element-call/.gitea/workflows/ci.yml

name: CI

# Build + publish the Lotus fork of Element Call's embedded web bundle.
# Models LotusGuild/cinny's .gitea/workflows/ci.yml. Web bundle only, so
# Linux-only (the Windows worker is for cinny-desktop / Tauri, not needed here).
#
# - PRs and pushes to `lotus`         -> build + smoke-check the embedded dist
# - Pushes of a tag `v*`              -> build + publish @lotusguild/element-call-embedded
#                                         to the Gitea npm registry
#
# Versioning: the checked-in embedded/web/package.json tracks the intended next
# release (e.g. 0.20.1-lotus.2) for local/manual publishes, but the AUTHORITATIVE
# published version is still derived from the git tag at publish time (the
# `npm version "$TAG"` step below overwrites it, so a tag always wins).

on:
  push:
    branches: [lotus]
    tags: ["v*"]
  pull_request:
    branches: [lotus]

# A superseded push cancels its in-flight run (same guard as cinny's ci.yml):
# rapid pushes to lotus otherwise queue one full build each on the shared runner.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  # element-call's build:full sets 16384 already; keep parity for safety.
  NODE_OPTIONS: "--max-old-space-size=16384"

jobs:
  build:
    name: Build embedded bundle
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: ".node-version" # Node 24
          # registry-url wires up the Gitea-scoped registry + auth for publish
          registry-url: "https://code.lotusguild.org/api/packages/LotusGuild/npm/"
          scope: "@lotusguild"

      # pnpm is installed directly (NOT via `corepack enable`): matrix-js-sdk
      # is a git dependency that pnpm has to build from source, and its own
      # devEngines pins a different pnpm (11.9.0). A corepack-shimmed pnpm
      # refuses to switch versions for that nested install and the whole
      # `pnpm install` fails (run #1854); a real pnpm binary downloads the
      # pinned version itself. Version is read from package.json's
      # packageManager field so it cannot drift from the lockfile.
      - name: Install pnpm (version from packageManager field)
        # The runner's cached Node toolchain keeps a corepack `pnpm` shim from
        # earlier runs, and npm refuses to overwrite it (EEXIST, run #1855) —
        # drop the shim first so the real binary lands.
        run: |
          B="$(dirname "$(command -v node)")"
          corepack disable pnpm 2>/dev/null || true
          rm -f "$B/pnpm" "$B/pnpx"
          npm install -g "pnpm@$(node -p "require('./package.json').packageManager.split('@')[1].split('+')[0]")"
          pnpm --version

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # ── Quality gates (hard) — run BEFORE the slow build so a type/lint/
      # format/test error fails in seconds. Upstream replaced eslint+prettier
      # with oxlint+oxfmt in v0.25.0; `pnpm lint` = tsc + oxlint + knip.
      - name: Lint (tsc + oxlint + knip)
        run: pnpm lint

      - name: Format check (oxfmt)
        run: pnpm format:check

      - name: Unit tests
        run: pnpm test:unit --run

      - name: Build embedded
        # build:embedded writes to the repo-root dist/ (vite default outDir).
        # Stage it into embedded/web/dist — the publish template's "files" entry
        # — so the smoke-check and npm publish both see the bundle.
        # (embedded/web/dist is gitignored, hence the explicit copy.)
        # VITE_APP_VERSION stamps the bundle so analytics/rageshakes aren't
        # labelled "dev". Scoped to the build step only: at workflow level it
        # also reached the unit tests, whose DeveloperSettingsTab snapshot
        # expects the unset ("dev") value (run #1859).
        env:
          VITE_APP_VERSION: ${{ github.ref_name }}
        run: |
          pnpm run build:embedded
          rm -rf embedded/web/dist
          cp -r dist embedded/web/dist

      - name: Smoke-check output
        run: |
          test -f embedded/web/dist/index.html
          test -d embedded/web/dist/assets
          echo "### Embedded bundle" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          du -sh embedded/web/dist >> "$GITHUB_STEP_SUMMARY"
          ls embedded/web/dist >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"

      # NOTE: no actions/upload-artifact step — v4 requires GitHub's artifact
      # backend, which the Gitea act_runner does not implement (it fails with
      # exit 1). The publish job rebuilds from source anyway, so the artifact
      # was only a convenience; re-add a Gitea-compatible action here if per-run
      # dist downloads are ever needed.

  publish:
    name: Publish to Gitea npm registry
    needs: build
    # Only on a version tag push, never on PRs.
    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: ".node-version"
          registry-url: "https://code.lotusguild.org/api/packages/LotusGuild/npm/"
          scope: "@lotusguild"

      # pnpm is installed directly (NOT via `corepack enable`): matrix-js-sdk
      # is a git dependency that pnpm has to build from source, and its own
      # devEngines pins a different pnpm (11.9.0). A corepack-shimmed pnpm
      # refuses to switch versions for that nested install and the whole
      # `pnpm install` fails (run #1854); a real pnpm binary downloads the
      # pinned version itself. Version is read from package.json's
      # packageManager field so it cannot drift from the lockfile.
      - name: Install pnpm (version from packageManager field)
        # The runner's cached Node toolchain keeps a corepack `pnpm` shim from
        # earlier runs, and npm refuses to overwrite it (EEXIST, run #1855) —
        # drop the shim first so the real binary lands.
        run: |
          B="$(dirname "$(command -v node)")"
          corepack disable pnpm 2>/dev/null || true
          rm -f "$B/pnpm" "$B/pnpx"
          npm install -g "pnpm@$(node -p "require('./package.json').packageManager.split('@')[1].split('+')[0]")"
          pnpm --version

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build embedded
        # build:embedded writes to the repo-root dist/ (vite default outDir).
        # Stage it into embedded/web/dist — the publish template's "files" entry
        # — so the smoke-check and npm publish both see the bundle.
        # (embedded/web/dist is gitignored, hence the explicit copy.)
        # VITE_APP_VERSION stamps the bundle so analytics/rageshakes aren't
        # labelled "dev". Scoped to the build step only: at workflow level it
        # also reached the unit tests, whose DeveloperSettingsTab snapshot
        # expects the unset ("dev") value (run #1859).
        env:
          VITE_APP_VERSION: ${{ github.ref_name }}
        run: |
          pnpm run build:embedded
          rm -rf embedded/web/dist
          cp -r dist embedded/web/dist

      - name: Set published version from tag
        working-directory: embedded/web
        # Versioning scheme: reserve bare vX.Y.Z for upstream-parity points only
        # (e.g. v0.20.1 == upstream 0.20.1). For Lotus-only iterations on top of
        # an upstream base, tag a semver prerelease — v0.20.1-lotus.1, -lotus.2,
        # … — so we never collide with an already-published upstream-parity
        # version on the registry.
        run: |
          TAG="${GITHUB_REF_NAME#v}"   # v0.20.1-lotus.1 -> 0.20.1-lotus.1
          npm version "$TAG" --no-git-tag-version --allow-same-version

      # `--tag lotus`: npm >= 11 refuses to publish a prerelease (x.y.z-lotus.N)
      # without an explicit dist-tag (run #1861). cinny pins exact versions, so
      # the dist-tag is only a namespace — it keeps `latest` pointing at the
      # last upstream-parity publish.
      - name: Publish
        working-directory: embedded/web
        # Secret names starting with GITEA_ are reserved and can't be created, so
        # the original `GITEA_NPM_TOKEN` never existed (every CI publish since the
        # fork's first commit hit ENEEDAUTH). Org secret, write:package scope.
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
        run: npm publish --access public --tag lotus