update-nutrient-sdk.yml

name: Update Nutrient SDK

on:
  schedule:
    # Daily, deliberately off the hour: GitHub deprioritises schedules that
    # bunch on :00, which delays them further.
    - cron: "17 6 * * *"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to bump to. Defaults to the npm latest dist-tag."
        required: false
        type: string

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  update:
    timeout-minutes: 90
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .tool-versions

      - name: Check for a new SDK release
        id: check
        env:
          GH_TOKEN: ${{ github.token }}
          REQUESTED_VERSION: ${{ inputs.version }}
        run: ./scripts/check-nutrient-update.sh "${REQUESTED_VERSION:-}"

      - name: Bump the SDK in every example
        if: steps.check.outputs.should_update == 'true'
        env:
          VERSION: ${{ steps.check.outputs.version }}
        run: ./scripts/update-nutrient-in-examples.sh "$VERSION"

      - name: Check every CDN reference was bumped
        if: steps.check.outputs.should_update == 'true'
        env:
          VERSION: ${{ steps.check.outputs.version }}
        run: |
          # The CDN file map in update-nutrient-in-cdn.js is hand-maintained, so an
          # example that gains a script tag without an entry is left behind in
          # silence. examples/salesforce/README.md is exempt: its version is an
          # illustration, not a pin.
          #
          # -o prints one match per line rather than one line per match, so a
          # line carrying both a bumped and a stale reference cannot have the
          # stale one dropped along with the whole line. The exclusion escapes
          # the dots in ${VERSION} and anchors on $, so 1.20.1 cannot swallow a
          # stale 1.20.10 as a prefix of it.
          stale="$(grep -rEon "pspdfkit-web@[0-9]+\.[0-9]+\.[0-9]+" examples/ \
            --exclude-dir=node_modules --exclude-dir=dist \
            --exclude-dir=.next --exclude-dir=.nuxt \
            | grep -vE "pspdfkit-web@${VERSION//./\\.}$" \
            | grep -v '^examples/salesforce/README.md:' || true)"

          if [ -n "$stale" ]; then
            echo "CDN references not updated to ${VERSION}:" >&2
            echo "$stale" >&2
            exit 1
          fi

      - name: Install root dependencies
        if: steps.check.outputs.should_update == 'true'
        run: pnpm install --frozen-lockfile

      - name: Format
        if: steps.check.outputs.should_update == 'true'
        run: pnpm run format

      - name: Install Playwright browsers
        if: steps.check.outputs.should_update == 'true'
        run: pnpm exec playwright install chromium --with-deps

      # A pull request opened with GITHUB_TOKEN does not trigger the Biome or
      # Playwright workflows, and main requires no status checks, so the bump
      # would otherwise arrive with no signal at all.
      - name: Run e2e smoke tests
        id: e2e
        if: steps.check.outputs.should_update == 'true'
        continue-on-error: true
        run: pnpm run e2e-tests

      - name: Upload Playwright report
        if: steps.check.outputs.should_update == 'true' && steps.e2e.outcome != 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 30

      - name: Commit and push the bump
        if: steps.check.outputs.should_update == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.check.outputs.version }}
          BRANCH: ${{ steps.check.outputs.branch }}
        run: |
          # `pnpm run format` writes unsafe Biome fixes repository-wide, and a dev
          # server may leave build output behind; neither belongs in a bump.
          git add -u examples/
          if git diff --cached --quiet; then
            echo "Detection reported ${VERSION} was needed but nothing changed." >&2
            exit 1
          fi
          # The base branch requires signed commits and the runner holds no
          # signing key, so the commit is made through the API, which GitHub
          # signs itself.
          node scripts/commit-signed.js "$BRANCH" \
            "Update examples with Nutrient SDK version $VERSION"

      - name: Open the pull request
        if: steps.check.outputs.should_update == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.check.outputs.version }}
          CURRENT: ${{ steps.check.outputs.current }}
          BRANCH: ${{ steps.check.outputs.branch }}
          E2E_OUTCOME: ${{ steps.e2e.outcome }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          BASE: ${{ github.ref_name }}
        run: |
          if [ "$E2E_OUTCOME" = "success" ]; then
            e2e_result="✅ passed"
            draft=""
          else
            e2e_result="❌ failed. The failing examples are named at the end of the run log."
            draft="--draft"
          fi

          cat > /tmp/pr-body.md <<BODY
          Automated bump of \`@nutrient-sdk/viewer\` from ${CURRENT} to ${VERSION}.

          ## Verification

          Checks ran inside the workflow before this pull request was opened. A
          pull request created by \`GITHUB_TOKEN\` does not trigger the Biome or
          Playwright workflows, so the checks tab here will be empty.

          - Dependency audit fixes: pnpm examples may include security overrides
            in \`pnpm-workspace.yaml\` and the corresponding lockfile updates
          - Formatting (\`pnpm run format\`): applied to \`examples/\`
          - E2E smoke tests (\`pnpm run e2e-tests\`): ${e2e_result}

          [Workflow run](${RUN_URL})
          BODY

          # Nothing retries a draft. The scheduled job treats any pull request
          # for this branch as "handled" whatever its state, so without these
          # instructions the version is parked on whoever opens the draft next,
          # with no way to re-run the suite from the pull request itself.
          if [ "$E2E_OUTCOME" != "success" ]; then
            cat >> /tmp/pr-body.md <<RECOVERY

          ## This draft needs a human

          The e2e suite failed, so this was opened as a draft and GitHub did not
          request code owners on it. It will not retry on its own: every future
          scheduled run sees this pull request and skips ${VERSION}. Re-running
          the workflow for ${VERSION} will not help either, for the same reason.

          Pick one:

          - **You want the checks to run here.** Close this pull request and
            reopen it. Reopening it yourself fires \`pull_request: reopened\`,
            which the Biome and Playwright workflows act on, so they run against
            this bump and report in the checks tab. Marking a draft ready for
            review triggers nothing, so it is not a substitute.
          - **The bump needs a fix.** Push it to \`${BRANCH}\`. A push from
            your own account runs those same checks. Then mark this ready for
            review.
          - **The bump is genuinely broken.** Close this pull request and leave
            the branch in place. ${VERSION} will not be proposed again.
          RECOVERY
          fi

          gh pr create \
            --title "Update examples with Nutrient SDK version $VERSION" \
            --body-file /tmp/pr-body.md \
            --base "$BASE" \
            --head "$BRANCH" \
            $draft

      - name: Fail the run when the e2e suite failed
        if: steps.check.outputs.should_update == 'true' && steps.e2e.outcome != 'success'
        env:
          VERSION: ${{ steps.check.outputs.version }}
        run: |
          echo "::error::E2E failed for ${VERSION}. The pull request was opened as a draft,"
          echo "::error::and GitHub does not request code owners on drafts."
          exit 1