pages-preview.yml

name: Pages preview

on:
  pull_request_target:
    branches:
      - main
    types:
      - opened
      - reopened
      - synchronize

permissions:
  contents: read
  packages: read

jobs:
  identity:
    name: Resolve trusted preview identity
    if: >-
      github.event.pull_request.base.ref == 'main' &&
      github.event.pull_request.base.repo.full_name == github.repository &&
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    outputs:
      branch: ${{ steps.identity.outputs.branch }}
      head_sha: ${{ steps.identity.outputs.head_sha }}
      pull_number: ${{ steps.identity.outputs.pull_number }}
    steps:
      - name: Resolve exact internal pull request
        id: identity
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const pull = context.payload.pull_request
            const repository = `${context.repo.owner}/${context.repo.repo}`
            if (
              pull.state !== 'open' ||
              pull.base.ref !== 'main' ||
              pull.base.repo.full_name !== repository ||
              pull.head.repo?.full_name !== repository
            ) {
              core.setFailed('Preview delivery only accepts an open same-repository PR targeting main.')
              return
            }
            core.setOutput('branch', `preview/client-web/pr-${pull.number}`)
            core.setOutput('head_sha', pull.head.sha)
            core.setOutput('pull_number', String(pull.number))

  deploy:
    name: Deploy pull-request preview
    needs: identity
    concurrency:
      group: pages-preview-client-web-${{ needs.identity.outputs.pull_number }}
      cancel-in-progress: true
    permissions:
      contents: read
      deployments: write
      packages: read
    runs-on: ubuntu-latest
    timeout-minutes: 25
    environment: preview
    steps:
      - name: Checkout the trusted preview controller
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          path: controller
          persist-credentials: false

      - name: Checkout the exact pull-request head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.identity.outputs.head_sha }}
          path: candidate
          persist-credentials: false

      - name: Install the pinned pnpm release
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: 11.11.0

      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: candidate/package.json
          cache: pnpm
          cache-dependency-path: candidate/pnpm-lock.yaml
          registry-url: https://npm.pkg.github.com
          scope: '@inkcre'

      - name: Set up Python and PDM
        uses: pdm-project/setup-pdm@544d7237314ee09c256785bd360f6b30add38b37 # v4.6
        with:
          python-version-file: candidate/.python-version
          version: 2.28.0
          cache: true
          cache-dependency-path: candidate/pdm.lock

      - name: Install frozen preview toolchains
        working-directory: candidate
        run: |
          pnpm install --frozen-lockfile
          pdm install --frozen-lockfile
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PDM_CHECK_UPDATE: 'false'

      - name: Build the exact-head SPA and Module Federation snapshots
        working-directory: candidate
        run: pnpm build

      - name: Build the same-origin Preview Registry facade
        working-directory: candidate
        env:
          PREVIEW_ORIGIN: https://preview-client-web-pr-${{ needs.identity.outputs.pull_number }}.${{ vars.CLOUDFLARE_PAGES_PROJECT }}.pages.dev
        run: |
          pdm run inkcre-ext preview build \
            --inventory .github/preview/extensions.json \
            --public-origin "$PREVIEW_ORIGIN" \
            --output .preview-registry
          cp -R .preview-registry/. apps/client-web/dist/
          cp -R apps/client-web/dist "$GITHUB_WORKSPACE/.pages-preview"

      - name: Deploy to the isolated Pages preview branch
        id: pages
        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          packageManager: pnpm
          wranglerVersion: 4.114.0
          workingDirectory: candidate
          command: >-
            pages deploy ../.pages-preview
            --project-name=${{ vars.CLOUDFLARE_PAGES_PROJECT }}
            --branch=${{ needs.identity.outputs.branch }}
            --commit-hash=${{ needs.identity.outputs.head_sha }}
            --commit-dirty=false