description: |
          The algorithm to digest the input.
          Must be one of: sha256, sha384, sha512.
        type: string
        required: false
        default: "sha256"

      #
      # Platforma Docker settings
      #
      pl-docker-tag:
        description: |
          Platforma docker tag.
        type: string
        required: false
        default: "main"
      pl-test-assets-dir:
        description: |
          Platforma test assets directory;
          this directory will be mounted inside
          the container under the path `/storage/controllers/file/library`
          The path must be relative to github.workspace
          and will be appended to github.workspace within the docker compose action.
        type: string
        required: false
        default: "assets"
      pl-log-dir:
        description: |
          Platforma logs directory on the agent;
          this directory will be mounted inside
          the container under the path. `pl-log-destination`
          The path must be relative to github.workspace
          and will be appended to github.workspace within the docker compose action.
        type: string
        required: false
        default: "log"
      pl-log-commit-summary:
        description: |
          Whether or not to log commit summary for Platforma.
        type: boolean
        required: false
        default: true
      pl-log-resource-data:
        description: |
          Whether or not to log resource data for Platforma.
        type: boolean
        required: false
        default: true
      pl-log-level:
        description: |
          Platforma log level
        type: string
        required: false
        default: "info"
      pl-auth-enabled:
        description: |
          Whether or not to enable authentication in the Platforma.
        type: boolean
        required: false
        default: true
      #
      # Debug
      #
      interactive-debug:
        description: |
          Enable interactive debugging session
        type: string
        default: ""
        required: false

      #
      # Notifications
      #
      notify-telegram:
        description: |
          Enable Telegram notifications
        required: false
        type: boolean
        default: true

      notify-build:
        description: |
          Enable notifications about build status (build ready/failed)
          Possible values are:
           - 'true' - send all notifications about build status (both success and failed)
           - 'failure-only' - send notification about failed builds, don't notify on success
           - 'success-only' - send notification about success builds, don't notify on failures
           - 'false' - don't send notifications about build results at all.
        required: false
        type: string
        default: "true"

      notify-tests:
        description: |
          Enable notifications about tests status (ready/failed)
          Possible values are:
           - 'true' - send all notifications about tests status (both success and failed)
           - 'failure-only' - send notification about failed tests, don't notify on success
           - 'success-only' - send notification about success tests, don't notify on failures
           - 'false' - don't send notifications about tests results at all.
        required: false
        type: string
        default: "true"

    secrets:
      env:
        description: |
          custom environment variables to set for all jobs in workflow
          as JSON-encoded map:
            { "MY_VAR_1": "awesome value",
              "VARIABLE_2": "not so awesome :)" }

          This input's envs are merged with inputs.env
          This input's envs have HIGHER priority compared than inputs.env
        required: false

      AWS_ASSUME_ROLE:
        description: |
          Role to assume in AWS to assume during CI run.
        required: false
      AWS_ASSUME_REGION:
        description: |
          The AWS region for AWS role assumption
        required: false

      GCP_KMS_WORKLOAD_IDENTITY_PROVIDER:
        description: |
          Tha name of the GCP workload identity federation provider.
        required: false
      GCP_KMS_SERVICE_ACCOUNT:
        description: |
          The name of the GCP service account
        required: false
      GCP_KMS_LOCATION:
        description: |
          KMS key and keyring location
        required: false
      GCP_KMS_KEYRING:
        description: |
          KMS keyring name in Google Cloud Platform.
        required: false
      GCP_KMS_KEY_NAME:
        description: |
          KMS key name in Google Cloud Platform.
        required: false

      TELEGRAM_NOTIFICATION_TARGET:
        description: |
          ID of Telegram Channel or User to notify on build results.
        required: false
      TELEGRAM_API_TOKEN:
        description: |
          Telegram Bot API authorization token
        required: false

jobs:
  init:
    name: Init
    runs-on: ubuntu-latest

    steps:
      - id: context
        uses: milaboratory/github-ci/actions/context@v4

    outputs:
      is-release: ${{ steps.context.outputs.is-release }}
      current-version: ${{ steps.context.outputs.current-version }}

  build-test-publish:
    name: unified (build test publish)
    runs-on: ubuntu-latest

    needs:
      - init

    permissions:
      id-token: write
      packages: write
      contents: write
      pull-requests: write
      issues: read

    steps:
      - id: context
        uses: milaboratory/github-ci/actions/context@v4

      - uses: milaboratory/github-ci/actions/env@v4
        with:
          inputs: ${{ inputs.env }}
          secrets: ${{ secrets.env }}

      - uses: actions/checkout@v4
        with:
          submodules: ${{ inputs.checkout-submodules }}

      - uses: milaboratory/github-ci/actions/env@v4
        with:
          inputs: ${{ inputs.env }}
          secrets: ${{ secrets.env }}

      - uses: actions/checkout@v4
        with:
          submodules: ${{ inputs.checkout-submodules }}

      - name: Add MiLab shell utils to PATH
        uses: milaboratory/github-ci/actions/milab-shell-utils@v4

      - id: npm-pkg-metadata
        uses: milaboratory/github-ci/actions/shell@v4
        with:
          run: |
            NPM_PKG_VERSION="$(cat "${GITHUB_WORKSPACE}/package.json" | jq --raw-output '.version')"
            PNPM_PKG_VERSION="$(cat "${GITHUB_WORKSPACE}/package.json" | jq --raw-output 'if .packageManager and (.packageManager | length > 0) then .packageManager | split("@")[1] else empty end')"
            ghwa_set_output npm-pkg-version "${NPM_PKG_VERSION}"
            ghwa_set_output pnpm-pkg-version "${PNPM_PKG_VERSION}"

      - uses: aws-actions/configure-aws-credentials@v4
        if: inputs.aws-login-enable
        with:
          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE || env.AWS_CI_IAM_MONOREPO_SIMPLE_ROLE }}
          aws-region: ${{ secrets.AWS_ASSUME_REGION || inputs.aws-region }}

      - id: login-ecr
        if: inputs.aws-login-enable
        uses: aws-actions/amazon-ecr-login@v2
        with:
          mask-password: "true"

      - uses: milaboratory/github-ci/actions/turborepo/cache@v4

      - uses: milaboratory/github-ci/blocks/node/build-and-test-pnpm@v4
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN  }}
          PNPM_PKG_VERSION: ${{ fromJSON(steps.npm-pkg-metadata.outputs.data).pnpm-pkg-version }}
        with:
          build-script-name: ${{ inputs.build-script-name }}
          tests: "false"
          test-script-name: ${{ inputs.test-script-name }}
          pnpm-recursive-build: ${{ inputs.pnpm-recursive-build }}
          pnpm-recursive-tests: ${{ inputs.pnpm-recursive-tests }}
          pnpm-build-args: ${{ inputs.pnpm-build-args }}
          pnpm-tests-args: ${{ inputs.pnpm-tests-args }}
          node-version: ${{ inputs.node-version }}
          cache-version: ${{ inputs.cache-version }}
          cache-hashfiles-search-path: ${{ inputs.cache-hashfiles-search-path }}
          pnpm-version: ${{ env.PNPM_PKG_VERSION || inputs.pnpm-version }}
          npmrc-config: ${{ inputs.npmrc-config }}

      - id: test
        uses: milaboratory/github-ci/blocks/pl/linux/test-pl-docker-pnpm@v4
        if: inputs.test
        env:
          PL_ADDRESS: "http://127.0.0.1:6345"
          PL_TEST_USER: ${{ env.PL_CI_TEST_USER }}
          PL_TEST_PASSWORD: ${{ env.PL_CI_TEST_PASSWORD }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN  }}
          PNPM_PKG_VERSION: ${{ fromJSON(steps.npm-pkg-metadata.outputs.data).pnpm-pkg-version }}
        with:
          test-script-name: ${{ inputs.test-script-name }}
          pnpm-recursive-tests: ${{ inputs.pnpm-recursive-tests }}
          pnpm-tests-args: ${{ inputs.pnpm-tests-args }}
          node-version: ${{ inputs.node-version }}
          cache-version: ${{ inputs.cache-version }}
          pnpm-version: ${{ env.PNPM_PKG_VERSION || inputs.pnpm-version }}
          cache-hashfiles-search-path: ${{ inputs.cache-hashfiles-search-path }}
          npmrc-config: ${{ inputs.npmrc-config }}
          pl-auth-enabled: ${{ inputs.pl-auth-enabled }}
          pl-docker-registry: ${{ format('{0}/{1}', steps.login-ecr.outputs.registry, 'pl') }}
          pl-docker-tag: ${{ inputs.pl-docker-tag }}
          pl-test-assets-dir: ${{ inputs.pl-test-assets-dir }}
          pl-log-dir: ${{ inputs.pl-log-dir }}
          pl-log-level: ${{ inputs.pl-log-level }}
          pl-log-commit-summary: ${{ inputs.pl-log-commit-summary }}
          pl-log-resource-data: ${{ inputs.pl-log-resource-data }}

      - name: Configure GCP credentials
        uses: google-github-actions/auth@v2
        if: inputs.gcp-login-enable
        with:
          workload_identity_provider: ${{ secrets.GCP_KMS_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_KMS_SERVICE_ACCOUNT }}
          token_format: "access_token"

      - name: Set up GCloud SDK
        uses: google-github-actions/setup-gcloud@v2
        if: inputs.gcp-login-enable
        with:
          version: ${{ inputs.gcp-sdk-version }}

      - name: Create Release Pull Request and Publish npm package (Public)
        if: steps.context.outputs.is-release == 'true' && inputs.publish-to-public == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN }}
        uses: changesets/action@v1
        with:
          commit: "chore: update versions"
          title: "chore: update versions"
          publish: pnpm -r publish --no-git-checks --access public

      - name: Create Release Pull Request and Publish npm package
        if: steps.context.outputs.is-release == 'true' && inputs.publish-to-public == 'false'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN }}
          GCP_KMS_KEY_VERSION: ${{ inputs.gcp-kms-key-version }}
          GCP_KMS_KEY_NAME: ${{ secrets.GCP_KMS_KEY_NAME }}
          GCP_KMS_KEYRING: ${{ secrets.GCP_KMS_KEYRING }}
          GCP_KMS_LOCATION: ${{ secrets.GCP_KMS_LOCATION }}
          GCP_KMS_DIGEST_ALGORITHM: ${{ inputs.gcp-kms-digest-algorithm }}
        uses: changesets/action@v1
        with:
          commit: "chore: update versions"
          title: "chore: update versions"
          publish: pnpm -r publish --no-git-checks

    outputs:
      # Even constant outputs become initialized only after job start.
      # All outputs of skipped jobs are always empty.
      npm-pkg-version: ${{ fromJSON(steps.npm-pkg-metadata.outputs.data).npm-pkg-version }}
      started: "true"

  notify-release:
    name: notify release
    runs-on: ubuntu-latest

    if: always()
    needs:
      - init
      - build-test-publish

    steps:
      - id: search-tags
        if: always()
        uses: milaboratory/github-ci/actions/strings/json-list@v4
        with:
          input: |
            release

      - uses: milaboratory/github-ci/blocks/notify/release@v4
        env:
          NPM_PKG_VERSION: ${{ needs.build-test-publish.outputs.npm-pkg-version }}
        with:
          telegram-target: ${{ secrets.TELEGRAM_NOTIFICATION_TARGET }}
          telegram-token: ${{ secrets.TELEGRAM_API_TOKEN }}
          job-status: |
            ${{ needs.build-test-publish.result }}
          product-name: ${{ inputs.app-name }}
          override-version: ${{ format('{0}', env.NPM_PKG_VERSION) }}
          override-tag: ${{ format('v{0}', env.NPM_PKG_VERSION) }}
          search-tags: ${{ steps.search-tags.outputs.result }}