pages-deploy.yml

name: Build and Deploy to Pages

on:
  push:
    branches:
      - main
    paths:
      - src/**
      - static/**
      - package.json
      - pnpm-lock.yaml
      - "*.config.*s"
      - tsconfig.json
      - .github/workflows/*
  pull_request:
    paths:
      - src/**
      - static/**
      - package.json
      - pnpm-lock.yaml
      - "*.config.*s"
      - tsconfig.json
      - .github/workflows/*

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  HUSKY: 0

# Start the workflow
jobs:
  permissions-check:
    name: Permissions check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    outputs:
      has-permissions: ${{ steps.check-output.outputs.has-permissions }}

    steps:
      - name: ❓ Has access to secrets?
        id: secrets-check
        continue-on-error: true
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.repository.full_name }}
          ref: ${{ github.head_ref }}
          token: ${{ secrets.WORKFLOW_PAT }}

      - name: 📤 Set output
        id: check-output
        if: always()
        run: echo "has-permissions=${{ steps.secrets-check.outcome == 'success' && 'true' || 'false' }}" >> $GITHUB_OUTPUT

  prechecks:
    name: Pre-checks
    runs-on: ubuntu-latest
    needs: permissions-check
    if: github.event_name == 'pull_request' && !failure() && !cancelled()
    permissions:
      contents: write

    steps:
      - name: 📂 Checkout
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.repository.full_name }}
          ref: ${{ github.head_ref }}
          token: ${{ needs.permissions-check.outputs.has-permissions == 'false' && github.token || secrets.WORKFLOW_PAT }}
          fetch-depth: ${{ github.event_name == 'push' && 2 || 1 }}

      - name: 📥 Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: latest

      - name: 🧭 Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: latest
          cache: pnpm

      - name: 📥 Install NPM dependencies
        run: pnpm i --no-frozen-lockfile

      - name: 🔍 Detect file changes
        id: detect-changes-pnpm
        run: |
          if [[ $(git diff --name-only) =~ pnpm-lock.yaml ]]; then
            echo "changes_detected=true >> $GITHUB_OUTPUT"
          else
            echo "changes_detected=false >> $GITHUB_OUTPUT"
          fi

      - name: ❌ Exit if lock file is not updated
        if: needs.permissions-check.outputs.has-permissions == 'false' && steps.detect-changes-pnpm.outputs.changes_detected == 'true'
        run: exit 1

      - name: 📤 Commit updated lock file
        id: auto-commit-action-lock
        if: needs.permissions-check.outputs.has-permissions == 'true'
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Update lock file
          file_pattern: pnpm-lock.yaml

      - name: ❌ Exit if lock file has been committed
        if: needs.permissions-check.outputs.has-permissions == 'true' && steps.auto-commit-action-lock.outputs.changes_detected == 'true'
        run: exit 1

      - name: 🔨 Compile Inlang
        run: pnpm exec paraglide-js compile --project ./project.inlang

      - name: ✅ Validate Inlang
        run: pnpx @inlang/cli@latest validate --project ./project.inlang

      - name: ✨ Check for missing localizations
        id: missing-localizations
        run: pnpx @inlang/cli@latest lint --project ./project.inlang

      - name: 🔤 Translate missing localizations
        if: failure() && needs.permissions-check.outputs.has-permissions == 'true' && steps.missing-localizations.outcome == 'failure'
        run: pnpx @inlang/cli@latest machine translate --project ./project.inlang

      - name: 📤 Commit localization fixes
        if: failure() && needs.permissions-check.outputs.has-permissions == 'true' && steps.missing-localizations.outcome == 'failure'
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Fix localizations

      - name: ❌ Exit if localization fixes have been committed
        if: needs.permissions-check.outputs.has-permissions == 'true' && steps.auto-commit-action-lock.outputs.changes_detected == 'true'
        run: exit 1

      - name: ✨ Lint check localizations
        id: check-localizations
        run: |
          # Remove all lines that contain "error" in ./project.inlang/settings.json
          sed -i '/\"error\"/d' ./project.inlang/settings.json
          # Replace all "warning"s in ./project.inlang/settings.json with "error"
          sed -i 's/\"warning\"/\"error\"/g' ./project.inlang/settings.json
          pnpx @inlang/cli@latest lint --project ./project.inlang
          # Restore ./project.inlang/settings.json
          git restore ./project.inlang/settings.json

      - name: 🔍 Get modified files
        id: modified-files
        uses: tj-actions/changed-files@v45

      - name: 📤 Export results
        id: changed-files
        run: |
          code_changes=false
          config_changes=false
          deps_changes=false

          for file in ${{ steps.modified-files.outputs.all_changed_files }}; do
            if [[ $file =~ ^src/ || $file =~ ^static/ ]]; then
              echo "$file changes code"
              code_changes=true
            elif [[ $file = pnpm-lock.yaml ]]; then
              echo "$file changes dependencies"
              deps_changes=true
            elif [[ $file = *.config.*s || $file = tsconfig.json ]]; then
              echo "$file changes config"
              config_changes=true
            fi
            if [[ $code_changes == 'true' && $config_changes == 'true' ]]; then
              echo "Code and config changes detected, skipping further checks"
              break
            fi
          done

          echo "code_changes=$code_changes" >> $GITHUB_OUTPUT
          echo "config_changes=$config_changes" >> $GITHUB_OUTPUT
          echo "deps_changes=$deps_changes" >> $GITHUB_OUTPUT

      - name: ✨ Check Svelte format
        id: svelte-format
        if: steps.changed-files.outputs.code_changes == 'true'
        run: pnpm check

      - name: ✨ Check style with Prettier & ESLint
        id: prettier-eslint
        if: steps.changed-files.outputs.code_changes == 'true' || steps.changed-files.outputs.config_changes == 'true' || steps.changed-files.outputs.deps_changes == 'true'
        run: pnpm lint

      - name: 🔧 Fix lint
        if: failure() && needs.permissions-check.outputs.has-permissions == 'true' && (steps.svelte-format.outcome == 'failure' || steps.prettier-eslint.outcome == 'failure')
        run: pnpm format && pnpm eslint --fix .

      - name: 📤 Commit lint fixes
        if: failure() && needs.permissions-check.outputs.has-permissions == 'true' && (steps.svelte-format.outcome == 'failure' || steps.prettier-eslint.outcome == 'failure')
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Fix lint

  build:
    name: Build website
    runs-on: ubuntu-latest
    needs: prechecks
    if: (!failure() || github.event_name == 'push') && !cancelled()
    outputs:
      has-built: ${{ steps.changed-files.outputs.requires_build }}

    steps:
      - name: 📂 Checkout
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.repository.full_name }}
          ref: ${{ github.head_ref }}
          fetch-depth: ${{ github.event_name == 'push' && 2 || 1 }}

      - name: 🔍 Get modified files
        id: modified-files
        uses: tj-actions/changed-files@v45

      - name: 📤 Export results
        id: changed-files
        run: |
          requires_build=false

          for file in ${{ steps.modified-files.outputs.all_changed_files }}; do
            if [[ $file =~ ^src/ || $file =~ ^static/ || $file = pnpm-lock.yaml || $file = *.config.*s || $file = tsconfig.json ]]; then
              echo "$file requires build"
              requires_build=true
              break
            fi
          done

          echo "requires_build=$requires_build" >> $GITHUB_OUTPUT

      - name: 🔧 Configure pages
        uses: actions/configure-pages@v5
        if: github.event_name != 'pull_request' && steps.changed-files.outputs.requires_build == 'true'
        id: pages
        with:
          static_site_generator: sveltekit

      - name: 📥 Install pnpm
        if: steps.changed-files.outputs.requires_build == 'true'
        uses: pnpm/action-setup@v4
        with:
          version: latest

      - name: 🧭 Setup Node
        if: steps.changed-files.outputs.requires_build == 'true'
        uses: actions/setup-node@v4
        with:
          node-version: latest
          cache: pnpm

      - name: 📥 Install NPM dependencies
        if: steps.changed-files.outputs.requires_build == 'true'
        run: pnpm i # no need for `--no-frozen-lockfile` here, as the sync is ensured by the `prechecks` job

      - name: 🔨 Build repo
        if: steps.changed-files.outputs.requires_build == 'true'
        run: |
          touch static/.nojekyll
          pnpm build

      - name: 📤 Upload artifact
        if: github.event_name == 'push' && steps.changed-files.outputs.requires_build == 'true'
        uses: actions/upload-pages-artifact@v3
        with:
          path: build

  deploy:
    name: Deploy website to GitHub Pages
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'push' && !failure() && !cancelled() && needs.build.outputs.has-built == 'true'
    concurrency:
      group: pages
      cancel-in-progress: true
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    outputs:
      page_url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - name: 🌍 Deploy Pages
        uses: actions/deploy-pages@v4
        id: deployment

  perf-check:
    name: Performance checks
    runs-on: ubuntu-latest
    needs: [build, deploy]
    if: github.event_name == 'push' && !failure() && !cancelled() && needs.build.outputs.has-built == 'true'

    steps:
      - name: 🧭 Setup Bun
        uses: oven-sh/setup-bun@v2

      - name: ⚓️ Unlighthouse check
        run: |
          bun i -g @unlighthouse/cli puppeteer
          unlighthouse-ci --site ${{ needs.deploy.outputs.page_url }} --budget 75

      - name: 📤 Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: unlighthouse-result
          path: .unlighthouse/ci-result.json