ermnvldmr.com/.gitea/workflows/services-www-next-required.yml

name: services/www - next/required
'on':
  push:
    branches:
    - next
    paths:
    - services/www/**
    - packages/ui/**
    - packages/stl/**
    - packages/i18n/**
    - .gitea/workflows/services-www-next-required.yml
    - ci/docker/www/**
    - ci/config/nginx/**
    - ci/scripts/**
    - pnpm-lock.yaml
    - .gitea/scripts/**
    - .gitea/actions/**
  workflow_dispatch: null
concurrency:
  group: ci-www-${{ github.ref_name }}
  cancel-in-progress: true
permissions:
  contents: read
  actions: read
jobs:
  setup-stage:
    name: Setup - Stage
    runs-on: apex-debian13
    outputs: {}
    steps:
    - name: Checkout repository
      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Install pnpm
      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac

        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"

        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
      env:
        PNPM_VERSION: 9.12.3
    - name: Setup Node.js with pnpm cache
      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
        \ >> \"$GITHUB_PATH\""
      env:
        NODE_VERSION: '20'
    - name: Restore repository dependency cache
      id: dependency-cache
      run: python3 .gitea/scripts/cache.py restore
      env:
        CACHE_TOKEN: ${{ github.token }}
    - name: Install dependencies
      run: pnpm install --frozen-lockfile
    - name: Pack dependency cache
      run: python3 .gitea/scripts/cache.py pack
    - uses: ./.gitea/actions/upload-artifact
      with:
        name: ${{ steps.dependency-cache.outputs.key }}
        path: .ci/pnpm-store.tar
        retention-days: 7
  build-configs:
    name: Build - Configs
    needs: setup-stage
    runs-on: apex-debian13
    steps:
    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Install pnpm
      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac

        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"

        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
      env:
        PNPM_VERSION: 9.12.3
    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
        \ >> \"$GITHUB_PATH\""
      env:
        NODE_VERSION: '20'
    - name: Restore repository dependency cache
      id: dependency-cache
      run: python3 .gitea/scripts/cache.py restore
      env:
        CACHE_TOKEN: ${{ github.token }}
    - name: Install dependencies
      run: pnpm install --frozen-lockfile
    - name: Build Rsbuild config
      run: pnpm --filter @ermnvldmr/rsbuild-config build
    - name: Build Storybook config
      run: pnpm --filter @ermnvldmr/storybook-config build
    - name: Upload Rsbuild Config
      uses: ./.gitea/actions/upload-artifact
      with:
        name: rsbuild-config-dist
        path: packages/rsbuild-config/dist
        retention-days: 30
    - name: Upload Storybook Config
      uses: ./.gitea/actions/upload-artifact
      with:
        name: storybook-config-dist
        path: packages/storybook-config/dist
        retention-days: 30
    - name: Build i18n package
      run: pnpm --filter @ermnvldmr/i18n build
    - name: Upload i18n dist
      uses: ./.gitea/actions/upload-artifact
      with:
        name: i18n-dist
        path: packages/i18n/dist
        retention-days: 30
  lint-www:
    name: Lint - WWW
    needs: build-configs
    runs-on: apex-debian13
    steps:
    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Install pnpm
      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac

        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"

        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
      env:
        PNPM_VERSION: 9.12.3
    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
        \ >> \"$GITHUB_PATH\""
      env:
        NODE_VERSION: '20'
    - name: Restore repository dependency cache
      id: dependency-cache
      run: python3 .gitea/scripts/cache.py restore
      env:
        CACHE_TOKEN: ${{ github.token }}
    - name: Install dependencies
      run: pnpm install --frozen-lockfile
    - name: Download Rsbuild Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: rsbuild-config-dist
        path: packages/rsbuild-config/dist
    - name: Download i18n dist
      uses: ./.gitea/actions/download-artifact
      with:
        name: i18n-dist
        path: packages/i18n/dist
    - name: Download Storybook Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: storybook-config-dist
        path: packages/storybook-config/dist
    - name: Lint WWW service
      run: pnpm --filter @ermnvldmr/www lint
  typecheck-www:
    name: Typecheck - WWW
    needs: build-configs
    runs-on: apex-debian13
    steps:
    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Install pnpm
      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac

        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"

        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
      env:
        PNPM_VERSION: 9.12.3
    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
        \ >> \"$GITHUB_PATH\""
      env:
        NODE_VERSION: '20'
    - name: Restore repository dependency cache
      id: dependency-cache
      run: python3 .gitea/scripts/cache.py restore
      env:
        CACHE_TOKEN: ${{ github.token }}
    - name: Install dependencies
      run: pnpm install --frozen-lockfile
    - name: Download Rsbuild Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: rsbuild-config-dist
        path: packages/rsbuild-config/dist
    - name: Download i18n dist
      uses: ./.gitea/actions/download-artifact
      with:
        name: i18n-dist
        path: packages/i18n/dist
    - name: Download Storybook Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: storybook-config-dist
        path: packages/storybook-config/dist
    - name: Typecheck WWW service
      run: pnpm --filter @ermnvldmr/www typecheck
  build-storybook:
    name: Build - Storybook
    needs: build-configs
    runs-on: apex-debian13
    steps:
    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Install pnpm
      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac

        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"

        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
      env:
        PNPM_VERSION: 9.12.3
    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
        \ >> \"$GITHUB_PATH\""
      env:
        NODE_VERSION: '20'
    - name: Restore repository dependency cache
      id: dependency-cache
      run: python3 .gitea/scripts/cache.py restore
      env:
        CACHE_TOKEN: ${{ github.token }}
    - name: Install dependencies
      run: pnpm install --frozen-lockfile
    - name: Download Rsbuild Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: rsbuild-config-dist
        path: packages/rsbuild-config/dist
    - name: Download i18n dist
      uses: ./.gitea/actions/download-artifact
      with:
        name: i18n-dist
        path: packages/i18n/dist
    - name: Download Storybook Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: storybook-config-dist
        path: packages/storybook-config/dist
    - name: Build WWW Storybook
      run: pnpm --filter @ermnvldmr/www build-storybook
    - name: Upload Storybook build
      uses: ./.gitea/actions/upload-artifact
      with:
        name: storybook-static
        path: services/www/storybook-static/
        retention-days: 30
  test-www:
    name: Test - Unit
    needs: build-configs
    runs-on: apex-debian13
    steps:
    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Install pnpm
      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac

        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"

        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
      env:
        PNPM_VERSION: 9.12.3
    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
        \ >> \"$GITHUB_PATH\""
      env:
        NODE_VERSION: '20'
    - name: Restore repository dependency cache
      id: dependency-cache
      run: python3 .gitea/scripts/cache.py restore
      env:
        CACHE_TOKEN: ${{ github.token }}
    - name: Install dependencies
      run: pnpm install --frozen-lockfile
    - name: Download Rsbuild Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: rsbuild-config-dist
        path: packages/rsbuild-config/dist
    - name: Download i18n dist
      uses: ./.gitea/actions/download-artifact
      with:
        name: i18n-dist
        path: packages/i18n/dist
    - name: Download Storybook Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: storybook-config-dist
        path: packages/storybook-config/dist
    - name: Test WWW service
      run: pnpm --filter @ermnvldmr/www test:coverage
  test-storybook:
    name: Test - Storybook
    needs: build-storybook
    runs-on: apex-debian13
    steps:
    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Install pnpm
      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac

        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"

        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
      env:
        PNPM_VERSION: 9.12.3
    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
        \ >> \"$GITHUB_PATH\""
      env:
        NODE_VERSION: '20'
    - name: Restore repository dependency cache
      id: dependency-cache
      run: python3 .gitea/scripts/cache.py restore
      env:
        CACHE_TOKEN: ${{ github.token }}
    - name: Install dependencies
      run: pnpm install --frozen-lockfile
    - name: Download Rsbuild Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: rsbuild-config-dist
        path: packages/rsbuild-config/dist
    - name: Download i18n dist
      uses: ./.gitea/actions/download-artifact
      with:
        name: i18n-dist
        path: packages/i18n/dist
    - name: Download Storybook Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: storybook-config-dist
        path: packages/storybook-config/dist
    - name: Install Playwright browsers
      run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
    - name: Download Storybook build
      uses: ./.gitea/actions/download-artifact
      with:
        name: storybook-static
        path: services/www/storybook-static/
    - name: Serve Storybook and run tests with coverage
      run: pnpm --filter @ermnvldmr/www test:storybook:ci
  build-www:
    name: Build - WWW Service
    needs: build-configs
    runs-on: apex-debian13
    steps:
    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Install pnpm
      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac

        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"

        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
      env:
        PNPM_VERSION: 9.12.3
    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
        \ >> \"$GITHUB_PATH\""
      env:
        NODE_VERSION: '20'
    - name: Restore repository dependency cache
      id: dependency-cache
      run: python3 .gitea/scripts/cache.py restore
      env:
        CACHE_TOKEN: ${{ github.token }}
    - name: Install dependencies
      run: pnpm install --frozen-lockfile
    - name: Download Rsbuild Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: rsbuild-config-dist
        path: packages/rsbuild-config/dist
    - name: Download i18n dist
      uses: ./.gitea/actions/download-artifact
      with:
        name: i18n-dist
        path: packages/i18n/dist
    - name: Download Storybook Config
      uses: ./.gitea/actions/download-artifact
      with:
        name: storybook-config-dist
        path: packages/storybook-config/dist
    - name: Build WWW service (all locales)
      run: pnpm --filter @ermnvldmr/www build:all
      env:
        RSDOCTOR: 'true'
    - name: Upload Rsdoctor report
      uses: ./.gitea/actions/upload-artifact
      with:
        name: rsdoctor-report
        path: services/www/rsdoctor/
        retention-days: 30
  build-docker:
    name: Build - Docker Image
    needs:
    - lint-www
    - typecheck-www
    - test-www
    - test-storybook
    - build-www
    runs-on: apex-debian13
    permissions:
      contents: read
      packages: write
    outputs:
      short_sha: ${{ steps.vars.outputs.short_sha }}
    steps:
    - name: Checkout repository
      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Calculate Short SHA
      id: vars
      run: 'SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"

        echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT

        '
    - name: Log in to GitHub Container Registry
      run: python3 .gitea/scripts/docker.py login
      env:
        REGISTRY: git.ermnvldmr.com
        REGISTRY_USER: ${{ github.repository_owner }}
        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
    - name: Set up Docker Buildx
      run: 'docker buildx version

        docker buildx create --name apex-ci --driver docker-container --use

        docker buildx inspect --bootstrap'
    - name: Build and push Docker image
      run: python3 .gitea/scripts/docker.py build
      env:
        TAGS: git.ermnvldmr.com/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha
          }}
        LABELS: ''
        BUILD_ARGS: 'COMMIT_SHA=${{ steps.vars.outputs.short_sha }}

          VERSION=${{ steps.vars.outputs.short_sha }}

          '
        DOCKERFILE: ci/docker/www/Dockerfile
        PLATFORMS: ''
        PUSH: 'true'
        CONTEXT: .
        SOURCE_SHA: ${{ github.sha }}
        RUN_ID: ${{ github.run_id }}
      id: image
    - name: Record tested digest provenance
      env:
        IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
      run: 'mkdir -p .ci

        python3 - <<''PROVENANCE''

        import json, os

        from pathlib import Path

        Path(''.ci/www-provenance.json'').write_text(json.dumps({''sha'': os.environ[''GITHUB_SHA''],
        ''digest'': os.environ[''IMAGE_DIGEST''], ''run_id'': os.environ[''GITHUB_RUN_ID''],
        ''repository'': os.environ[''GITHUB_REPOSITORY'']}))

        PROVENANCE'
    - uses: ./.gitea/actions/upload-artifact
      with:
        name: www-provenance
        path: .ci/www-provenance.json
        retention-days: 30