main.yml

name: Main

on: # yamllint disable-line rule:truthy
  push:
    branches:
    - main
  pull_request:
    branches:
    - main
    types:
    - opened
    - synchronize

jobs:
  build:
    name: Check nuxt build
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Run task
      run: |
        npm run build

  audit:
    name: Check audit
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18

    - name: Run task
      run: |
        npm audit

  all-licenses:
    name: Check all licenses
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Run task
      run: |
        npm run license:all

  prod-licenses:
    name: Check production licenses
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Run task
      run: |
        npm run license:prod

  stylelint:
    name: Check stylelint
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Run task
      run: |
        npm run lint:css

  eslint:
    name: Check eslint
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Run task
      run: |
        npm run lint:js

  typecheck:
    name: Run typecheck
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Prepare nuxt types
      run: |
        npm run prepare

    - name: Run task
      run: |
        npm run typecheck

  yamllint:
    name: Check yamllint
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Setup python
      uses: actions/setup-python@v4
      with:
        python-version: "3.10"

    - name: Install yamllint
      run: |
        pip install --user yamllint

    - name: Run task
      run: |
        yamllint -c .yamllint.yml .

  test:
    name: Run test suite
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version:
        - 16
        - 18

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: ${{ matrix.version }}
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Run task
      run: |
        npm run test

  renovate-pr:
    name: Approve and merge renovate PRs
    runs-on: ubuntu-latest
    if: github.actor == 'renovate[bot]'

    permissions:
      pull-requests: write
      contents: write

    needs:
    - build
    - audit
    - all-licenses
    - prod-licenses
    - stylelint
    - eslint
    - yamllint
    - test
    - typecheck

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Approve PR
      if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        gh pr checkout "${{ github.event.pull_request.html_url }}"
        if [ "$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)" != "APPROVED" ];
        then gh pr review --approve "${{ github.event.pull_request.html_url }}"
        else echo "PR already approved.";
        fi

  deploy:
    if: github.repository == 'DaniFoldi/paintbrush' && github.actor != 'renovate[bot]'
    name: Update production deployment
    runs-on: ubuntu-latest
    permissions:
      contents: read
      deployments: write

    needs:
    - build
    - audit
    - all-licenses
    - prod-licenses
    - stylelint
    - eslint
    - yamllint
    - test
    - typecheck

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Build nuxt
      env:
        NITRO_PRESET: cloudflare-pages
        NODE_ENV: production
      run: |
        npm run build

    - name: Publish to Cloudflare Pages
      uses: cloudflare/pages-action@v1.5.0
      with:
        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        projectName: paintbrush
        directory: .output/public
        githubToken: ${{ secrets.GITHUB_TOKEN }}

  code-analysis:
    name: Run CodeQL analysis
    runs-on: ubuntu-latest

    permissions:
      actions: read
      contents: read
      security-events: write

    needs:
    - build

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        languages: javascript

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - name: Run CodeQL Analysis
      uses: github/codeql-action/analyze@v2

  npm-publish:
    name: Publish to NPM
    runs-on: ubuntu-latest
    if: contains( join( github.event.commits.*.message, ', ' ), '[ci release]' )

    needs:
    - build
    - audit
    - all-licenses
    - prod-licenses
    - stylelint
    - eslint
    - yamllint
    - test
    - typecheck

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Install nodejs
      uses: actions/setup-node@v3
      with:
        node-version: 18
        cache: npm

    - name: Install dependencies
      run: |
        npm ci --no-progress

    - uses: JS-DevTools/npm-publish@v1
      with:
        token: ${{ secrets.NPM_TOKEN }}


# TODO coverage report
# TODO test report
# TODO eslint, stylelint, yamllint report
# TODO new dependency report
# TODO license report
# TODO new contributor welcome
# TODO axe tests