validate.yml

name: Validate Web Console

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - name: Check out immutable Web Console source
        env:
          SOURCE_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "$SOURCE_SHA"
          git -c advice.detachedHead=false checkout --detach FETCH_HEAD
          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
          test -z "$(git status --short)"

      - name: Install pinned Node.js
        env:
          NODE_VERSION: 24.20.0
          NODE_ARCHIVE_SHA256: 2f2c0da162318f0de47665410c7c8c2ed3d36c8f3105de4bbc61176c70a7cbf2
          NPM_VERSION: 12.0.2
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/node.tar.xz"
          curl \
            --proto '=https' \
            --tlsv1.2 \
            --fail \
            --silent \
            --show-error \
            --location \
            --retry 5 \
            --retry-all-errors \
            --retry-delay 2 \
            -o "$archive" \
            "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"
          printf '%s  %s\n' "$NODE_ARCHIVE_SHA256" "$archive" |
            sha256sum --check
          mkdir -p "$RUNNER_TEMP/node"
          tar -xJf "$archive" --strip-components=1 -C "$RUNNER_TEMP/node"
          "$RUNNER_TEMP/node/bin/npm" install \
            --global \
            --prefix "$RUNNER_TEMP/node" \
            --ignore-scripts \
            --no-audit \
            --no-fund \
            "npm@${NPM_VERSION}"
          test "$("$RUNNER_TEMP/node/bin/npm" --version)" = "$NPM_VERSION"
          echo "$RUNNER_TEMP/node/bin" >>"$GITHUB_PATH"

      - name: Test and build twice
        id: build
        env:
          PASTURESTACK_NODE24_IMAGE: node:24.20.0-bookworm@sha256:be23f54a88d34e8824c741b19b91064094f92c1c97b194144bfc8b50d67258e2
        run: |
          set -euo pipefail
          test "$(node --version)" = v24.20.0
          test "$(npm --version)" = 12.0.2
          npm ci --ignore-scripts --no-audit --no-fund
          bash scripts/ci

          package_version=$(node -p 'require("./package.json").version')
          source_date_epoch=$(git show -s --format=%ct "$GITHUB_SHA")
          export SOURCE_DATE_EPOCH="$source_date_epoch"
          work_root=$(mktemp -d)
          cleanup() {
            rm -rf "$work_root"
          }
          trap cleanup EXIT

          build_candidate() {
            output=$1
            rm -rf dist
            ./node_modules/.bin/ember build --environment production
            bash scripts/package-static-candidate \
              "$package_version" \
              dist \
              "$output"
          }

          build_candidate "$work_root/web-console-a.tar.gz"
          build_candidate "$work_root/web-console-b.tar.gz"
          cmp "$work_root/web-console-a.tar.gz" "$work_root/web-console-b.tar.gz"
          artifact_sha=$(sha256sum "$work_root/web-console-a.tar.gz" | awk '{print $1}')
          test "$(tar -tzf "$work_root/web-console-a.tar.gz" |
            cut -d/ -f1 | sort -u)" = "$package_version"
          test "$(tar -xOzf "$work_root/web-console-a.tar.gz" \
            "${package_version}/VERSION.txt")" = "$package_version"
          test "$(tar -tzf "$work_root/web-console-a.tar.gz" |
            grep -Ec "^${package_version}/translations/zh-tw\\.json$")" -eq 1
          if tar -tzf "$work_root/web-console-a.tar.gz" | grep -Eq '\.map$'; then
            echo WEB_CONSOLE_SOURCE_MAP_PRESENT >&2
            exit 1
          fi
          printf 'WEB_CONSOLE_VALIDATION_OK source=%s package=%s artifact=%s sha256=%s\n' \
            "$GITHUB_SHA" \
            "$package_version" \
            "$package_version" \
            "$artifact_sha"
          release_asset="$RUNNER_TEMP/web-console-${package_version}.tar.gz"
          cp "$work_root/web-console-a.tar.gz" "$release_asset"
          release_dir=$(dirname "$release_asset")
          release_name=$(basename "$release_asset")
          (
            cd "$release_dir"
            sha256sum "$release_name" >"${release_name}.sha256"
          )
          test "$(awk '{print $2}' "${release_asset}.sha256")" = "$release_name"
          printf 'package_version=%s\nrelease_asset=%s\n' \
            "$package_version" "$release_asset" >>"$GITHUB_OUTPUT"

      - name: Retain reviewed candidate for release
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: web-console-${{ steps.build.outputs.package_version }}
          path: |
            ${{ steps.build.outputs.release_asset }}
            ${{ steps.build.outputs.release_asset }}.sha256
          if-no-files-found: error
          retention-days: 30
          compression-level: 0