main.yml

name: Main

on:
  push:
    branches:
      - main
      - master
      - Version-v*
      - trigger-ci*
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
  merge_group:

jobs:
  prep-deps:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout and setup environment
        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
        with:
          is-high-risk-environment: false
          cache-node-modules: 'true'

  lint-workflows:
    name: Lint workflows
    uses: metamask/github-tools/.github/workflows/lint-workflows.yml@1299bb1de0c6974ae6d0a32c7e8897fe168239ac

  test-lint:
    needs: prep-deps
    uses: ./.github/workflows/test-lint.yml

  test-circular-deps:
    name: Test circular deps
    needs: prep-deps
    runs-on: ubuntu-latest
    steps:
      - name: Checkout and setup environment
        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
        with:
          is-high-risk-environment: false

      - name: Check circular dependencies
        run: yarn circular-deps:check

  repository-health-checks:
    needs: prep-deps
    uses: ./.github/workflows/repository-health-checks.yml

  test-storybook:
    name: Test storybook
    needs: prep-deps
    uses: ./.github/workflows/test-storybook.yml

  validate-lavamoat-policy-build:
    needs: prep-deps
    uses: ./.github/workflows/validate-lavamoat-policy-build.yml

  validate-lavamoat-policy-webapp:
    needs: prep-deps
    uses: ./.github/workflows/validate-lavamoat-policy-webapp.yml

  prep-build-test-browserify:
    needs: prep-deps
    runs-on: ubuntu-latest
    steps:
      - name: Checkout and setup environment
        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
        with:
          is-high-risk-environment: false

      - run: yarn build:test

      - name: Upload artifact prep-build-test-browserify
        uses: actions/upload-artifact@v4
        with:
          name: prep-build-test-browserify
          path: ./dist/

  prep-build-test-webpack:
    needs: prep-deps
    runs-on: ubuntu-latest
    steps:
      - name: Checkout and setup environment
        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
        with:
          is-high-risk-environment: false

      - run: yarn webpack --test --no-lavamoat --no-cache --browser=chrome --lockdown --sentry --snow --env production
        env:
          SEGMENT_PROD_WRITE_KEY: '-' # A fake key just to make the build succeed

      - name: Upload artifact prep-build-test-webpack
        uses: actions/upload-artifact@v4
        with:
          name: prep-build-test-webpack
          path: ./dist/

  run-tests:
    name: Run tests
    needs: prep-deps
    uses: ./.github/workflows/run-tests.yml

  run-benchmarks:
    uses: ./.github/workflows/run-benchmarks.yml
    needs:
      - prep-build-test-browserify
      - prep-build-test-webpack

  wait-for-circleci-workflow-status:
    name: Wait for CircleCI workflow status
    uses: ./.github/workflows/wait-for-circleci-workflow-status.yml

  runway:
    name: Runway
    # For a `pull_request` event, the branch is `github.head_ref``.
    # For a `push` event, the branch is `github.ref_name`.
    if: ${{ startsWith(github.head_ref || github.ref_name, 'Version-v') }}
    needs:
      - wait-for-circleci-workflow-status
    uses: ./.github/workflows/runway.yml

  build-storybook:
    name: Build storybook
    uses: ./.github/workflows/build-storybook.yml
    secrets:
      STORYBOOK_TOKEN: ${{ secrets.STORYBOOK_TOKEN }}
    permissions:
      contents: read
      # id-token permission is required for uploading to s3
      id-token: write

  build-beta:
    name: Build beta
    uses: ./.github/workflows/build-beta.yml
    permissions:
      contents: read
      # id-token permission is required for uploading to s3
      id-token: write

  publish-prerelease:
    name: Publish prerelease
    if: ${{ github.event_name == 'pull_request' }}
    needs:
      - wait-for-circleci-workflow-status
      - build-storybook
      - build-beta
    uses: ./.github/workflows/publish-prerelease.yml
    secrets:
      PR_COMMENT_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}

  # Explanation for all-jobs-completed and all-jobs-pass being separate:
  # https://github.com/MetaMask/metamask-module-template/pull/151
  all-jobs-completed:
    name: All jobs completed
    runs-on: ubuntu-latest
    needs:
      - lint-workflows
      - test-lint
      - repository-health-checks
      - test-storybook
      - validate-lavamoat-policy-build
      - validate-lavamoat-policy-webapp
      - run-tests
      - wait-for-circleci-workflow-status
      - build-storybook
      - build-beta
    outputs:
      PASSED: ${{ steps.set-output.outputs.PASSED }}
    steps:
      - name: Set PASSED output
        id: set-output
        run: echo "PASSED=true" >> "$GITHUB_OUTPUT"

  all-jobs-pass:
    name: All jobs pass
    if: ${{ always() }}
    runs-on: ubuntu-latest
    needs:
      - all-jobs-completed
    steps:
      - name: Check that all jobs have passed
        run: |
          passed="${{ needs.all-jobs-completed.outputs.PASSED }}"
          if [[ $passed != "true" ]]; then
            exit 1
          fi

  log-merge-group-failure:
    name: Log merge group failure
    # Only run this job if the merge group event fails, skip on forks
    if: ${{ github.event_name == 'merge_group' && failure() && !github.event.repository.fork }}
    needs:
      - all-jobs-pass
    uses: metamask/github-tools/.github/workflows/log-merge-group-failure.yml@6bbad335a01fce1a9ec1eabd9515542c225d46c0
    secrets:
      GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
      GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
      SPREADSHEET_ID: ${{ secrets.GOOGLE_MERGE_QUEUE_SPREADSHEET_ID }}
      SHEET_NAME: ${{ secrets.GOOGLE_MERGE_QUEUE_SHEET_NAME }}