build.yml

name: Builds

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  changes:
    runs-on: ubuntu-latest
    # Required permissions
    permissions:
      pull-requests: read
    # Set job outputs to values from filter step
    outputs:
      android: ${{ steps.filter.outputs.android }}
      web: ${{ steps.filter.outputs.web }}
      admin: ${{ steps.filter.outputs.admin }}
      admin-dependencies: ${{ steps.filter.outputs.admin-dependencies }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v2
        id: filter
        with:
          filters: |
            android:
              - 'app/**'
              - '*gradle*'
              - '.github/workflows/build.yml'
            web:
              - 'web/**'
              - '.github/workflows/build.yml'
            admin:
              - 'admin/**'
              - '.github/workflows/build.yml'
            admin-dependencies:
              - 'admin/package*'
              - '.github/workflows/build.yml'

  block-fixup:
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Block fixup commit merge
        uses: 13rac1/block-fixup-merge-action@v2.0.0

  gradle-dependency-submission:
    needs: changes
    if: ${{ needs.changes.outputs.android == 'true' && github.ref == 'refs/heads/master' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: "17"
          distribution: "temurin"
          cache: gradle

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Gradle Dependency Submission
        uses: mikepenz/gradle-dependency-submission@v0.9.0
        with:
          gradle-build-module: ":app"
        env:
          ORG_GRADLE_PROJECT_Refitted_IdentityPoolId: "not-needed"
          ORG_GRADLE_PROJECT_Refitted_OpenIdSource: "not-needed"

  build-android:
    needs: changes
    if: ${{ needs.changes.outputs.android == 'true' }}

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: "17"
          distribution: "temurin"
          cache: gradle

      - name: Decode google-services.json
        env:
          FIREBASE_SECRET: ${{ secrets.FIREBASE_SECRET }}
        run: echo $FIREBASE_SECRET | base64 --decode > app/google-services.json

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Build with Gradle
        env:
          ORG_GRADLE_PROJECT_Refitted_IdentityPoolId: ${{ secrets.REFITTED_IDENTITYPOOLID }}
          ORG_GRADLE_PROJECT_Refitted_OpenIdSource: ${{ secrets.REFITTED_OPENIDSOURCE }}
        run: ./gradlew assembleMinDebug

  build-web:
    needs: changes
    if: ${{ needs.changes.outputs.web == 'true' }}

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js 16.17
        uses: actions/setup-node@v3
        with:
          node-version: 16.17
          cache: "npm"
          cache-dependency-path: "web/package-lock.json"

      - run: npm ci
        working-directory: web

      - name: Decode secrets
        env:
          FIREBASE: ${{ secrets.FIREBASETS }}
          AWS: ${{ secrets.AWSTS }}
        # base64 -w 0 <file> | clip
        run: |
          echo $FIREBASE | base64 --decode > web/store/auth/firebase.ts
          echo $AWS | base64 --decode > web/store/aws/aws.ts

      - run: npm run build
        working-directory: web

  lint-web:
    needs: changes
    if: ${{ needs.changes.outputs.web == 'true' }}

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js 16.17
        uses: actions/setup-node@v3
        with:
          node-version: 16.17
          cache: "npm"
          cache-dependency-path: "web/package-lock.json"

      - run: npm ci
        working-directory: web

      - name: Decode secrets
        env:
          FIREBASE: ${{ secrets.FIREBASETS }}
          AWS: ${{ secrets.AWSTS }}
        # base64 -w 0 <file> | clip
        run: |
          echo $FIREBASE | base64 --decode > web/store/auth/firebase.ts
          echo $AWS | base64 --decode > web/store/aws/aws.ts

      - run: npm run lint
        working-directory: web

  lint-admin:
    needs: changes
    if: ${{ needs.changes.outputs.admin == 'true' }}

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js 16.17
        uses: actions/setup-node@v3
        with:
          node-version: 16.17
          cache: "npm"
          cache-dependency-path: "admin/package-lock.json"

      - run: npm ci
        working-directory: admin

      - name: Provide firebase.json
        # base64 -w 0 <file> | clip
        run: |
          echo "{}" > admin/firebase.json

      - run: npm run lint
        working-directory: admin

  admin-matrix:
    needs: changes
    if: ${{ needs.changes.outputs.admin == 'true' && needs.changes.outputs.admin-dependencies == 'false' }}

    runs-on: ubuntu-latest
    # Required permissions
    permissions:
      pull-requests: read
    # Set job outputs to values from filter step
    outputs:
      admin-packages: ${{ steps.filter.outputs.admin_files }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v2
        id: filter
        with:
          list-files: json
          filters: |
            admin:
              - added|modified: 'admin/lambda/*.ts'

  build-admin-some:
    needs: admin-matrix
    # continue-on-error: true
    strategy:
      max-parallel: 1
      matrix:
        package: ${{ fromJSON(needs.admin-matrix.outputs.admin-packages) }}

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js 16.17
        uses: actions/setup-node@v3
        with:
          node-version: 16.17
          cache: "npm"
          cache-dependency-path: "admin/package-lock.json"

      - run: npm ci
        working-directory: admin

      - name: Provide firebase.json
        # base64 -w 0 <file> | clip
        run: |
          echo "{}" > admin/firebase.json

      - run: npm run build ../${{ matrix.package }}
        working-directory: admin

  list-admin-files:
    needs: changes
    if: ${{ needs.changes.outputs.admin-dependencies == 'true' }}
    runs-on: ubuntu-latest
    outputs:
      paths: ${{ steps.list-files.outputs.paths }}
    steps:
      - name: List Files
        id: list-files
        uses: mirko-felice/list-files-action@v3.0.5
        with:
          repo: ${{ github.repository }}
          ref: ${{ github.ref }}
          path: "admin/lambda"
          ext: ".ts"

  # TODO can this be combined with the non-depencency version?
  build-admin-all:
    needs: list-admin-files
    # continue-on-error: true
    strategy:
      max-parallel: 1
      matrix:
        package: ${{ fromJSON(needs.list-admin-files.outputs.paths) }}

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js 16.17
        uses: actions/setup-node@v3
        with:
          node-version: 16.17
          cache: "npm"
          cache-dependency-path: "admin/package-lock.json"

      - run: npm ci
        working-directory: admin

      - name: Decode secrets
        env:
          GROUPS: ${{ secrets.REFITTED_GROUPS }}
        # base64 -w 0 <file> | clip
        run: |
          echo "{}" > admin/firebase.json
          echo $GROUPS | base64 --decode > admin/refitted.ts

      - run: npm run build ../${{ matrix.package }}
        working-directory: admin