packmind/.github/workflows/main.yml at 3c2c8cc03027acefe81dee252fc485e860068c9c · PackmindHub/packmind · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
name: Main CI/CD Pipeline

# ┌─────────────────────────────────────────────────────────────────┐
# │ GLOBAL CONFIGURATION                                            │
# │ To update Node.js version, change all occurrences below        │
# │ Current version: 24.18.0                                       │
# │                                                                 │
# │ Repository Variables Required:                                  │
# │ - PACKMIND_EDITION: 'oss' or 'proprietary'                     │
# │ - ACTION_RUNNER_TAG: (optional) defaults to 'self-hosted'      │
# └─────────────────────────────────────────────────────────────────┘
#
# Three roots start at once — `build`, `quality` and `e2e` — because none of
# them reads anything the others produce. Every `needs:` below is a real data
# dependency (an artifact) or a deployment gate; nothing waits on a stage just
# because that stage used to come earlier in a list.
#
#   build ─┬─────────────────► quality-packmind-cli ─┐
#          └── artifacts ───────────────────────────┬┴► docker ─► deploy ─► release
#   quality ────────────────────────────────────────┤
#   e2e ────────────────────────────────────────────┘
#
# `needs:` gates on a called workflow as a whole, never on individual jobs
# inside it. That is why the E2E suites and the artifact-consuming Packmind
# lint each live in their own file: leaving them alongside jobs with different
# dependencies is what serialised this pipeline in the first place.
#
# Every called workflow keeps at least one unconditional job, so no caller job
# here can ever be reported `skipped`. Do not add an `if:` that could skip a
# whole called workflow — GitHub skips its dependents too, silently, and
# `deploy-staging-and-release` would stop deploying with nothing showing red.

on:
  push:
    branches: ['main']
    tags:
      - 'release/*'
      - 'release-cli/*'
  pull_request:

# Only pull requests share a group, and only they cancel. Non-PR runs key on
# `github.run_id`, which is unique per run: keying them on `github.ref` instead
# would put every push to `main` — and every release tag — in one group with
# `cancel-in-progress` false, i.e. queued one at a time behind a ~7 minute
# pipeline. Cancelling them is not an option either: they push images and
# deploy, so an interrupted run leaves partial state.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Compile, unit and integration tests. Produces every artifact the pipeline
  # consumes downstream.
  build:
    uses: ./.github/workflows/build.yml
    with:
      node-version: 24.18.0
    secrets:
      VITE_SENTRY_FRONTEND_DSN: ${{ secrets.VITE_SENTRY_FRONTEND_DSN }}
      VITE_CRISP_WEBSITE_ID: ${{ secrets.VITE_CRISP_WEBSITE_ID }}

  # The E2E suites. Each builds what it needs from source inside its own
  # containers, so it consumes no build artifact and has no reason to wait for
  # `build`. Sitting inside build.yml, it added its whole duration to the front
  # of every downstream stage — `needs:` gates on the called workflow as a
  # whole, never on individual jobs inside it.
  e2e:
    uses: ./.github/workflows/e2e.yml
    with:
      node-version: 24.18.0

  # GitGuardian, lint+format, Sonar and the OSS parity check. All source-only:
  # they read the checkout and nothing else, so no `needs:`.
  quality:
    uses: ./.github/workflows/quality.yml
    with:
      node-version: 24.18.0
    secrets:
      GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # The one quality check with a real build dependency: it runs the CLI
  # executable that build-cli uploaded.
  quality-packmind-cli:
    needs: [build]
    uses: ./.github/workflows/quality-packmind-cli.yml
    with:
      cli-executables-artifact: ${{ needs.build.outputs.cli-executables-artifact }}
    secrets:
      PACKMIND_API_KEY: ${{ secrets.PACKMIND_API_KEY }}

  # Docker images (on main and release tags; docker.yml gates that internally).
  # `e2e` is in the needs by choice: no image reaches Docker Hub from code whose
  # E2E suites fail. It is free — docker starts at max(build, quality, e2e,
  # build+packmind-lint), which Sonar sets, and E2E finishes under it.
  docker:
    needs: [build, quality, e2e, quality-packmind-cli]
    uses: ./.github/workflows/docker.yml
    with:
      api-artifact: ${{ needs.build.outputs.api-artifact }}
      frontend-artifact: ${{ needs.build.outputs.frontend-artifact }}
      standard-samples-artifact: ${{ needs.build.outputs.standard-samples-artifact }}
      node-version: 24.18.0
    secrets:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

  # Only on release-cli/* tags, OSS only.
  publish-cli-release:
    needs: [build, quality, e2e, quality-packmind-cli]
    if: startsWith(github.ref, 'refs/tags/release-cli/') && vars.PACKMIND_EDITION == 'oss'
    permissions:
      contents: write
    uses: ./.github/workflows/publish-cli-release.yml
    with:
      cli-artifact: ${{ needs.build.outputs.cli-artifact }}
    secrets:
      MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
      MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
      MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      HOMEBREW_TAP_PAT: ${{ secrets.HOMEBREW_TAP_PAT }}

  # Deploy and update Helm charts, after the images exist. This is the gate
  # nothing gets past on red: deploy.yml handles edition-specific logic
  # internally.
  deploy-staging-and-release:
    needs: [build, quality, e2e, quality-packmind-cli, docker]
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/release/')
    uses: ./.github/workflows/deploy-staging-and-release.yml
    with:
      node-version: 24.18.0
      helm-charts-repository: ${{ vars.HELM_CHARTS_REPOSITORY || 'PackmindHub/packmind-ai-helm-charts' }}
    secrets:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      HELM_CHARTS_PAT: ${{ secrets.HELM_CHARTS_PAT }}

  # Only on release tags, after the deployment.
  create-release:
    needs: [build, quality, e2e, quality-packmind-cli, docker, deploy-staging-and-release]
    if: startsWith(github.ref, 'refs/tags/release/')
    permissions:
      contents: write
    uses: ./.github/workflows/release.yml