ci.yml

# Continuous integration: the one workflow that decides whether a change may merge.
#
# This file only wires things together. Each concern lives in a reusable workflow (the files
# starting with an underscore) and each job in those is small enough to read at a glance.
# release.yml calls this workflow too, so a release is gated on exactly the checks that gate
# a merge; add a check here and it protects releases without touching release.yml.
#
# Branch protection should require one check, `CI passed`, rather than the individual jobs:
# it keeps working when jobs or matrix entries are added, renamed or removed.
name: CI

on:
  push:
    branches: [main]
  pull_request:
  # Merge queue: the required check must also report on the queue's temporary branch.
  merge_group:
  workflow_dispatch:
  # Used by release.yml. The outputs pass on the digests of the tarballs that _package.yml
  # built, so the release can check that what it publishes is what was built and tested.
  workflow_call:
    outputs:
      npm-sha256:
        description: SHA-256 of the npm tarball, recorded when it was packed.
        value: ${{ jobs.package.outputs.npm-sha256 }}
      scoped-sha256:
        description: SHA-256 of the GitHub Packages tarball, recorded when it was derived.
        value: ${{ jobs.package.outputs.scoped-sha256 }}

# Least privilege: nothing here writes to the repository. A job that needs more asks for it
# itself (release.yml does).
permissions:
  contents: read

# A new push to a pull request supersedes the run in flight. Runs on main, in the merge queue
# and under release.yml always finish. The group is prefixed `ci-` rather than built from the
# workflow name, because a called workflow inherits its caller's `github.workflow` and must
# never share a concurrency group with it.
concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  quality:
    name: Quality
    uses: ./.github/workflows/_quality.yml

  test:
    name: Test
    uses: ./.github/workflows/_test.yml

  compat:
    name: Compatibility
    uses: ./.github/workflows/_compat.yml

  package:
    name: Package
    uses: ./.github/workflows/_package.yml

  runtimes:
    name: Runtimes
    uses: ./.github/workflows/_runtimes.yml

  examples:
    name: Examples
    uses: ./.github/workflows/_examples.yml

  site:
    name: Site
    uses: ./.github/workflows/_site.yml

  # The single stable check to require. `always()` makes it run (and fail) when a job it
  # needs failed or was cancelled, instead of being skipped, because a skipped required check
  # counts as passing for branch protection. Skipped needs are allowed so a job can become
  # conditional later; a job skipped because its dependency failed always comes with that
  # dependency's failure.
  passed:
    name: CI passed
    if: always()
    needs: [quality, test, compat, package, runtimes, examples, site]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions: {}
    steps:
      - name: Check that no job failed or was cancelled
        env:
          NEEDS: ${{ toJSON(needs) }}
        run: |
          set -euo pipefail
          echo "$NEEDS" | jq -r 'to_entries[] | "\(.value.result)\t\(.key)"' | sort
          if echo "$NEEDS" | jq -e 'any(.[]; .result == "failure" or .result == "cancelled")' > /dev/null; then
            echo "::error title=CI failed::at least one job failed or was cancelled"
            exit 1
          fi