ui-preview.yml

# UI previews on pull requests, by tinysweeper.
#
# For a pull request that touches the app's UI, tinysweeper plans the user
# flows the change affects, this job drives the web build through them (head
# and merge-base), and the tinysweeper server posts one comment with clips
# and annotated screenshots of what changed. This job builds and serves
# openhuman's own code and talks to the server with a bearer token; it holds
# no model or GitHub-write credential. See .github/tinysweeper/serve.sh and
# .github/tinysweeper/ui-preview.json.
#
# Same-repository, non-draft pull requests only: a fork's job cannot read the
# secrets below.
name: UI preview

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - "app/src/**"
      - "app/index.html"
      - "app/public/**"
      - "app/package.json"
      - ".github/tinysweeper/**"
      - ".github/workflows/ui-preview.yml"

permissions:
  contents: read
  packages: read

concurrency:
  group: ui-preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  ui-preview:
    name: ui-preview
    if: >-
      github.event.pull_request.draft == false &&
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-22.04
    defaults:
      run:
        shell: bash
    container:
      image: ghcr.io/tinyhumansai/openhuman_ci:latest
    timeout-minutes: 60
    steps:
      - name: Check out the head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: false
          submodules: recursive

      - name: Find the merge-base
        id: base
        shell: bash
        run: |
          set -euo pipefail
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git fetch --no-tags origin "${{ github.event.pull_request.base.ref }}"
          sha="$(git merge-base HEAD "origin/${{ github.event.pull_request.base.ref }}")"
          echo "sha=$sha" >> "$GITHUB_OUTPUT"

      - name: Check out the merge-base beside it
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ steps.base.outputs.sha }}
          path: before
          persist-credentials: false
          submodules: recursive

      - name: Cache pnpm store
        uses: actions/cache@v6
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            pnpm-store-${{ runner.os }}-

      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            . -> target
          cache-on-failure: true
          key: ui-preview-linux

      - name: Install JS dependencies (both checkouts)
        run: |
          set -euo pipefail
          pnpm install --frozen-lockfile
          (cd before && pnpm install --frozen-lockfile)
          touch .env app/.env before/.env before/app/.env

      # The core is built once, for the head, and shared with the merge-base
      # side through TS_SHARED_CORE_BIN — see .github/tinysweeper/serve.sh for
      # why. The web bundle is built per checkout by that script.
      - name: Build the standalone core once
        id: core
        run: |
          set -euo pipefail
          triple="$(rustc -vV | awk '/^host: / { print $2 }')"
          target="$PWD/target/ui-preview-${triple}"
          features="$(bash scripts/ci/product-features.sh)"
          CARGO_TARGET_DIR="$target" cargo build --bin openhuman-core --features "$features"
          echo "bin=$target/debug/openhuman-core" >> "$GITHUB_OUTPUT"

      - name: Check out the pinned Tinysweeper preview runner
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          repository: tinyhumansai/tinysweeper
          ref: 2afdd90d1ced1ea8433d4f6f825ac148c6b783c7
          path: .github/tinysweeper-action
          persist-credentials: false

      - name: Set up Node for the preview runner
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"

      - name: Install the preview runner
        working-directory: .github/tinysweeper-action/actions/ui-preview
        run: |
          set -euo pipefail
          npm ci --no-audit --no-fund
          npx playwright install --with-deps chromium-headless-shell
          if ! command -v ffmpeg >/dev/null; then
            apt-get update -qq && apt-get install -y -qq --no-install-recommends ffmpeg || echo "::warning::ffmpeg is not installable here; clips will be skipped"
          fi

      - name: Drive the preview
        env:
          TS_SHARED_CORE_BIN: ${{ steps.core.outputs.bin }}
          OPENHUMAN_KEYRING_BACKEND: file
          TS_SERVER: ${{ vars.TINYSWEEPER_SERVER_URL }}
          TS_TOKEN: ${{ secrets.TINYSWEEPER_PREVIEW_TOKEN }}
          TS_CONFIG: .github/tinysweeper/ui-preview.json
          TS_BEFORE_DIR: before
          TS_AFTER_DIR: .
          TS_BASE_SHA: ${{ steps.base.outputs.sha }}
          TS_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          TS_REPO: ${{ github.repository }}
          TS_PR: ${{ github.event.pull_request.number }}
          TS_OUT: ${{ runner.temp }}/ui-preview
          TS_S3_BUCKET: ${{ secrets.PREVIEW_S3_BUCKET }}
          TS_S3_ENDPOINT: ${{ secrets.PREVIEW_S3_ENDPOINT }}
          TS_S3_REGION: ${{ vars.PREVIEW_S3_REGION || 'auto' }}
          AWS_ACCESS_KEY_ID: ${{ secrets.PREVIEW_S3_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.PREVIEW_S3_SECRET_ACCESS_KEY }}
        run: node .github/tinysweeper-action/actions/ui-preview/run.mjs

      - name: Keep the run as an artifact
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ui-preview
          path: ${{ runner.temp }}/ui-preview
          if-no-files-found: ignore
          retention-days: 14