ci.yml

name: run-ci
on:
  push:
    branches:
      - main
  pull_request_target:
    branches:
      - main
    types:
      - opened
      - synchronize
      - labeled
# cancel in-progress runs on new commits to same PR (gitub.event.number)
concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
  cancel-in-progress: true
jobs:
  verify-run:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write # used to remove label
      contents: read
    # We run CI only if the event is a:
    #   1) pull request not from a fork (ie. internal PR), or
    #   2) pull request from a fork (ie. external PR) that was added "action: run-ci" label
    if: |
      (github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event.action == 'labeled' && github.event.label.name == 'run-ci')
    steps:
      - name: remove label, if applicable
        if: always() && github.event.label.name == 'run-ci'
        uses: actions/github-script@v6
        with:
          script: |
            const { issue: { number: issue_number }, repo: { owner, repo } } = context;
            const label = 'run-ci';
            github.rest.issues.removeLabel({ owner, repo, issue_number, name: label });
  ci:
    runs-on: ubuntu-latest
    needs: verify-run
    environment: ci
    env:
      DATABASE_URL: 'file:data/test.db'
      VITE_NEXTAUTH_URL: 'http://localhost:3000'
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          persist-credentials: false
      - uses: pnpm/action-setup@v2
      - uses: actions/setup-node@v3
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile --silent
      - run: pnpm lint
      # build ./packages/*
      - run: pnpm build:lib
      # build SvelteKit app and Server
      - run: pnpm build
        env:
          NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
          VITE_HOST: ${{ secrets.VITE_HOST }}
          VITE_NEXTAUTH_URL: ${{ secrets.VITE_NEXTAUTH_URL }}
          VITE_DISCORD_GUILD_ID: ${{ secrets.VITE_DISCORD_GUILD_ID }}
      - run: pnpm prisma db push
        env:
          DATABASE_URL: 'file:data/test.db'
      - run: pnpm test
        env:
          DISCORD_GUILD_ID: ${{ secrets.VITE_DISCORD_GUILD_ID }}
          DISCORD_WEBHOOK_URL_RELEASES: ${{ secrets.DISCORD_WEBHOOK_URL_RELEASES }}
          DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
          NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
          GITHUB_WEBHOOK_SECRET: ${{ secrets.GH_WEBHOOK_SECRET }}
          GITHUB_APP_ID: ${{ secrets.GH_APP_ID }}
          GITHUB_CLIENT_ID: ${{ secrets.GH_CLIENT_ID }}
          GITHUB_CLIENT_SECRET: ${{ secrets.GH_CLIENT_SECRET }}
          GITHUB_PRIVATE_KEY: ${{ secrets.GH_PRIVATE_KEY }}
          GITHUB_INSTALLATION_ID: ${{ secrets.GH_INSTALLATION_ID }}
          GITHUB_ORG_LOGIN: ${{ secrets.GH_ORG_LOGIN }}
          VITE_HOST: ${{ secrets.VITE_HOST }}
          VITE_NEXTAUTH_URL: ${{ secrets.VITE_NEXTAUTH_URL }}
          VITE_DISCORD_GUILD_ID: ${{ secrets.VITE_DISCORD_GUILD_ID }}