ci.yml

name: CI

on:
  pull_request:
    branches:
      - production

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  compile:
    name: Compiles
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: "npm"
      - uses: actions/cache/restore@v5
        with:
          path: |
            node_modules/.astro/assets
          key: static

      - run: |
          FILES=$(
            find src/content \
              -type f \
              -not -name '*.mdx' \
              -not -name '*.md' \
              -not -name '*.json' \
              -not -name '*.yml' \
              -not -name '*.yaml' \
              -not -name '*.txt' \
              -not -wholename 'src/content/collections/*'
          )

          if [ -n "$FILES" ]; then
            echo "Found files with invalid file extensions:\n\n$FILES"
            exit 1
          fi

      - run: npm ci

      - run: npx tsx bin/post-codeowners-comment/index.ts
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - run: npm run check

      - uses: reviewdog/action-eslint@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          reporter: github-pr-review
          fail_level: error
          filter_mode: nofilter

      - run: npm run format:core:check
      ## TODO: content formatting checks
      - run: npm run build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RUN_LINK_CHECK: true

      - run: npm run check:worker

      - uses: actions/cache/save@v5
        with:
          path: |
            node_modules/.astro/assets
          key: static

      - name: Check - Validate redirects (infinite loops, sources with fragment)
        run: npx tsm bin/validate-redirects.ts

      - name: Tests
        run: npm run test

      - name: Post PR CI failure comment
        if: always()
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx tsx bin/post-pr-ci-failure-comment/index.ts

  pre-build:
    name: Pre Build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - uses: actions/setup-node@v6
        with:
          node-version: 22.x
          cache: npm

      - name: Check for CRLF line endings
        run: |
          if git grep -Il $'\r'; then
            echo "::error::CRLF line endings detected. Configure your editor to use LF line endings (this repo has an .editorconfig file that most editors respect automatically)."
            exit 1
          fi

      - name: Check for invalid file extensions
        run: |
          FILES=$(
            find src/content \
              -type f \
              -not -name '*.mdx' \
              -not -name '*.md' \
              -not -name '*.json' \
              -not -name '*.yml' \
              -not -name '*.yaml' \
              -not -name '*.txt' \
              -not -wholename 'src/content/collections/*'
          )

          if [ -n "$FILES" ]; then
            echo "Found files with invalid file extensions:\n\n$FILES"
            exit 1
          fi

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

      - name: Install node_modules (cache miss)
        run: npm ci
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - run: npx tsx bin/post-codeowners-comment/index.ts
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - run: npm run check

      - run: npm run check:worker

      - uses: reviewdog/action-eslint@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          reporter: github-pr-review
          fail_level: error
          filter_mode: nofilter

      - run: npm run format:core:check

      - name: Validate redirects
        run: npx tsm bin/validate-redirects.ts

      - name: Tests
        run: npm run test:prebuild

  build:
    name: Build
    needs: pre-build
    runs-on: ubuntu-latest
    outputs:
      link_check_failed: ${{ steps.check_link_result.outputs.failed }}
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - uses: actions/setup-node@v6
        with:
          node-version: 22.x
          cache: npm

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

      - name: Install node_modules (cache miss)
        run: npm ci
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - uses: actions/cache@v5
        with:
          path: |
            node_modules/.astro/assets
          key: static

      # The starlight-links-validator plugin runs in astro:build:done, which fires
      # AFTER all pages have been written to dist/. If link validation fails, the
      # build exits non-zero but dist/ is complete. We use continue-on-error so the
      # job succeeds (allowing deploy + post-build to run), then check the outcome below.
      - run: npm run build
        id: build_step
        name: Build
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RUN_LINK_CHECK: true

      # Distinguish between "link check failed" (dist/ exists) and "real build failure" (no dist/).
      # If the build produced no output, we must fail the job immediately.
      - name: Check build result
        id: check_link_result
        run: |
          if [ ! -d dist ] || [ -z "$(ls -A dist)" ]; then
            echo "Build failed before producing output. Check the Build job logs for the error."
            exit 1
          fi
          if [ "${{ steps.build_step.outcome }}" = "failure" ]; then
            echo "failed=true" >> "$GITHUB_OUTPUT"
            echo "::warning::Build succeeded but link validation failed. Preview will still be deployed."
          else
            echo "failed=false" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist

  post-build:
    name: Post Build
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - uses: actions/setup-node@v6
        with:
          node-version: 22.x
          cache: npm

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

      - name: Install node_modules (cache miss)
        run: npm ci
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist

      - name: Tests (Workers)
        run: npm run test:postbuild

      - name: Link validation
        if: needs.build.outputs.link_check_failed == 'true'
        run: |
          echo "::error::starlight-links-validator found broken internal links during the build. See the Build job logs for details."
          exit 1

  notify:
    name: Notify
    needs: [pre-build, build, post-build]
    if: always()
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - uses: actions/setup-node@v6
        with:
          node-version: 22.x
          cache: npm

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

      - name: Install node_modules (cache miss)
        run: npm ci
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - name: Post PR CI failure comment
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx tsx bin/post-pr-ci-failure-comment/index.ts

  publish-preview:
    name: Deploy Preview
    needs: build
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - uses: actions/setup-node@v6
        with:
          node-version: 22.x
          cache: npm

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

      - name: Install node_modules (cache miss)
        run: npm ci
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist

      - name: Deploy to Cloudflare Workers
        id: deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          SHORT_SHA="${{ github.event.pull_request.head.sha }}"
          SHORT_SHA="${SHORT_SHA:0:8}"
          BRANCH="${{ github.event.pull_request.head.ref }}"
          BRANCH_SLUG=$(echo "$BRANCH" | iconv -c -t ascii//TRANSLIT | sed -E 's/[~^]+//g' | sed -E 's/[^a-zA-Z0-9]+/-/g' | sed -E 's/^-+|-+$//g' | tr A-Z a-z)

          echo "branch_slug=$BRANCH_SLUG" >> "$GITHUB_OUTPUT"

          npx wrangler deploy --dispatch-namespace preview-deployments --name $SHORT_SHA
          npx wrangler deploy --dispatch-namespace preview-deployments --name $BRANCH_SLUG

      - name: Post preview URL on PR
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRANCH_SLUG: ${{ steps.deploy.outputs.branch_slug }}
        run: npx tsx bin/post-preview-url-comment/index.ts
        continue-on-error: true