Repository navigation
fix(linux): constrain native packaging scripts and tests to Linux #411
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Hosted card deploy | |
| # Runs on every push to main so every main commit shows a hosted card check. | |
| # It only deploys when hosted code changed (or on manual dispatch); otherwise | |
| # it just smoke-tests the live site. That keeps Vercel Hobby deploys rare. | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| changes: | |
| name: Hosted card changes | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| deploy: ${{ steps.diff.outputs.deploy }} | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Did hosted code change? | |
| id: diff | |
| env: | |
| EVENT: ${{ github.event_name }} | |
| BEFORE: ${{ github.event.before }} | |
| AFTER: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$EVENT" != "push" ] || ! git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then | |
| echo "deploy=true" >> "$GITHUB_OUTPUT"; exit 0 | |
| fi | |
| if git diff --name-only "$BEFORE" "$AFTER" | grep -qE '^(hosted/|src/card\.js$|\.github/workflows/hosted-deploy\.yml$)'; then | |
| echo "deploy=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "deploy=false" >> "$GITHUB_OUTPUT" | |
| echo "No hosted changes in this push; skipping the deploy and checking the live site only." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| deploy: | |
| name: Deploy hosted card service to Vercel | |
| needs: changes | |
| if: needs.changes.outputs.deploy == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| # Serialize deploys only. A workflow-level group would drop the whole | |
| # queued run (and its checks) when two main commits land close together. | |
| concurrency: | |
| group: hosted-deploy | |
| cancel-in-progress: false | |
| environment: | |
| name: production | |
| url: ${{ vars.HOSTED_BASE_URL }} | |
| env: | |
| VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} | |
| VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} | |
| VERCEL_TELEMETRY_DISABLED: "1" | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 22 | |
| - name: Test hosted service | |
| run: node --test test/hosted-service.test.js test/hosted-http.test.js | |
| - name: Pull Vercel project settings | |
| env: | |
| VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} | |
| run: npx --yes vercel@59.25.4 pull --yes --environment=production --token="$VERCEL_TOKEN" | |
| - name: Build | |
| env: | |
| VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} | |
| run: npx --yes vercel@59.25.4 build --prod --token="$VERCEL_TOKEN" | |
| - name: Deploy | |
| timeout-minutes: 5 | |
| env: | |
| VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} | |
| # Drop git metadata first. With it, Vercel attributes the deploy to the | |
| # commit author, who isn't a member of the Hobby "nowplaying" team, and | |
| # blocks the deployment (the CLI then waits at "Building..." forever). | |
| # The prebuilt output is already in .vercel/output. | |
| run: | | |
| set -euo pipefail | |
| rm -rf .git | |
| npx --yes vercel@59.25.4 deploy --prebuilt --prod --token="$VERCEL_TOKEN" | |
| live: | |
| name: Hosted card live check | |
| needs: [changes, deploy] | |
| if: ${{ !cancelled() && needs.changes.result == 'success' && needs.deploy.result != 'failure' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - name: Smoke test production domain | |
| env: | |
| BASE_URL: ${{ vars.HOSTED_BASE_URL }} | |
| run: | | |
| set -euo pipefail | |
| test -n "$BASE_URL" | |
| curl --fail --silent --show-error --retry 5 --retry-delay 3 "$BASE_URL/healthz" | grep -qx ok | |
| curl --fail --silent --show-error "$BASE_URL/api/card?id=AAAAAAAAAAAAAAAAAAAAAA" | grep -qi 'not playing' | |
| curl --fail --silent --show-error "$BASE_URL/" | grep -q 'nowplaying hosted cards' | |
| test "$(curl --silent --output /dev/null --write-out '%{http_code}' "$BASE_URL/lib/service.js")" = 404 |