main.yml

name: Build

on:
  push:
    branches:
      - main
    paths:
      - src/**
      - static/**
      - package.json
      - pnpm-lock.yaml
      - "*.config.*s"
      - tsconfig.json
      - .github/workflows/*
  pull_request:
    paths:
      - src/**
      - static/**
      - package.json
      - pnpm-lock.yaml
      - "*.config.*s"
      - tsconfig.json
      - .github/workflows/*

# Start the workflow
jobs:
  permissions-check:
    name: Permissions check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'

    steps:
      - name: ❓ Has access to secrets?
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.repository.full_name }}
          ref: ${{ github.head_ref }}
          token: ${{ secrets.WORKFLOW_PAT }}

  prechecks:
    name: Pre-checks
    runs-on: ubuntu-latest
    needs: permissions-check
    if: github.event_name == 'pull_request' && !cancelled()
    permissions:
      contents: write

    steps:
      - name: 📂 Checkout
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.repository.full_name }}
          ref: ${{ github.head_ref }}
          token: ${{ needs.permissions-check.result == 'failure' && github.token || secrets.WORKFLOW_PAT }}

      - name: 📥 Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: latest

      - name: 🧭 Setup Node
        uses: actions/setup-node@v3
        with:
          node-version: latest
          cache: pnpm

      - name: 📥 Install NPM dependencies
        run: pnpm i --no-frozen-lockfile

      - name: 🔍 Detect file changes
        id: detect-changes-pnpm
        run: |
          if [[ $(git diff --name-only) =~ pnpm-lock.yaml ]]; then
            echo "changes_detected=true >> $GITHUB_OUTPUT"
          else
            echo "changes_detected=false >> $GITHUB_OUTPUT"
          fi

      - name: ❌ Exit if lock file is not updated
        if: needs.permissions-check.result == 'failure' && steps.detect-changes-pnpm.outputs.changes_detected == 'true'
        run: exit 1

      - name: 📤 Commit updated lock file
        id: auto-commit-action-lock
        if: needs.permissions-check.result != 'failure'
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Update lock file
          file_pattern: pnpm-lock.yaml

      - name: ❌ Exit if lock file has been committed
        if: needs.permissions-check.result != 'failure' && steps.auto-commit-action-lock.outputs.changes_detected == 'true'
        run: exit 1

      - name: ✨ Check Svelte format
        run: pnpm check

      - name: ✨ Check style with Prettier & ESLint
        id: lint-check
        run: pnpm lint

      - name: 🔧 Fix lint
        if: failure() && needs.permissions-check.result != 'failure'
        run: pnpm format

      - name: 📤 Commit lint fixes
        if: failure() && needs.permissions-check.result != 'failure'
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Fix lint

  build:
    name: Build website
    runs-on: ubuntu-latest
    needs: prechecks
    if: (!failure() && !cancelled()) || github.event_name == 'push'

    steps:
      - name: 📂 Checkout
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.repository.full_name }}
          ref: ${{ github.head_ref }}

      - name: 📥 Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: latest

      - name: 🧭 Setup Node
        uses: actions/setup-node@v3
        with:
          node-version: latest
          cache: pnpm

      - name: 📥 Install NPM dependencies
        run: pnpm i # no need for `--no-frozen-lockfile` here, as the sync is ensured by the `prechecks` job

      - name: 🔨 Build repo
        run: pnpm build