.github/workflows/build.yaml - develop - scamii/scam-dev

.github/workflows/build.yaml
173 строки5 KB
Fediushin
ci: publish PHPCS diagnostics
10 июл 2026, 07:25
10 июл 2026, 07:25e7238ec
name: Quality, Build and Release

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  pull_request:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: scam-dev-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    name: Quality and security gates
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "22"
          cache: npm

      - name: Install JavaScript dependencies
        # The committed lockfile was generated with legacy peer resolution
        # because WordPress Scripts 30 still declares React 18 peer ranges,
        # while WordPress itself provides the external React runtime.
        run: npm ci --legacy-peer-deps

      - name: JavaScript lint
        id: javascript_lint
        continue-on-error: true
        run: npm run lint:js 2>&1 | tee javascript-lint.log

      - name: Upload JavaScript lint report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: javascript-lint-report
          path: javascript-lint.log
          if-no-files-found: error
          retention-days: 7

      - name: Enforce JavaScript lint
        if: steps.javascript_lint.outcome == 'failure'
        run: exit 1

      - name: CSS lint
        id: css_lint
        continue-on-error: true
        run: npm run lint:css:ci 2>&1 | tee css-lint.log

      - name: Upload CSS lint report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: css-lint-report
          path: css-lint.log
          if-no-files-found: error
          retention-days: 7

      - name: Enforce CSS lint
        if: steps.css_lint.outcome == 'failure'
        run: exit 1

      - name: Static regression tests
        run: npm run test:static

      - name: Runtime dependency audit
        run: npm audit --omit=dev --audit-level=high

      - name: Install PHP quality tools
        run: composer install --no-interaction --prefer-dist --no-progress

      - name: Composer audit
        run: composer audit --locked

      - name: WordPress coding standards
        id: phpcs
        continue-on-error: true
        run: composer lint 2>&1 | tee phpcs.log

      - name: Upload WordPress coding standards report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: phpcs-report
          path: phpcs.log
          if-no-files-found: error
          retention-days: 7

      - name: Enforce WordPress coding standards
        if: steps.phpcs.outcome == 'failure'
        run: exit 1

      - name: PHP syntax
        run: |
          find . -type f -name '*.php' \
            -not -path './vendor/*' \
            -not -path './node_modules/*' \
            -print0 | xargs -0 -n1 php -l

      - name: PHP runtime regression tests
        run: |
          php tests/update-signing-test.php
          php tests/svg-sanitizer-test.php

      - name: Build production assets
        run: npm run build

      - name: Package and smoke-test release archives
        run: bash scripts/package.sh

  release:
    name: Signed GitHub release archives
    if: startsWith(github.ref, 'refs/tags/v')
    needs:
      - quality
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "22"
          cache: npm

      - name: Build and package
        run: |
          npm ci --legacy-peer-deps
          npm run build
          bash scripts/package.sh

      - name: Generate changelog
        run: |
          previous_tag="$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || true)"
          if [[ -n "$previous_tag" ]]; then
            git log "$previous_tag"..HEAD --pretty=format:'- %s' --no-merges > CHANGELOG_BODY.md
          else
            git log --pretty=format:'- %s' --no-merges > CHANGELOG_BODY.md
          fi
          [[ -s CHANGELOG_BODY.md ]] || printf '%s\n' '- Initial release' > CHANGELOG_BODY.md

      - name: Create GitHub release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          name: Scam Dev ${{ github.ref_name }}
          body_path: CHANGELOG_BODY.md
          files: |
            scam-dev-*.zip
            scam-dev-*.zip.sha256
          draft: false
          prerelease: ${{ contains(github.ref_name, 'beta') || contains(github.ref_name, 'alpha') || contains(github.ref_name, 'rc') }}