tech-radar/.github/workflows/ci.yaml at master · qiwi/tech-radar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
# Runs lint+tests on every push/PR; on master also releases the npm package
# via zx-semrel (with npm OIDC trusted publishing) and pushes the radar +
# jsdoc statics to the gh-pages branch via ggcp.
name: CI
on: [push, pull_request]

permissions: {}

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Setup NodeJS
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Install deps
        run: npm ci

      - name: Test
        run: npm test

      - name: Upload coverage to Qlty
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        uses: qltysh/qlty-action/coverage@a19242102d17e497f437d7466aa01b528537e899 # v2
        env:
          QLTY_TOKEN: ${{ secrets.QLTY_TOKEN }}
        with:
          token: ${{ env.QLTY_TOKEN }}
          files: coverage/lcov.info

  release:
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    needs: test
    runs-on: ubuntu-latest
    permissions:
      checks: read
      statuses: write
      contents: write
      issues: write
      pull-requests: write
      id-token: write
    # Common secrets/inputs reused across release steps. Job-scoped so they
    # don't leak into earlier steps (checkout/setup-node/install) and are
    # referenced via $VAR in shells, not via ${{ secrets.X }}.
    env:
      GIT_AUTHOR_NAME: ${{ secrets.GIT_AUTHOR_NAME }}
      GIT_AUTHOR_EMAIL: ${{ secrets.GIT_AUTHOR_EMAIL }}
      GIT_COMMITTER_NAME: ${{ secrets.GIT_COMMITTER_NAME }}
      GIT_COMMITTER_EMAIL: ${{ secrets.GIT_COMMITTER_EMAIL }}
      REPO: ${{ github.repository }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup NodeJS
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          registry-url: https://registry.npmjs.org

      - name: Install deps
        run: npm ci

      - name: Build radar & docs
        run: |
          npm run generate
          npm run docs

      - name: Release npm package
        env:
          GH_USER: 'qiwibot'
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          NPM_OIDC: true
          NPM_PROVENANCE: true
        run: npx zx-semrel

      - name: Push radar & docs to gh-pages
        env:
          GH_PAGES_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          npx ggcp 'dist>**/*' "https://x-access-token:$GH_PAGES_TOKEN@github.com/$REPO.git/gh-pages" --message='docs: update tech-radar static'