webclient-cicd.yml

name: Webclient CI/CD

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-webclient
  cancel-in-progress: true

on:
  pull_request:
    branches: [ main ]
    types: [ opened, reopened, synchronize ]
  push:
    branches: [ main ]
  workflow_dispatch:

jobs:
  lint:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with: {persist-credentials: false}
      - uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6.0.0
        with:
          version: 10.14.0
          package_json_file: webclient/package.json
          run_install: |
            - cwd: webclient
              args: [--frozen-lockfile, --strict-peer-dependencies]
            - args: [--global, openapi-format]
      - run: pnpm run lint
        working-directory: webclient
      - run: pnpm run type-check
        working-directory: webclient
  build:
    uses: ./.github/workflows/_docker-build.yml
    with:
      image_suffix: webclient
      context: ./webclient
      dockerfile: Dockerfile
    permissions:
      id-token: write
      contents: read
      packages: write
      attestations: write

  # This final step is needed to mark the whole workflow as successful
  # Don't change its name - it is used by the merge protection rules
  done:
    name: Finished webclient CI
    runs-on: ubuntu-latest
    needs: [ build, lint ]
    if: always()
    permissions: {}
    steps:
      - name: Result of the needed steps
        run: echo "${{ toJSON(needs) }}" # zizmor: ignore[template-injection]
      - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
        name: CI Result
        run: exit 1