ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '7 23 * * *' # 11:07 PM America/Chicago
      timezone: America/Chicago
  workflow_dispatch:

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          fetch-depth: 0
          lfs: true
          # The CLI build runs semantic-release dry-run to bake the next binary version.
          # On main, checkout credentials must match the release token used by that dry-run.
          token: ${{ github.ref == 'refs/heads/main' && secrets.RELEASE_TOKEN || github.token }}
      - uses: ./.github/actions/setup-ci
      - name: Run CI checks
        env:
          ELEMENTS_PAGES_BASE_URL: ${{vars.ELEMENTS_PAGES_BASE_URL}}
          ELEMENTS_REGISTRY_URL: ${{vars.ELEMENTS_REGISTRY_URL}}
          ELEMENTS_REPO_BASE_URL: ${{vars.ELEMENTS_REPO_BASE_URL}}
          GITHUB_TOKEN: ${{ github.ref == 'refs/heads/main' && secrets.RELEASE_TOKEN || github.token }}
        run: PAGES_BASE_URL="/elements/" pnpm run ci && PAGES_BASE_URL="/elements/" node ./projects/internals/ci/cache-validate.js ci
      - name: Write CI job summary
        if: always()
        run: node ./projects/internals/ci/ci-summary.js >> "$GITHUB_STEP_SUMMARY"
      - name: Upload build artifacts
        if: github.event_name == 'push'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: build-artifacts
          retention-days: 1
          path: |
            projects/core/dist
            projects/core/package.json
            projects/forms/dist
            projects/forms/package.json
            projects/styles/dist
            projects/styles/package.json
            projects/themes/dist
            projects/themes/package.json
            projects/lint/dist
            projects/lint/package.json
            projects/cli/dist
            projects/cli/package.json
            projects/code/dist
            projects/code/package.json
            projects/create/dist
            projects/create/package.json
            projects/markdown/dist
            projects/markdown/package.json
            projects/media/dist
            projects/media/package.json
            projects/monaco/dist
            projects/monaco/package.json
            projects/pages/dist
      - name: Prepare IndexNow artifacts
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        env:
          ELEMENTS_PAGES_BASE_URL: ${{vars.ELEMENTS_PAGES_BASE_URL}}
          INDEXNOW_KEY: ${{secrets.INDEXNOW_KEY}}
        run: >-
          node ./projects/internals/ci/indexnow.js prepare
          --site-dir projects/pages/dist
          --site-url "$ELEMENTS_PAGES_BASE_URL"
      - name: Upload pages artifact
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9
        with:
          path: projects/pages/dist
          include-hidden-files: true
      - name: Upload IndexNow state
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: indexnow-state
          retention-days: 1
          path: projects/pages/dist/indexnow-manifest.json
          overwrite: true

  lighthouse:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          fetch-depth: 0
          lfs: true
      - uses: ./.github/actions/setup-ci
      - name: Run Lighthouse tests
        run: WIREIT_FAILURES=kill pnpm run lighthouse && node ./projects/internals/ci/cache-validate.js lighthouse && node ./projects/internals/ci/metrics.lighthouse.js
      - name: Write lighthouse job summary
        if: always()
        run: node ./projects/internals/ci/lighthouse-summary.js >> "$GITHUB_STEP_SUMMARY"

  release:
    needs: ci
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      issues: write
      deployments: write
      pull-requests: write
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          fetch-depth: 0
          lfs: true
          ref: main
          # Use RELEASE_TOKEN so the persisted git credentials match the token
          # semantic-release pushes with — otherwise the default GITHUB_TOKEN's
          # http.extraheader overrides @semantic-release/git's push auth.
          token: ${{secrets.RELEASE_TOKEN}}
      - uses: ./.github/actions/setup-ci
        with:
          install-playwright: 'false'
      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: build-artifacts
          path: projects
      - name: Release
        env:
          # RELEASE_TOKEN must be a PAT or GitHub App token with contents:write and
          # bypass permission for main's branch protection rules. The default
          # GITHUB_TOKEN cannot push tags/release commits to a protected branch.
          GITHUB_TOKEN: ${{secrets.RELEASE_TOKEN}}
          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
        run: WIREIT_PARALLEL=1 WIREIT_LOGGER=metrics pnpm run release
      - name: Upload MCP server manifest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: mcp-server
          retention-days: 1
          path: projects/cli/server.json

  publish-mcp:
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    concurrency: mcp-registry-publish
    steps:
      - name: Download MCP server manifest
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: mcp-server
          path: projects/cli
      - name: Check MCP Registry
        id: registry
        run: |
          path=$(jq -r '[.name, .version] | map(@uri) | join("/versions/")' projects/cli/server.json)
          status=$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            --retry 3 --retry-all-errors --connect-timeout 10 --max-time 30 \
            "https://registry.modelcontextprotocol.io/v0.1/servers/$path")

          case "$status" in
            200) publish=false ;;
            404) publish=true ;;
            *)
              echo "Unexpected MCP Registry response: HTTP $status" >&2
              exit 1
              ;;
          esac
          echo "publish=$publish" >> "$GITHUB_OUTPUT"
      - name: Publish to MCP Registry
        if: steps.registry.outputs.publish == 'true'
        run: |
          curl --fail --location --show-error \
            "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" \
            | tar xz mcp-publisher
          ./mcp-publisher validate projects/cli/server.json
          ./mcp-publisher login github-oidc
          ./mcp-publisher publish projects/cli/server.json

  deploy-pages:
    needs: ci
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{steps.deployment.outputs.page_url}}
    concurrency: pages
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          sparse-checkout: |
            .nvmrc
            mise.toml
            projects/internals/ci/indexnow.js
            projects/internals/ci/package.json
          sparse-checkout-cone-mode: false
      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d
        with:
          version: 2026.6.14
          install: true
          cache: true
      - name: Download IndexNow state
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: indexnow-state
          path: indexnow/current
      - name: Determine changed URLs
        env:
          ELEMENTS_PAGES_BASE_URL: ${{vars.ELEMENTS_PAGES_BASE_URL}}
        run: >-
          node ./projects/internals/ci/indexnow.js diff
          --current-file indexnow/current/indexnow-manifest.json
          --site-url "$ELEMENTS_PAGES_BASE_URL"
          --output-file indexnow/payload.json
      - name: Upload IndexNow payload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: indexnow-payload
          retention-days: 30
          path: indexnow/payload.json
          overwrite: true
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128

  notify-indexnow:
    needs: deploy-pages
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          sparse-checkout: |
            .nvmrc
            mise.toml
            projects/internals/ci/indexnow.js
            projects/internals/ci/package.json
          sparse-checkout-cone-mode: false
      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d
        with:
          version: 2026.6.14
          install: true
          cache: true
      - name: Download IndexNow payload
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: indexnow-payload
          path: indexnow
      - name: Notify IndexNow
        env:
          ELEMENTS_PAGES_BASE_URL: ${{vars.ELEMENTS_PAGES_BASE_URL}}
          INDEXNOW_KEY: ${{secrets.INDEXNOW_KEY}}
        run: >-
          node ./projects/internals/ci/indexnow.js submit
          --payload-file indexnow/payload.json
          --site-url "$ELEMENTS_PAGES_BASE_URL"