fix: no openshock.app production defaults #1293
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| on: | |
| push: | |
| branches: | |
| - '**' | |
| tags: | |
| # Release + rc semver tags. Prereleases build & publish but never move `latest`. | |
| - '[0-9]+.[0-9]+.[0-9]+' | |
| - '[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+' | |
| pull_request: | |
| branches: | |
| - '**' | |
| types: [opened, reopened, synchronize] | |
| workflow_dispatch: # Manually invoked by user. | |
| name: ci-build | |
| jobs: | |
| test: | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| name: Install pnpm | |
| with: | |
| run_install: false | |
| - name: Install Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| shell: bash | |
| run: pnpm install --frozen-lockfile --strict-peer-dependencies | |
| - name: Check | |
| shell: bash | |
| run: pnpm run check | |
| # TODO: Uncomment when e2e tests are enabled (pnpm test). Consider caching | |
| # Playwright browsers with actions/cache keyed on the Playwright version. | |
| #- name: Install playwright | |
| # shell: bash | |
| # run: pnpx playwright install --with-deps | |
| - name: Test | |
| shell: bash | |
| #run: pnpm test # TODO: Run dev full infra containers locally, seed them with data, and run tests against them. (alotta work, but worth it) | |
| run: pnpm test:unit | |
| build-container: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: test | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: recursive | |
| # Decide whether this tag is the newest release (final versions only, no rc), | |
| # so we only move `latest` when it actually is. Done locally from git tags — | |
| # no API calls, so no rate-limit / network failure can block the publish. | |
| - name: Determine if this is the newest release | |
| id: latest-tag | |
| if: github.ref_type == 'tag' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| git fetch --tags --force --quiet | |
| newest="$(git tag --list --sort=-v:refname | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true)" | |
| echo "Newest release tag: ${newest:-<none>}; this ref: ${GITHUB_REF_NAME}" | |
| if [ "$newest" = "$GITHUB_REF_NAME" ]; then | |
| echo "is-latest=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "is-latest=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - uses: ./.github/actions/containerize | |
| with: | |
| registry: ghcr.io | |
| registry-path: ${{ github.repository_owner }}/frontend | |
| registry-username: ${{ github.actor }} | |
| registry-password: ${{ secrets.GITHUB_TOKEN }} | |
| # Push on tag pushes (semver releases) and on master/develop branch pushes. Never on PRs. | |
| push-image: ${{ github.event_name != 'pull_request' && (github.ref_type == 'tag' || github.ref_name == 'master' || github.ref_name == 'develop') }} | |
| # Move `latest` only when this tag is the newest release (not an rc, not a hotfix to an old version). | |
| latest: ${{ steps.latest-tag.outputs.is-latest == 'true' }} |