securebuild/.github/workflows/build.yml at ce498b14e58589aa4e70053826a20012c817e0fe · securebuildhq/securebuild · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: Build

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  # Determine which build jobs need to run based on changed files
  check-changes:
    runs-on: ubuntu-latest
    outputs:
      run-app: ${{ steps.check.outputs.run-app }}
      run-api: ${{ steps.check.outputs.run-api }}
      run-go: ${{ steps.check.outputs.run-go }}
      run-all: ${{ steps.check.outputs.run-all }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Check for changes
        id: check
        uses: ./.github/actions/check-changes

  securebuild-app-build:
    needs: check-changes
    if: needs.check-changes.outputs.run-app == 'true'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Node.js
      uses: actions/setup-node@v7
      with:
        node-version: '24'

    - name: Cache Node.js modules
      uses: actions/cache@v6
      with:
        path: |
          ~/.npm
          securebuild-app/node_modules
          securebuild-app/.next/cache
        key: ${{ runner.os }}-node-app-${{ hashFiles('securebuild-app/package-lock.json') }}
        restore-keys: |
          ${{ runner.os }}-node-app-

    - name: Install Node.js dependencies
      uses: ./.github/actions/install-npm-dependencies
      with:
        working-directory: securebuild-app

    - name: Build
      run: |
        cd securebuild-app
        npm run build
      env:
        CI: true

  securebuild-api-build:
    needs: check-changes
    if: needs.check-changes.outputs.run-api == 'true'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Node.js
      uses: actions/setup-node@v7
      with:
        node-version: '24'

    - name: Cache Node.js modules
      uses: actions/cache@v6
      with:
        path: |
          ~/.npm
          securebuild-api/node_modules
          securebuild-api/.next/cache
        key: ${{ runner.os }}-node-api-${{ hashFiles('securebuild-api/package-lock.json') }}
        restore-keys: |
          ${{ runner.os }}-node-api-

    - name: Install Node.js dependencies
      uses: ./.github/actions/install-npm-dependencies
      with:
        working-directory: securebuild-api

    - name: Build
      run: |
        cd securebuild-api
        npm run build
      env:
        CI: true

  worker-build:
    needs: check-changes
    if: needs.check-changes.outputs.run-go == 'true' || needs.check-changes.outputs.run-all == 'true'
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Go
      uses: actions/setup-go@v7
      with:
        go-version-file: 'go.mod'
        cache: false

    - name: Restore Go cache
      uses: actions/cache/restore@v6
      id: go-cache
      with:
        path: |
          ~/.cache/go-build
          ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-

    - name: Download Go modules
      run: go mod download

    - name: Build worker binary
      run: make build-worker

    - name: Save Go cache
      uses: actions/cache/save@v6
      if: steps.go-cache.outputs.cache-hit != 'true'
      with:
        path: |
          ~/.cache/go-build
          ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}