main.yml

name: main

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  release:
    types:
      - prereleased
      - released
  workflow_dispatch:
    inputs:
      version:
        description: Application version to use when publishing the project
        required: false

env:
  # Setting these variables allows .NET CLI to use rich color codes in console output
  TERM: xterm
  DOTNET_SYSTEM_CONSOLE_ALLOW_ANSI_COLOR_REDIRECTION: true
  # Skip boilerplate output
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true

# Note that as much as we'd love to avoid repetitive work, splitting the pipeline into separate jobs
# makes it very difficult to share artifacts between them. Even if we succeed, we'll still end up
# pushing and pulling gigabytes worth of data, which makes the jobs so much slower that we might as
# well just repeat the checkout-restore-build steps instead.

# Having a setup that involves separate jobs gives us significant benefits, on the other hand, namely:
# - Most of the jobs can run in parallel, which reduces the overall execution time significantly,
#   despite the repetitive work.
# - We can catch more issues this way, for example if the formatting job fails, we can still see the
#   the test results too.
# - If one of the jobs fails due to reasons unrelated to our code (e.g. NuGet server is down), we get
#   the option to rerun only that job, saving us time.
# - It's easier to understand what each job does (and later, read its output) because the scope is much
#   more narrow.
# - We can set permissions on a more granular (per-job) level, which allows us to expose only a few select
#   steps to more sensitive access scopes.

jobs:
  # Determine version
  version:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Determine stable version
        id: stable-version
        if: ${{ inputs.version || github.event_name == 'release' }}
        run: |
          version="${{ inputs.version || github.event.release.tag_name }}"

          if ! [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z].*)?$ ]]; then
              echo "Invalid version: $version"
              exit 1
          fi

          echo "version=$version" >> $GITHUB_OUTPUT

      - name: Determine prerelease version
        id: pre-version
        run: |
          hash="${{ github.event.pull_request.head.sha || github.sha }}"
          echo "version=0.0.0-ci-${hash:0:7}" >> $GITHUB_OUTPUT

    outputs:
      version: ${{ steps.stable-version.outputs.version || steps.pre-version.outputs.version }}

  # Check formatting
  format:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install .NET
        uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0

      - name: Validate format
        run: dotnet format --verify-no-changes

  # Run tests
  check-test-secrets:
    name: Check for test secrets
    runs-on: ubuntu-24.04
    outputs:
      available: ${{ steps.check-test-secrets.outputs.available }}
    permissions:
      contents: read

    steps:
      - name: Check
        id: check-test-secrets
        run: |
          if [ "${{ secrets.CODECOV_TOKEN }}" != '' ]; then
            echo "available=true" >> $GITHUB_OUTPUT;
          else
            echo "available=false" >> $GITHUB_OUTPUT;
          fi

  test:
    runs-on: ubuntu-24.04
    needs: check-test-secrets
    permissions:
      checks: write
      contents: read
      pull-requests: write

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install .NET
        uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0

      - name: Run restore
        run: dotnet restore
        
      - name: Add node_modules/.bin to PATH
        run: echo "NODE_PATH=$(pwd)/node_modules/.bin" >> $GITHUB_ENV

      - name: Run build
        run: >
          dotnet build
          --no-restore
          --configuration Release

      - name: Run tests
        # The next step will fail if any tests fail, but we still want to publish the results
        continue-on-error: true
        run: >
          dotnet test
          --no-restore
          --no-build
          --configuration Release
          --logger "trx;LogFileName=pw-test-results.trx"
          --collect:"XPlat Code Coverage"
          --
          RunConfiguration.CollectSourceInformation=true
          DataCollectionRunSettings.DataCollectors.DataCollector.Configuration.Format=opencover
        env:
          ASPNETCORE_ENVIRONMENT: Development # For Serilog passthrough

      - name: Report test results
        uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5 # v1.9.1
        if: ${{ needs.check-test-secrets.outputs.available == 'true' && !cancelled() }}
        with:
          name: Test Results
          path: "**/*-test-results.trx"
          reporter: dotnet-trx
          fail-on-error: true

      - name: Upload to codecov.io
        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        if: ${{ needs.check-test-secrets.outputs.available == 'true' }}
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  # Publish the apps
  pack:
    needs: version

    strategy:
      matrix:
        app:
          - Api
          - AdminConsole

    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install .NET
        uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0

      - name: Install NodeJS
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: lts/*

      - name: Publish app
        run: >
          dotnet publish src/${{ matrix.app }}/
          -p:Version=${{ needs.version.outputs.version }}
          --configuration Release
          --runtime win-x86
          --no-self-contained
          --output src/${{ matrix.app }}/publish/

      - name: Upload artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: ${{ matrix.app }}
          path: src/${{ matrix.app }}/publish/

  # Dispatches a separate deployment workflow in a private repository
  deploy:
    if: ${{ github.event_name != 'pull_request' }}

    needs:
      - version
      - format
      - test
      - pack

    strategy:
      matrix:
        environment:
          - devtest
          - qa
          - prod
        exclude:
          # Deploy to QA on pre-releases and stable releases
          - environment: ${{ !(github.event_name == 'release') && 'qa' }}
          # Deploy to PROD on stable release only
          - environment: ${{ !(github.event_name == 'release' && github.event.action == 'released') && 'prod' }}
          # Deploy to DEVTEST every time

    runs-on: ubuntu-latest
    permissions: {} # no permissions required

    steps:
      - name: Log in to Azure - CI subscription
        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve GitHub PAT secrets
        id: retrieve-secret-pat
        uses: bitwarden/gh-actions/get-keyvault-secrets@main
        with:
          keyvault: "bitwarden-ci"
          secrets: "github-pat-bitwarden-devops-bot-repo-scope"

      - name: Dispatch deployment
        env:
          GITHUB_TOKEN: ${{ steps.retrieve-secret-pat.outputs.github-pat-bitwarden-devops-bot-repo-scope }}
        run: >
          gh workflow run deploy-passwordless-server
          --repo bitwarden/passwordless-devops
          --field repository=${{ github.repository }}
          --field run-id=${{ github.run_id }}
          --field api-artifact=Api
          --field admin-console-artifact=AdminConsole
          --field environment=${{ matrix.environment }}
          --field version=${{ needs.version.outputs.version }}