deploy.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Deploy
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:
    inputs:
      update-snapshots:
        description: "Regenerate Playwright screenshot baselines and commit them to this branch"
        type: boolean
        default: false

jobs:
  deploy:
    permissions:
      actions: read
      contents: read
      deployments: write
      pull-requests: write
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      url: ${{ steps.deploy_cloudflare.outputs.url}}
      playwright-version: ${{ steps.playwright.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 #v6.1.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 #v7.1.0
        with:
          node-version-file: "package.json"
          cache: "pnpm"
      - name: Cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0
        with:
          path: |
            ~/.cache/
          key: ${{ runner.os }}-node-${{ hashFiles('**/pnpm-lock.yaml', '**/eslint.config.js', '**/prettier.config.js', '**/www/tsconfig.json', 'prek.toml') }}
      - run: pnpm install
      - name: Get Playwright version
        id: playwright
        run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
      # Same hooks as the local pre-commit stage (Prettier, ESLint, actionlint,
      # zizmor, ...). no-commit-to-branch would fail every push to main.
      - run: pnpm exec prek run --all-files --show-diff-on-failure
        env:
          SKIP: no-commit-to-branch
      - run: pnpm run test && pnpm run build
        working-directory: ./www
      - name: "Deploy to Cloudflare Pages"
        id: deploy_cloudflare
        uses: andykenward/github-actions-cloudflare-pages@f3b833c8f206f03c6ce74daea7a6fa8ae5c279ff #v3.6.1
        with:
          cloudflare-api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          cloudflare-account-id: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
          cloudflare-project-name: ${{ vars.CLOUDFLARE_PROJECT_NAME }}
          directory: dist
          working-directory: www
          github-token: ${{ secrets.GITHUB_TOKEN }}
          github-environment: ${{ (github.ref == 'refs/heads/main' && 'production') || 'preview' }}
      - name: "Deploy deletion from Cloudflare Pages"
        uses: andykenward/github-actions-cloudflare-pages/delete@f3b833c8f206f03c6ce74daea7a6fa8ae5c279ff #v3.6.1
        if: github.ref == 'refs/heads/main'
        with:
          cloudflare-api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          keep-latest: 2
  playwright:
    permissions:
      actions: read
    needs:
      - deploy
    timeout-minutes: 5
    runs-on: ubuntu-latest
    container:
      # Match the installed @playwright/test so browsers and screenshot
      # baselines stay in sync when it is bumped.
      image: mcr.microsoft.com/playwright:v${{ needs.deploy.outputs.playwright-version }}-noble
      options: --user 1001
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 #v6.1.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 #v7.1.0
        with:
          node-version-file: "package.json"
          cache: "pnpm"
      # Tests run against the deployed URL, so www's dependencies aren't needed.
      - run: pnpm install --filter unlike-dev
      - name: Run Playwright tests
        # "all" rewrites every baseline. The default only rewrites ones that
        # fail, so a change inside the pixel tolerance would never land.
        run: pnpm exec playwright test ${{ inputs.update-snapshots && '--update-snapshots=all' || '' }}
        env:
          CLOUDFLARE_ACCESS_CLIENT_ID: ${{ secrets.CLOUDFLARE_ACCESS_CLIENT_ID }}
          CLOUDFLARE_ACCESS_CLIENT_SECRET: ${{ secrets.CLOUDFLARE_ACCESS_CLIENT_SECRET }}
          PLAYWRIGHT_TEST_BASE_URL: ${{ needs.deploy.outputs.url }}
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7.0.2
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 30
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7.0.2
        if: ${{ inputs.update-snapshots }}
        with:
          name: playwright-snapshots
          path: tests/screenshots/
          retention-days: 7
  commit-snapshots:
    if: ${{ inputs.update-snapshots }}
    permissions:
      contents: write
    needs:
      - playwright
    timeout-minutes: 5
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2
        with:
          name: playwright-snapshots
          path: tests/screenshots/
      # Commit through the GraphQL API rather than git push so GitHub signs it.
      - name: Commit updated screenshot baselines
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          git add tests/screenshots/
          files=$(git diff --cached --name-only)
          if [ -z "$files" ]; then
            echo "Screenshot baselines unchanged."
            exit 0
          fi
          for f in $files; do
            base64 -w0 "$f" | jq -Rc --arg path "$f" '{path: $path, contents: .}'
          done > "$RUNNER_TEMP/additions.jsonl"
          jq -n \
            --arg repo "$GITHUB_REPOSITORY" \
            --arg branch "$GITHUB_REF_NAME" \
            --arg oid "$(git rev-parse HEAD)" \
            --slurpfile additions "$RUNNER_TEMP/additions.jsonl" \
            '{
              query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { url } } }",
              variables: {input: {
                branch: {repositoryNameWithOwner: $repo, branchName: $branch},
                expectedHeadOid: $oid,
                message: {headline: "test: update Playwright screenshot baselines"},
                fileChanges: {additions: $additions}
              }}
            }' > "$RUNNER_TEMP/request.json"
          gh api graphql --input "$RUNNER_TEMP/request.json" --jq .data.createCommitOnBranch.commit.url