ci.yml

name: CI

on:
  push:
    branches:
      - '*'
  pull_request:
    types: [opened, reopened, edited, synchronize]
    branches:
      - 'main'

env:
  DOCKER_IMAGE: 36node/auth
  HARBOR_IMAGE: ${{ secrets.HARBOR_DOMAIN }}/36node/auth
  SDK_TS: '@36node/auth-sdk'
  SDK_TS_REPO: auth-sdk-ts
  ORG: 36node
  CLUSTER_DIR: ~/Workspace/z-ctyun-stage
  TAG_NAME: auth_tag
  DEPLOY: auth-${{ github.event.pull_request.number }}
  TEND_UAT_PLAYBOOK: site-tend-uat.yaml
  TEND_PR_PLAYBOOK: site-tend-uat.yaml
  TEND_DOMAIN: auth.tend-core-${{ github.event.pull_request.number }}.36node.com

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      mongodb:
        image: mongo
        ports:
          - 27017:27017
      redis:
        image: redis/redis-stack-server
        ports:
          - 6379:6379
    outputs:
      new_sdk: ${{ steps.check-new-sdk.outputs.new }}
      sdk_version: ${{ steps.sdk-version.outputs.sdk_version }}
      artifact_name: ${{ steps.artifact-name.outputs.artifact_name }}
    steps:
      - name: Extract env from pr body
        id: pr-env
        uses: 36node/action-pr-env@v1.0.0
        with:
          text: '${{ github.event.pull_request.body }}'

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: '0'

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        with:
          version: 10.22.0
          run_install: false

      - name: Get pnpm store directory
        id: pnpm-cache
        run: echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Eslint
        run: pnpm lint

      # - name: Unit Test
      #   run: pnpm test
      #   env:
      #     NODE_ENV: test

      - name: Integration Test
        run: pnpm test:e2e
        env:
          NODE_ENV: test

      - name: Generate openapi.json
        run: |
          pnpm build
          NODE_ENV=development node ./bin/generate-swagger.js

      - name: Check if openapi.json match the code
        run: |
          if git diff --name-only | grep openapi.json; then
            echo "The file openapi.json does not matches the code."
            exit 1
          else
            echo "The file openapi.json matches the code."
          fi

      - name: Set sdk version
        id: sdk-version
        run: |
          CURRENT_VERSION=$(node -p "require('./package.json').version")
          PR_NUMBER=${{ github.event.pull_request.number}}
          OPENAPI_HASH=$(node -p "require('./openapi.json').hash")
          SHORT_HASH=$(echo $OPENAPI_HASH | cut -c1-10)
          SDK_VERSION="$CURRENT_VERSION-pr-$PR_NUMBER-$SHORT_HASH"
          echo "sdk_version=$SDK_VERSION" >> $GITHUB_OUTPUT

      - name: Check if a new sdk should to be generated
        if: github.event_name == 'pull_request'
        id: check-new-sdk
        run: |
          if git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} | grep 'openapi.json'; then
            if npm view ${{env.SDK_TS }}@${{ steps.sdk-version.outputs.sdk_version }} time --json; then
              echo "new=false" >> $GITHUB_OUTPUT
            else
              echo "new=true" >> $GITHUB_OUTPUT
            fi
          else
            echo "new=false" >> $GITHUB_OUTPUT
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Set artifact name
        if: steps.check-new-sdk.outputs.new == 'true'
        id: artifact-name
        run: |
          SHORT_SHA=$(echo $(git rev-parse HEAD) | cut -c1-7)
          PR_NUMBER=${{ github.event.pull_request.number}}
          ARTIFACT_NAME="openapi-$PR_NUMBER-$SHORT_SHA"
          echo "artifact_name=$ARTIFACT_NAME" >> $GITHUB_OUTPUT

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        if: steps.check-new-sdk.outputs.new == 'true'
        id: upload-artifact
        with:
          name: ${{ steps.artifact-name.outputs.artifact_name }}
          path: ./openapi.json

  build:
    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.DOCKER_IMAGE }}
            ${{ env.HARBOR_IMAGE }}
          # generate Docker tags based on the following events/attributes
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: '${{ secrets.DOCKERHUB_USERNAME }}'
          password: '${{ secrets.DOCKERHUB_TOKEN }}'
      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ secrets.HARBOR_DOMAIN }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64

  gen-sdk-ts:
    needs: [test]
    if: github.event_name == 'pull_request' && needs.test.outputs.new_sdk == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Trigger ts sdk generation workflow and wait
        uses: convictional/trigger-workflow-and-wait@v1.6.1
        id: sdk-ts-generation
        with:
          owner: ${{ env.ORG }}
          repo: ${{ env.SDK_TS_REPO }}
          github_token: ${{ secrets.DISPATCH_TOKEN }}
          workflow_file_name: generate-sdk.yml
          ref: refs/heads/main
          client_payload: '{"artifactName": "${{ needs.test.outputs.artifact_name }}","runId": "${{ github.run_id }}","version": "${{ needs.test.outputs.sdk_version }}","prNumber": "${{ github.event.pull_request.number }}","prTitle": "${{ github.event.pull_request.title }}","prHtmlUrl": "${{ github.event.pull_request.html_url }}"}'

      - name: Comment PR
        uses: thollander/actions-comment-pull-request@v2
        with:
          message: |
            sdk version ${{ needs.test.outputs.sdk_version }}

            ```shell
            ## for js/ts project
            pnpm add ${{ env.SDK_TS }}@${{ needs.test.outputs.sdk_version }}
            ```
          reactions: eyes, rocket

  # deploy-tend-pr:
  #   needs: [build]
  #   if: github.event_name == 'pull_request'
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Extract env from pr body
  #       id: pr-env
  #       uses: 36node/action-pr-env@v1.0.0
  #       with:
  #         text: '${{ github.event.pull_request.body }}'

  #     - name: Deploy
  #       uses: appleboy/ssh-action@v1.0.3
  #       with:
  #         host: ${{ secrets.DEPLOY_HOST }}
  #         username: ${{ secrets.DEPLOY_USERNAME }}
  #         key: ${{ secrets.DEPLOY_KEY }}
  #         port: ${{ secrets.DEPLOY_PORT }}
  #         script: |
  #           cd ${{ env.CLUSTER_DIR }}
  #           source .envrc
  #           EXPORT_COMMANDS=$(echo '${{ toJson(steps.pr-env.outputs.env) }}' | jq -r 'to_entries | .[] | "export \(.key)=\(.value)"')
  #           echo "$EXPORT_COMMANDS"
  #           eval "$EXPORT_COMMANDS"
  #           tag=$(echo sha-${{ github.sha }} | cut -c1-11)
  #           ansible-playbook ${{ env.TEND_PR_PLAYBOOK }} -e "${{ env.TAG_NAME }}=${tag} deploy=${{ env.DEPLOY }}"

  #     - name: Comment PR
  #       uses: thollander/actions-comment-pull-request@v2
  #       with:
  #         message: |
  #           Deployed to: https://${{ env.TEND_DOMAIN }}
  #         reactions: eyes, rocket

  #     - name: Feishu Robot Nessage
  #       run: |
  #         curl -X POST -H "Content-Type: application/json" \
  #           -d '
  #             {
  #               "msg_type": "post",
  #               "content": {
  #                 "post": {
  #                   "zh_cn": {
  #                     "title": "请查阅: Auth PR ${{ github.event.pull_request.number }} 已发布/更新",
  #                     "content": [
  #                       [{
  #                         "tag": "a",
  #                         "text": "${{ github.event.pull_request.title }}\n",
  #                         "href": "${{ github.event.pull_request.html_url }}"
  #                       },{
  #                         "tag": "text",
  #                         "text": "Deploy to https://${{ env.TEND_DOMAIN }}\n"
  #                       }]
  #                     ]
  #                   }
  #                 }
  #               }
  #             }' \
  #           https://open.feishu.cn/open-apis/bot/v2/hook/${{ secrets.TEND_FEISHU_ROBOT_TOKEN }}

  # deploy-tend-uat:
  #   needs: [build]
  #   if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Deploy
  #       uses: appleboy/ssh-action@v1.0.3
  #       with:
  #         host: ${{ secrets.DEPLOY_HOST }}
  #         username: ${{ secrets.DEPLOY_USERNAME }}
  #         key: ${{ secrets.DEPLOY_KEY }}
  #         port: ${{ secrets.DEPLOY_PORT }}
  #         script: |
  #           cd ${{ env.CLUSTER_DIR }}
  #           source .envrc
  #           tag=$(echo sha-${{ github.sha }} | cut -c1-11)
  #           ansible-playbook ${{ env.TEND_UAT_PLAYBOOK }} -e "${{ env.TAG_NAME }}=${tag}"