ci.yml

name: CI

on:
  pull_request:
    branches:
      - production

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  pre-build:
    name: Pre Build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Check out repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 1

      - name: Set up pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
        with:
          version: 10

      - name: Set up node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        id: setup-node
        with:
          node-version: 24.x
          cache: pnpm

      - name: Check for CRLF line endings
        run: |
          if git grep -Il $'\r'; then
            echo "::error::CRLF line endings detected. Configure your editor to use LF line endings (this repo has an .editorconfig file that most editors respect automatically)."
            exit 1
          fi

      - name: Check for invalid file extensions
        run: |
          FILES=$(
            find src/content \
              -type f \
              -not -name '*.mdx' \
              -not -name '*.md' \
              -not -name '*.json' \
              -not -name '*.yml' \
              -not -name '*.yaml' \
              -not -name '*.txt' \
              -not -wholename 'src/content/collections/*'
          )

          if [ -n "$FILES" ]; then
            echo "Found files with invalid file extensions:\n\n$FILES"
            exit 1
          fi

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-node-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('package.json') }}

      - name: Install node_modules (cache miss)
        run: pnpm install --frozen-lockfile
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - name: Post codeowners comment
        run: pnpm exec tsx bin/post-codeowners-comment/index.ts
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check Astro and CF Worker
        run: pnpm run check

      - name: Set up reviewdog
        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
        with:
          reviewdog_version: v0.21.0

      - name: Run eslint
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pnpm run lint --format eslint-formatter-checkstyle | \
            reviewdog -f=checkstyle -name=eslint -reporter=github-pr-review -fail-level=error -filter-mode=nofilter

      - name: Check formatting (js,jsx,ts,tsx,mjs,css)
        run: pnpm run format:core:check

      - name: Validate redirects
        run: pnpm exec tsm bin/validate-redirects.ts

      - name: Tests
        run: pnpm run test:prebuild

  build:
    name: Build
    needs: pre-build
    runs-on: ubuntu-latest
    outputs:
      link_validation_failed: ${{ steps.build_step.outputs.link_validation_failed }}
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Check out repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 1

      - name: Set up pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
        with:
          version: 10

      - name: Set up node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        id: setup-node
        with:
          node-version: 24.x
          cache: pnpm

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-node-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('package.json') }}

      - name: Install node_modules (cache miss)
        run: pnpm install --frozen-lockfile
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - name: Restore Astro assets from cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: |
            node_modules/.astro/assets
          key: astro-assets-${{ hashFiles('src/assets/**') }}
          restore-keys: |
            astro-assets-

      - name: Build
        id: build_step
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RUN_LINK_CHECK: true
        run: |
          set -o pipefail
          pnpm run build 2>&1 | tee /tmp/build-output.log

      - name: Upload build artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: dist
          path: dist

      - name: Upload link validation report
        if: steps.build_step.outputs.link_validation_failed == 'true'
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: link-validation-report
          path: .starlight-links-validator/errors.json

  post-build:
    name: Post Build
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Check out repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 1

      - name: Set up pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
        with:
          version: 10

      - name: Set up node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        id: setup-node
        with:
          node-version: 24.x
          cache: pnpm

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-node-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('package.json') }}

      - name: Install node_modules (cache miss)
        run: pnpm install --frozen-lockfile
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - name: Download artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: dist
          path: dist

      - name: Tests (Workers)
        run: pnpm run test:postbuild

      - name: Download link validation report
        if: needs.build.outputs.link_validation_failed == 'true'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: link-validation-report
          path: .starlight-links-validator

      - name: Link validation
        run: pnpm exec tsx bin/check-link-validation/index.ts

  notify:
    name: Notify
    needs: [pre-build, build, post-build]
    if: always()
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Check out repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 1

      - name: Set up pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
        with:
          version: 10

      - name: Set up node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        id: setup-node
        with:
          node-version: 24.x
          cache: pnpm

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-node-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('package.json') }}

      - name: Install node_modules (cache miss)
        run: pnpm install --frozen-lockfile
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - name: Post PR CI failure comment
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: pnpm exec tsx bin/post-pr-ci-failure-comment/index.ts

      - name: Download link validation report
        if: needs.build.outputs.link_validation_failed == 'true' && github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: link-validation-report
          path: .starlight-links-validator

      - name: Post link validation comment
        if: github.event.pull_request.head.repo.full_name == github.repository
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: pnpm exec tsx bin/post-link-validation-comment/index.ts

  publish-preview:
    name: Deploy Preview
    needs: build
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Check out repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 1

      - name: Set up pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
        with:
          version: 10

      - name: Set up node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        id: setup-node
        with:
          node-version: 24.x
          cache: pnpm

      - name: Restore node_modules (cache hit)
        id: node-modules-cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-node-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('package.json') }}

      - name: Install node_modules (cache miss)
        run: pnpm install --frozen-lockfile
        if: steps.node-modules-cache.outputs.cache-hit != 'true'

      - name: Download artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: dist
          path: dist

      - name: Deploy to Cloudflare Workers
        id: deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          SHORT_SHA="${PR_HEAD_SHA:0:8}"
          BRANCH_SLUG=$(echo "$PR_HEAD_REF" | iconv -c -t ascii//TRANSLIT | sed -E 's/[~^]+//g' | sed -E 's/[^a-zA-Z0-9]+/-/g' | sed -E 's/^-+|-+$//g' | tr A-Z a-z)

          echo "branch_slug=$BRANCH_SLUG" >> "$GITHUB_OUTPUT"

          pnpm exec wrangler deploy --dispatch-namespace preview-deployments --name $SHORT_SHA
          pnpm exec wrangler deploy --dispatch-namespace preview-deployments --name $BRANCH_SLUG

      - name: Post preview URL on PR
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRANCH_SLUG: ${{ steps.deploy.outputs.branch_slug }}
        run: pnpm exec tsx bin/post-preview-url-comment/index.ts
        continue-on-error: true