frontend.yml

name: frontend

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

permissions: # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  lint_test_build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18]
    steps:
      # See https://docs.stepsecurity.io/harden-runner/getting-started/ for instructions on
      # configuring harden-runner and identifying allowed endpoints.
      - name: Harden Runner
        uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            *.actions.githubusercontent.com:443
            api.github.com:443
            codecov.io:443
            github.com:443
            registry.npmjs.org:443
            storage.googleapis.com:443
            uploader.codecov.io:443
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm ci
      - run: npm run fmt-frontend-check
      - run: npm run lint

      # Coverage.
      - run: npm run test-frontend:coverage
        env:
          CI: true
      - name: Upload coverage report
        id: uploadCoverage
        continue-on-error: true
        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
        with:
          files: coverage/clover.xml
          flags: frontend
          name: Frontend
          fail_ci_if_error: true
      - name: Upload coverage report - take 2 (if the first attempt fails)
        if: steps.uploadCoverage.outcome == 'failure'
        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
        with:
          files: coverage/clover.xml
          flags: frontend
          name: Frontend
          fail_ci_if_error: true

      # Release build.
      - run: npm run build

  docker_build:
    runs-on: ubuntu-latest
    if: ${{ github.event.type }} == "PullRequest"
    steps:
      # See https://docs.stepsecurity.io/harden-runner/getting-started/ for instructions on
      # configuring harden-runner and identifying allowed endpoints.
      - name: Harden Runner
        uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            *.actions.githubusercontent.com:443
            auth.docker.io:443
            files.pythonhosted.org:443
            github.com:443
            production.cloudflare.docker.com:443
            pypi.org:443
            registry-1.docker.io:443
            registry.npmjs.org:443
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0
      - name: Build frontend
        run: |
          deploy/scripts/build.py --components frontend
        shell: bash
      - name: Image digest
        run: |
          docker image inspect combine_frontend:latest -f '{{json .Id}}'
        shell: bash