build.yml

name: BUILD

on:
    push:
        branches: [develop, release/**, rc/**, release]

jobs:
    # Run tests for all branches (runs in parallel with build)
    test:
        uses: ./.github/workflows/test.yml

    # Build job runs immediately without waiting for tests
    build:
        runs-on: ubuntu-latest
        timeout-minutes: 3
        outputs:
            configuration: ${{ steps.build_ext.outputs.configuration }}
            deploy_branch: ${{ steps.build_ext.outputs.deploy_branch }}
            is_production: ${{ steps.build_ext.outputs.is_production }}
        steps:
            - uses: actions/checkout@v6

            # The changelog needs the history and tags of this branch only.
            # fetch-depth: 0 also downloads the build/* deploy branches (about
            # 560 MB against 30 MB).
            - name: Fetch branch history and tags
              run: git fetch --unshallow --tags origin "$GITHUB_REF"

            - name: Setup Bun
              uses: oven-sh/setup-bun@v2
              with:
                  bun-version: '1.3.11'

            - name: Install dependencies
              run: bun install --frozen-lockfile

            - name: Setup version
              run: bun run postinstall

            - name: Install git-cliff
              uses: taiki-e/install-action@v2
              with:
                  tool: git-cliff@2.13.1

            - name: Extract branch name
              id: branch_name
              shell: bash
              run: echo "name=$(echo ${GITHUB_REF#refs/heads/} | sed 's/\//_/g')" >> $GITHUB_OUTPUT

            - name: Extract build configuration
              shell: bash
              id: build_ext
              run: |
                  if [[ ${{ steps.branch_name.outputs.name }} == "release" ]] || [[ ${{ steps.branch_name.outputs.name }} == "release"* ]] || [[ ${{ steps.branch_name.outputs.name }} == "main" ]]
                  then
                      echo "configuration=production" >> $GITHUB_OUTPUT
                      echo "deploy_branch=prod" >> $GITHUB_OUTPUT
                      echo "is_production=true" >> $GITHUB_OUTPUT
                  elif [[ ${{ steps.branch_name.outputs.name }} == "rc"* ]]
                  then
                      echo "configuration=staging" >> $GITHUB_OUTPUT
                      echo "deploy_branch=uat" >> $GITHUB_OUTPUT
                      echo "is_production=true" >> $GITHUB_OUTPUT
                  else
                      echo "configuration=development" >> $GITHUB_OUTPUT
                      echo "deploy_branch=dev" >> $GITHUB_OUTPUT
                      echo "is_production=false" >> $GITHUB_OUTPUT
                  fi

            - name: Initialise Pipeline Chat Status
              uses: fjogeleit/http-request-action@master
              continue-on-error: true
              with:
                  url: ${{ secrets.STATUS_URL }}
                  data: '{ "chat_url": "${{ secrets.CHAT_URL }}", "name": "${{ github.repository }}", "commit": "${{ github.sha }}", "pipeline_name": "backoffice", "branch": "${{ github.ref }}", "status": "processing", "url": "https://github.com/${{ github.repository }}/runs/${{ github.run_id }}" }'

            # Do not restore an Nx cache for this build. Nx does not hash the
            # gitignored src/env/version.ts, so a cached build could deploy
            # the version info of an earlier commit.
            # git-cliff runs alongside the build; `wait` fails the step if it fails.
            # Do not set GITHUB_REPO. cliff.toml uses no GitHub metadata, and
            # the unauthenticated metadata requests hit the API rate limit.
            - name: Build application and changelog
              run: |
                  git-cliff --config cliff.toml --output "${RUNNER_TEMP}/CHANGELOG.md" &
                  cliff_pid=$!
                  bun run build -- --verbose --configuration=${{ steps.build_ext.outputs.configuration }}
                  wait "$cliff_pid"

            - name: Add application changelog to build
              run: cp "${RUNNER_TEMP}/CHANGELOG.md" dist/backoffice/browser/CHANGELOG.md

            # Upload source maps so Sentry shows the original code. Skipped
            # until the SENTRY_* secrets are set. Debug IDs change the scripts,
            # so the service worker hashes are updated after. Development
            # builds have no service worker.
            # The release name must match SENTRY_RELEASE in src/app/common/sentry.ts.
            - name: Upload source maps to Sentry
              env:
                  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
                  SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
                  SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
              run: |
                  if [ -z "$SENTRY_AUTH_TOKEN" ] || [ -z "$SENTRY_ORG" ] || [ -z "$SENTRY_PROJECT" ]; then
                      echo "SENTRY_AUTH_TOKEN, SENTRY_ORG or SENTRY_PROJECT is not set. Skipping upload."
                      exit 0
                  fi
                  release=$(bun -e "import { VERSION } from './src/env/version.ts'; console.log('backoffice@' + VERSION.hash)")
                  bunx sentry-cli sourcemaps inject dist/backoffice/browser
                  if [ -f dist/backoffice/browser/ngsw.json ]; then
                      bun config/ngsw-rehash.js dist/backoffice/browser
                  fi
                  bunx sentry-cli sourcemaps upload --release="$release" dist/backoffice/browser

            # Production builds make hidden source maps for Sentry only
            - name: Remove hidden source maps
              if: steps.build_ext.outputs.configuration != 'development'
              run: find dist/backoffice/browser -name '*.map' -delete

            - name: Upload build artifact
              uses: actions/upload-artifact@v4
              with:
                  name: build-output
                  path: dist/backoffice/browser
                  retention-days: 1

    # Deploy dev builds immediately after build (don't wait for tests)
    deploy-dev:
        needs: [build]
        if: needs.build.outputs.is_production == 'false'
        runs-on: ubuntu-latest
        timeout-minutes: 3
        steps:
            - uses: actions/checkout@v6

            - name: Download build artifact
              uses: actions/download-artifact@v4
              with:
                  name: build-output
                  path: dist/backoffice/browser

            - name: Deploy the application
              uses: MrYuion/git-publish-subdir-action@develop
              env:
                  REPO: self
                  BRANCH: build/${{ needs.build.outputs.deploy_branch }}
                  FOLDER: dist/backoffice/browser
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  MESSAGE: 'build(backoffice): [{sha}] CI build'

            - name: Update Pipeline Chat Status
              uses: fjogeleit/http-request-action@master
              continue-on-error: true
              with:
                  url: ${{ secrets.STATUS_URL }}
                  data: '{ "name": "${{ github.repository }}", "commit": "${{ github.sha }}", "pipeline_name": "backoffice", "branch": "${{ github.ref }}", "status": "${{ job.status }}", "url": "https://github.com/${{ github.repository }}/runs/${{ github.run_id }}" }'
              if: ${{ always() }}

    # Deploy production builds only after tests pass
    deploy-production:
        needs: [build, test]
        if: needs.build.outputs.is_production == 'true'
        runs-on: ubuntu-latest
        timeout-minutes: 3
        steps:
            - uses: actions/checkout@v6

            - name: Download build artifact
              uses: actions/download-artifact@v4
              with:
                  name: build-output
                  path: dist/backoffice/browser

            - name: Deploy the application
              uses: MrYuion/git-publish-subdir-action@develop
              env:
                  REPO: self
                  BRANCH: build/${{ needs.build.outputs.deploy_branch }}
                  FOLDER: dist/backoffice/browser
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  MESSAGE: 'build(backoffice): CI build from {sha}'

            - name: Update Pipeline Chat Status
              uses: fjogeleit/http-request-action@master
              continue-on-error: true
              with:
                  url: ${{ secrets.STATUS_URL }}
                  data: '{ "name": "${{ github.repository }}", "commit": "${{ github.sha }}", "pipeline_name": "backoffice", "branch": "${{ github.ref }}", "status": "${{ job.status }}", "url": "https://github.com/${{ github.repository }}/runs/${{ github.run_id }}" }'
              if: ${{ always() }}