main.yml

name: CI

# On pull requests: lint and build the UI so a broken gulp/bundle cannot
# merge. CI does NOT commit the bundle. Contributors rebuild it locally with
# `npx gulp bundle` (Node 20) and commit build/ui-bundle.zip in their PR.
#
# On push to main: ping Netlify once so docs sites that consume
# https://github.com/tigergraph/antora-ui/blob/main/build/ui-bundle.zip?raw=true
# pick up the bundle that was committed in the merged PR.
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: read

# PRs: cancel superseded runs. Main: let each merge run to completion so its
# Netlify ping is not cancelled by the next merge.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v5

      # Node 17+ dropped PostCSS 8.1's "./" exports fallback, which broke
      # gulp-stylelint 13 / postcss-syntax. CSS lint now uses stylelint 14.
      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version-file: .nvmrc
          cache: npm

      - name: Install dependencies
        run: npm ci --no-audit

      # Lints and builds the bundle so a broken gulp/lint cannot merge. This
      # is the required `build` check. On main it also acts as a smoke test
      # that the branch still builds after a merge. It does not publish.
      - name: Build UI bundle
        run: npx gulp bundle

      # Catch the common mistake in the "contributor commits the bundle" model:
      # src/ changed but build/ui-bundle.zip was not rebuilt, so the docs would
      # ship stale styling. We cannot compare the zip itself: it stores file
      # timestamps (never byte-identical) and image minification differs
      # between a contributor's Mac and this Linux runner (unzip-compare would
      # false-fail). Ask GitHub for the PR's changed files instead: it is exact
      # and needs no local git history (the checkout is shallow).
      - name: Ensure bundle was rebuilt
        if: github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          changed=$(gh api --paginate \
            "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" \
            --jq '.[].filename')
          if echo "$changed" | grep -q '^src/' && ! echo "$changed" | grep -qx 'build/ui-bundle.zip'; then
            echo "::error::src/ changed but build/ui-bundle.zip was not rebuilt. Run 'npx gulp bundle' and commit the updated bundle."
            exit 1
          fi

      # One Netlify deploy per merge to main. The committed bundle is already
      # on main (it came in with the PR), so this just tells the docs sites to
      # rebuild and pull it.
      - name: Trigger Netlify build hook
        if: >
          github.event_name != 'pull_request' &&
          github.ref == 'refs/heads/main'
        run: |
          echo "Making curl call to Netlify build hook"
          curl -X POST -d '{}' "${{ secrets.BUILD_HOOK }}"