build.yml

name: CI
on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  id-token: write
  contents: read
env:
  # Change this to upload the built image to your own organization.
  docker_tag_prefix: ghcr.io/tietokilta
jobs:
  build:
    name: Format, Lint, Check types & Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2

      - name: Setup turborepo cache
        uses: actions/cache@v5
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-turbo-

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v6
        with:
          node-version-file: package.json
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: "Build ui package"
        run: pnpm turbo run build --filter=@tietokilta/ui --force

      - name: Format (to ensure that code has been formatted)
        run: pnpm format && git diff --exit-code

      - name: Generate Payload types
        run: pnpm codegen

      - name: Lint
        run: pnpm lint

      - name: Typecheck
        run: pnpm typecheck

      - name: Build all
        run: pnpm build

  publish-npm:
    name: Publish @tietokilta/ui to npm
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    # Publish on main branch pushes
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'release' && github.event.action == 'published')
    steps:
      - name: Check out the repo
        uses: actions/checkout@v6

      - uses: pnpm/action-setup@v4

      - name: Setup Node.js for npm (OIDC)
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json
          cache: "pnpm"
          registry-url: "https://registry.npmjs.org"

      - name: Update npm to latest (required for OIDC)
        run: npm install -g npm@^11

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build UI package
        run: pnpm --filter @tietokilta/ui build

      - name: Publish @tietokilta/ui (alpha and latest)
        run: |
          pnpm publish --filter @tietokilta/ui --no-git-checks --access public --provenance --tag alpha --tag latest

  docker-build-and-push:
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'release' && github.event.action == 'published')
    needs: build
    name: Push Docker image to GitHub Packages
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    steps:
      - name: Check out the repo
        uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Generate Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{env.docker_tag_prefix}}/web
          tags: |
            type=semver,pattern={{version}},enable=${{ github.ref_type == 'tag' }}
            type=semver,pattern={{major}}.{{minor}},enable=${{ github.ref_type == 'tag' }}
            type=raw,value=sha-${{github.sha}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Push to GitHub Packages
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            GIT_COMMIT_SHA=${{github.sha}}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    # only run on published releases, enable this when we release
    #if: github.event_name == 'release' && github.event.action == 'published'
    name: Deploy to Azure
    runs-on: ubuntu-latest
    needs: docker-build-and-push
    steps:
      - name: Login via Azure CLI
        uses: azure/login@v2
        with:
          client-id: ${{secrets.AZURE_CLIENT_ID}}
          subscription-id: ${{secrets.AZURE_SUBSCRIPTION_ID}}
          tenant-id: ${{secrets.AZURE_TENANT_ID}}
      - uses: azure/webapps-deploy@v3
        with:
          app-name: tikweb-web-prod # TODO: if we ever setup more envs than prod, make this variable customizable
          images: "${{ env.docker_tag_prefix }}/web:sha-${{ github.sha }}"