site.ci.yml

name: Site

on:
  push:
    branches:
      - stable
      - v3
      - site/*
  pull_request:
    types: [labeled, opened, reopened, synchronize]
    branches:
      - stable
      - v3
      - site/*
      - release/*

env:
  BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}

permissions:
  contents: read

jobs:
  ##
  ## Job: Site Build
  ##
  site-build:
    name: "Site: Build"
    runs-on: ubuntu-latest
    continue-on-error: false

    permissions:
      contents: "read"
      id-token: "write"
      checks: "write"
      pull-requests: "write"

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: "Setup: QEMU"
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
      - name: "Setup: Docker Buildx"
        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1
      - name: "Setup: GraalVM"
        uses: graalvm/setup-graalvm@0a27862568a8481fbfd3e2ce38c6445e34c0bed4 # v1.1.4
        with:
          components: "native-image,js,wasm"
          distribution: 'graalvm'
          java-version: 20
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - id: "auth"
        name: "Setup: Authorize Service Account"
        uses: google-github-actions/auth@35b0e87d162680511bf346c299f71c9c5c379033 # v1.1.1
        with:
          credentials_json: "${{ secrets.BUILDBOT_SERVICE_ACCOUNT }}"
          create_credentials_file: true
          export_environment_variables: true
          cleanup_credentials: true
      - name: "Setup: Setup Cloud SDK"
        uses: google-github-actions/setup-gcloud@e30db14379863a8c79331b04a9969f4c1e225e0b # v1.1.1
        with:
          version: 389.0.0
          project_id: elide-fw
      - name: "Authorize Docker: GCP"
        run: |
          gcloud auth configure-docker us-docker.pkg.dev
      - name: "Authorize Docker: GHCR"
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ghcr.io
          username: elidebot
          password: ${{ secrets.BUILDBOT_GHCR_TOKEN }}
      - name: "Setup: Node"
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: 18
          cache: "yarn"
      - name: "Setup: Yarn"
        run: yarn
      - name: "Build: Reference Docs"
        env:
          CI: true
        run: |
          make docs reports CI=yes JVM=19
      - name: "Build: Site"
        uses: gradle/gradle-build-action@b5126f31dbc19dd434c3269bf8c28c315e121da2 # v2.8.1
        env:
          CI: true
          GRADLE_CACHE_PUSH: true
        with:
          cache-read-only: false
          arguments: |
            :site:docs:app:build
            :site:docs:app:dockerBuild
            :site:docs:app:dockerPush
            --scan
            --warning-mode=none
            --dependency-verification=lenient
            -Pelide.ci=true
            -Pelide.release=true
            -PbuildSamples=false
            -PbuildDocs=true
            -PbuildDocsSite=true
            -Pversions.java.language=19
            -x test
            -x check
            -x apiCheck
            -x nativeTest
            -x nativeCompile
      - name: "Build: Compress Site"
        run: |
          tar -czf site.tar.gz build/site
      - name: "Upload: Manifest"
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: site-tarball-phase1
          path: ./site.tar.gz
      - name: "Upload: Site"
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: site-manifest
          path: ./site/docs/app/build/generated/ksp/main/resources/elide/runtime/generated/app.manifest.pb

  ##
  ## Job: SSG Compile
  ##
  ssg-compile:
    name: "Site: SSG Compile"
    needs: [site-build]
    runs-on: ubuntu-latest

    permissions:
      contents: "read"
      id-token: "write"
      checks: "write"
      pull-requests: "write"

    services:
      site:
        image: us-docker.pkg.dev/elide-fw/samples/site/docs/jvm:latest
        credentials:
          username: _json_key_base64
          password: ${{  secrets.BUILDBOT_SERVICE_ACCOUNT_B64 }}
        ports:
          - 8080:8080
          - 8443:8443
        options: >-
          --health-cmd "curl --fail http://localhost:8080/"
          --health-interval 10s
          --health-timeout 10s
          --health-retries 4

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: "Setup: QEMU"
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
      - name: "Setup: Docker Buildx"
        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1
      - name: "Setup: GraalVM"
        uses: graalvm/setup-graalvm@0a27862568a8481fbfd3e2ce38c6445e34c0bed4 # v1.1.4
        with:
          components: "native-image,js,wasm"
          distribution: 'graalvm'
          java-version: 20
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - id: "auth"
        name: "Setup: Authorize Service Account"
        uses: google-github-actions/auth@35b0e87d162680511bf346c299f71c9c5c379033 # v1.1.1
        with:
          credentials_json: "${{ secrets.BUILDBOT_SERVICE_ACCOUNT }}"
          create_credentials_file: true
          export_environment_variables: true
          cleanup_credentials: true
      - name: "Setup: Setup Cloud SDK"
        uses: google-github-actions/setup-gcloud@e30db14379863a8c79331b04a9969f4c1e225e0b # v1.1.1
        with:
          version: 389.0.0
          project_id: elide-fw
      - name: "Authorize Docker: GCP"
        run: |
          gcloud auth configure-docker us-docker.pkg.dev
      - name: "Authorize Docker: GHCR"
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ghcr.io
          username: elidebot
          password: ${{ secrets.BUILDBOT_GHCR_TOKEN }}
      - name: "Setup: Node"
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: 18
          cache: "yarn"
      - name: "Setup: Yarn"
        run: yarn
      - name: "Setup: Site Manifest"
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: site-manifest
          path: ./artifacts/
      - name: "Setup: Site Tarball"
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: site-tarball-phase1
          path: .
      - name: "Setup: Expand Site Tarball"
        run: |
          tar -xzf site.tar.gz
      - name: "Setup: Show Artifacts"
        run: ls -R
        working-directory: ./artifacts/
      - name: "Setup: Test Site Container"
        run: |
          curl -vv --fail http://localhost:8080/ || exit 1
      - name: "Build: Compile SSG Site"
        env:
          CI: true
        run: |
          rm -fv ./site/docs/app/build/ssg-site.zip;
          mkdir -p ./site/docs/app/build;
          ./gradlew \
            :packages:ssg:run \
            --warning-mode=none \
            --dependency-verification=lenient \
            -Pelide.ci=true \
            -Pelide.release=true \
            -PbuildSamples=false \
            -PbuildDocs=true \
            -PbuildDocsSite=true \
            -Pversions.java.language=19 \
            --args="--http --ignore-cert-errors --verbose --no-crawl $PWD/artifacts/app.manifest.pb http://localhost:8080 $PWD/site/docs/app/build/ssg-site.zip"
      - name: "Build: Assemble Site"
        run: make site CI=yes JVM=19;
      - name: "Build: Compress Site"
        run: |
          rm -fv site.tar.gz;
          tar -czf site.tar.gz build/site;
      - name: "Upload: Site Tarball"
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: site-tarball-phase2
          path: ./site.tar.gz
      - name: "Upload: Site Artifact"
        uses: actions/upload-pages-artifact@a753861a5debcf57bf8b404356158c8e1e33150c # v2.0.0
        with:
          path: build/site

  ##
  ## Job: Site Deploy
  ##
  site-deploy:
    name: "Site: Deploy"
    runs-on: ubuntu-latest
    needs: [site-build, ssg-compile]
    environment: github-pages
    concurrency: "deploy-pages"
    if: |
      (
        github.ref == 'refs/heads/stable' ||
        github.ref == 'refs/heads/v3' ||
        contains(github.event.pull_request.labels.*.name, 'ci:deploy-site') ||
        contains(github.event.pull_request.labels.*.name, 'ci:deploy') ||
        contains(github.event.head_commit.message, 'ci:deploy-site') ||
        contains(github.event.head_commit.message, 'ci:deploy') ||
        startsWith(github.ref, 'refs/tags/v')
      )

    permissions:
      contents: "read"
      id-token: "write"
      checks: "write"
      pull-requests: "write"
      statuses: "write"
      deployments: "write"
      pages: "write"

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          egress-policy: audit

      - name: "Deploy Site: GitHub Pages"
        id: site-deploy
        uses: actions/deploy-pages@9dbe3824824f8a1377b8e298bafde1a50ede43e5 # v2.0.4