ci.yaml

name: CI

on:
  workflow_dispatch:
  push:
    branches:
      - dev
      - master
  pull_request:
    branches:
      - dev
      - master

env:
  NODE_OPTIONS: --max_old_space_size=6144

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  prepare-dependencies:
    name: Prepare dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Check out files from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Prepare dependencies
        uses: ./.github/actions/prepare-dependencies

  lint:
    name: Lint and check format
    needs: prepare-dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Check out files from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Node with shared dependencies
        uses: ./.github/actions/setup
        with:
          node-modules-cache: true
      - name: Check for duplicate dependencies
        run: yarn dedupe --check
      - name: Build resources
        id: build_resources
        run: ./node_modules/.bin/gulp gen-icons-json build-translations build-locale-data gather-gallery-pages
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Setup lint cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            node_modules/.cache/prettier
            node_modules/.cache/eslint
            node_modules/.cache/typescript
          key: lint-${{ github.sha }}
          restore-keys: lint-
      - name: Run eslint
        run: yarn run lint:eslint --quiet
      - name: Run tsc
        if: ${{ !cancelled() && steps.build_resources.outcome == 'success' }}
        run: yarn run lint:types
      - name: Run lit-analyzer
        if: ${{ !cancelled() && steps.build_resources.outcome == 'success' }}
        run: yarn run lint:lit --quiet
      - name: Run prettier
        if: ${{ !cancelled() && steps.build_resources.outcome == 'success' }}
        run: yarn run lint:prettier
      - name: Check dependency licenses
        if: ${{ !cancelled() && steps.build_resources.outcome == 'success' }}
        run: yarn run lint:licenses
  test:
    name: Run tests
    needs: prepare-dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Check out files from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Node with shared dependencies
        uses: ./.github/actions/setup
        with:
          node-modules-cache: true
      - name: Build resources
        run: ./node_modules/.bin/gulp gen-icons-json build-translations build-locale-data
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Run Tests
        run: yarn run test
  build:
    name: Build frontend
    # Runs alongside lint and test rather than after them: the build only needs
    # the dependency tree, and with the rspack cache it is no longer expensive
    # enough to be worth serialising behind the other checks. The
    # cancel-on-failure job below stops the run as soon as a check fails, so a
    # broken pull request does not finish building.
    needs: prepare-dependencies
    runs-on: ubuntu-latest
    steps:
      - name: Check out files from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Node with shared dependencies
        uses: ./.github/actions/setup
        with:
          node-modules-cache: true
      # Read-only reuse of the rspack cache written by the nightly (see
      # nightly.yaml). rspack itself decides what is still valid (version +
      # buildDependencies + node_modules snapshot), so the GHA key just restores
      # the latest nightly cache; no fingerprint, and no save step (CI never
      # writes the shared cache).
      - name: Restore rspack cache
        continue-on-error: true
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .rspack-cache
          key: rspack-cache-${{ runner.os }}-${{ github.run_id }}
          restore-keys: |
            rspack-cache-${{ runner.os }}-
      - name: Build Application
        uses: ./.github/actions/build
        with:
          target: build-app
          github-token: ${{ secrets.GITHUB_TOKEN }}
          is-test: true
          rspack-cache: readonly
      - name: Upload bundle stats
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-bundle-stats
          path: build/stats/*.json
          if-no-files-found: error
      - name: Check entrypoint bundle size budget
        run: yarn run check-bundlesize
      - name: Upload frontend build
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-build
          path: hass_frontend/
          if-no-files-found: error
          retention-days: 7

  # Now that the checks run in parallel, a failing lint or test no longer stops
  # the build from finishing on its own, so this watches them and cancels the
  # whole run on the first failure.
  #
  # It is a separate job on purpose. Cancelling needs `actions: write`, and the
  # other jobs check out the pull request and run its build scripts — handing
  # them that scope would give PR-controlled code (or a compromised dependency)
  # write access to Actions. This job never checks out the repository, so the
  # elevated token stays away from PR code. It also cannot be a job that
  # `needs` the checks: that would only start once they have all finished, which
  # is exactly too late to cancel anything.
  cancel-on-failure:
    name: Cancel run on failure
    needs: prepare-dependencies
    runs-on: ubuntu-latest
    permissions:
      actions: write
    timeout-minutes: 30
    steps:
      - name: Cancel the run when a check fails
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          RUN_ID: ${{ github.run_id }}
        run: |
          watched='^(Lint and check format|Run tests|Build frontend)$'
          while :; do
            jobs=$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
              --paginate --jq '.jobs[] | [.name, .status, (.conclusion // "")] | @tsv' \
              2>/dev/null || true)

            failed=$(printf '%s\n' "$jobs" | awk -F'\t' -v w="$watched" \
              '$1 ~ w && ($3 == "failure" || $3 == "timed_out") { print $1 }')
            if [ -n "$failed" ]; then
              echo "Cancelling the run, these checks failed:"
              printf '%s\n' "$failed"
              gh run cancel "$RUN_ID" --repo "$REPO" || true
              exit 0
            fi

            found=$(printf '%s\n' "$jobs" | awk -F'\t' -v w="$watched" '$1 ~ w' | wc -l)
            running=$(printf '%s\n' "$jobs" | awk -F'\t' -v w="$watched" \
              '$1 ~ w && $2 != "completed" { print $1 }')
            if [ "$found" -ge 3 ] && [ -z "$running" ]; then
              echo "All checks finished without failure"
              exit 0
            fi

            sleep 15
          done