ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint / format check
        run: pnpm check

      - name: Type check
        run: pnpm typecheck

      - name: Build
        run: pnpm build

      - name: Build (vinext)
        run: pnpm build:vinext

  vrt:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    env:
      S3_BUCKET: cateiru-public-storage
      S3_PATH_PREFIX: cateiru.com/vrt
      REPORT_DOMAIN: storage.cateiru.dev
      # フォークからの PR では OIDC トークンを取得できず、PR へのコメント権限もないため、
      # AWS 認証以降 (比較・公開・結果の投稿) は push か同一リポジトリからの PR でのみ実行する。
      # フォーク PR ではスクリーンショットの撮影までを行う
      TRUSTED: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          # reg-suit (reg-keygen-git-hash-plugin) がベースラインとの比較に
          # git のブランチ履歴を使うため必要
          fetch-depth: 0

      # actions/checkout は pull_request イベントだと detached HEAD で checkout するため、
      # reg-keygen-git-hash-plugin がブランチ名を取得できずエラーになる。
      # 回避策として現在のコミットにブランチ名を付け直す
      # (https://github.com/reg-viz/reg-suit#workaround-for-detached-head)
      - name: Attach HEAD to a branch (reg-suit workaround for detached HEAD)
        run: |
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
          git checkout "$BRANCH" || git checkout -b "$BRANCH"

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Playwright browsers
        run: pnpm exec playwright install --with-deps chromium

      - name: Run Playwright tests for VRT
        run: pnpm vrt

      # public-storage-cdk (https://github.com/cateiru/public-storage-cdk) が発行する
      # OIDC ロールを使う。cateiru/* の全リポジトリから AssumeRole 可能
      - name: Configure AWS credentials (public-storage-cdk)
        if: ${{ env.TRUSTED == 'true' }}
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::211125784910:role/github-actions-public-storage
          aws-region: us-east-1
          role-skip-session-tagging: true

      - name: Run reg-suit
        if: ${{ env.TRUSTED == 'true' }}
        run: pnpm vrt:reg

      # reg-publish-s3-plugin 自体はオブジェクトタグ付けに対応していないため、
      # アップロード後に auto-expire タグを付け直す
      # (public-storage-cdk 側のライフサイクルルールがこのタグを180日後の自動削除対象にする)
      - name: Tag published snapshots as auto-expire
        if: ${{ env.TRUSTED == 'true' }}
        run: |
          set -euo pipefail
          KEY="$(git rev-parse HEAD)"
          PREFIX="${S3_PATH_PREFIX}/${KEY}"
          aws s3api list-objects-v2 --bucket "$S3_BUCKET" --prefix "$PREFIX" \
            --query 'Contents[].Key' --output text \
            | tr '\t' '\n' \
            | grep -v '^$' \
            | xargs -P 8 -I {} aws s3api put-object-tagging \
                --bucket "$S3_BUCKET" --key "{}" \
                --tagging 'TagSet=[{Key=auto-expire,Value=true}]'

      # 比較結果 (.reg/out.json) から PR コメント用のメッセージを組み立てる
      - name: Build VRT summary comment
        if: ${{ env.TRUSTED == 'true' }}
        id: vrt-summary
        run: |
          set -euo pipefail
          KEY="$(git rev-parse HEAD)"
          REPORT_URL="https://${REPORT_DOMAIN}/${S3_PATH_PREFIX}/${KEY}/index.html"
          FAILED=$(jq '.failedItems | length' .reg/out.json)
          NEW=$(jq '.newItems | length' .reg/out.json)
          DELETED=$(jq '.deletedItems | length' .reg/out.json)
          PASSED=$(jq '.passedItems | length' .reg/out.json)

          {
            echo "## VRT (reg-suit) 結果"
            echo ""
            echo "| ステータス | 件数 |"
            echo "| --- | --- |"
            echo "| 差分あり | ${FAILED} |"
            echo "| 新規 | ${NEW} |"
            echo "| 削除 | ${DELETED} |"
            echo "| 変化なし | ${PASSED} |"
            echo ""
            echo "[reg-suit レポートを見る](${REPORT_URL})"
            if [ "$FAILED" -gt 0 ]; then
              echo ""
              echo "### 差分があった画面"
              echo ""
              jq -r '.failedItems[] | "- " + .' .reg/out.json
            fi
          } > vrt-comment.md

          echo "failed=${FAILED}" >> "$GITHUB_OUTPUT"
          {
            echo "message<<VRT_COMMENT_EOF"
            cat vrt-comment.md
            echo "VRT_COMMENT_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Post VRT result to the pull request
        if: ${{ env.TRUSTED == 'true' && github.event_name == 'pull_request' }}
        uses: hasura/comment-progress@v2.3.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          number: ${{ github.event.pull_request.number }}
          id: vrt-reg-suit
          recreate: true
          message: ${{ steps.vrt-summary.outputs.message }}

      # push イベントでは PR がないため、ジョブサマリーに結果を出す
      - name: Post VRT result to the job summary
        if: ${{ github.event_name == 'push' }}
        run: cat vrt-comment.md >> "$GITHUB_STEP_SUMMARY"

      - name: Fail if reg-suit detected visual differences
        if: ${{ env.TRUSTED == 'true' && steps.vrt-summary.outputs.failed != '0' }}
        run: |
          echo "::error::reg-suit detected ${{ steps.vrt-summary.outputs.failed }} visual difference(s). See the report URL in the PR comment or job summary posted above."
          exit 1