packages_publishing.yml

name: Publishing to GitHub Packages

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Choose a tag: 'daily' when publishing a daily build with a timestamp version, 'stable' when publishing a stable build from a release branch"
        type: choice
        options:
          - daily
          - stable
        default: 'daily'
        required: false
      filter:
        type: string
        description: Package file filter pattern
        required: false

env:
  NX_SKIP_NX_CACHE: true
  FILTER: ${{ github.event_name == 'workflow_dispatch' && inputs.filter || '' }}
  SET_TIMESTAMP_VERSION:  ${{ inputs.tag == 'daily' }}
  SBOM_PACKAGE_NAMES: devextreme,devextreme-angular,devextreme-react,devextreme-vue,devextreme-themebuilder
  CYCLONEDX_CLI_VERSION: 0.32.0
  CYCLONEDX_CLI_LINUX_X64_SHA256: 454879e6a4a405c8a13bff49b8982adcb0596f3019b26b0811c66e4d7f0783e1

jobs:
  build:
    name: Build packages
    runs-on: ubuntu-latest
    outputs:
      packages: ${{ steps.filter.outputs.packages }}
    steps:
      - name: Get sources
        uses: actions/checkout@v6

      - name: Set up nodejs
        uses: actions/setup-node@v6
        with:
          node-version-file: '.node-version'

      - uses: pnpm/action-setup@v6
        with:
          run_install: false

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Set timestamp version
        if: ${{ env.SET_TIMESTAMP_VERSION == 'true' }}
        run: pnpm run all:set-timestamp-version

      - name: Build npm packages
        env:
          BUILD_INTERNAL_PACKAGE: true
        run: pnpm run all:build

      - name: Prepare SBOM package inputs
        shell: bash
        run: |
          package_version=$(node -p "require('./package.json').version")
          IFS=',' read -ra package_names <<< "$SBOM_PACKAGE_NAMES"
          sbom_packages=()

          for package_name in "${package_names[@]}"; do
            tgz_path="artifacts/npm/$package_name-$package_version.tgz"

            if [ ! -f "$tgz_path" ]; then
              echo "Expected package tarball not found: $tgz_path"
              exit 1
            fi

            sbom_packages+=("$package_name(../../$tgz_path)")
          done

          sbom_packages_value=$(IFS=,; echo "${sbom_packages[*]}")
          echo "SBOM_PACKAGES=$sbom_packages_value" >> "$GITHUB_ENV"
          echo "$sbom_packages_value"

      - name: Build SBOMs
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN";
          pnpm nx built-hashes sbom;

      - name: Install CycloneDX CLI
        shell: bash
        run: |
          tool_dir="$RUNNER_TEMP/cyclonedx-cli"
          mkdir -p "$tool_dir"
          curl -fsSL "https://github.com/CycloneDX/cyclonedx-cli/releases/download/v${{ env.CYCLONEDX_CLI_VERSION }}/cyclonedx-linux-x64" -o "$tool_dir/cyclonedx"
          echo "${{ env.CYCLONEDX_CLI_LINUX_X64_SHA256 }}  $tool_dir/cyclonedx" | sha256sum -c -
          chmod +x "$tool_dir/cyclonedx"
          echo "$tool_dir" >> "$GITHUB_PATH"

      - name: Validate SBOMs
        shell: bash
        run: |
          shopt -s nullglob
          sbom_files=(packages/sbom/dist/*.cdx.json)

          if [ ${#sbom_files[@]} -eq 0 ]; then
            echo "No SBOM files found in packages/sbom/dist"
            exit 1
          fi

          for file in "${sbom_files[@]}"; do
            echo "Validating $file"
            cyclonedx validate --input-file "$file" --input-format json --fail-on-errors
          done

      - name: Build artifacts package
        run: pnpm run make-artifacts-package

      - name: Upload SBOMs
        uses: actions/upload-artifact@v7
        with:
          name: sbom-packages
          path: packages/sbom/dist
          retention-days: 7

      - name: Upload packages
        uses: actions/upload-artifact@v7
        with:
          name: npm-packages
          path: artifacts/npm/*.tgz
          retention-days: 2

      - name: Filter packages
        id: filter
        working-directory: artifacts/npm
        shell: bash
        run: ls *.tgz | grep -E -i "$FILTER" | sed -r 's/^(.*).tgz$/"\1"/g' | paste -sd "," - | sed -r 's/(.*)/packages=[\1]/' >> "$GITHUB_OUTPUT"

  publish:
    name: Publish package
    runs-on: ubuntu-latest
    needs: build
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJSON(needs.build.outputs.packages) }}
    steps:
      - name: Get sources
        uses: actions/checkout@v6

      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          name: npm-packages
          path: npm-packages

      - name: Download SBOMs
        uses: actions/download-artifact@v8
        with:
          name: sbom-packages
          path: sbom-packages

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: '.node-version'

      - uses: pnpm/action-setup@v6
        with:
          run_install: false

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Change package scope
        id: scopedPackage
        env:
          PACKAGE: ${{ matrix.package }}
        run: |
          SCOPE=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]');
          PACKAGE_DIR=$(pnpm --silent run change-package-scope --tgz npm-packages/$PACKAGE.tgz --scope $SCOPE)
          echo "packageDir=$PACKAGE_DIR" >> "$GITHUB_OUTPUT";
          cd $PACKAGE_DIR;
          pnpm pkg get name | tr -d '"' | sed -r 's/(.*)/name=\1/' >> "$GITHUB_OUTPUT";
          pnpm pkg get version | tr -d '"' | sed -r 's/(.*)/version=\1/' >> "$GITHUB_OUTPUT";
          pnpm pkg get version | tr -d '"' | sed -r 's/([0-9]+\.[0-9]+).*/majorVersion=\1/' >> "$GITHUB_OUTPUT";

      - name: Build SBOM package
        id: scopedSbomPackage
        env:
          PACKAGE_NAME: ${{ steps.scopedPackage.outputs.name }}
          PACKAGE_VERSION: ${{ steps.scopedPackage.outputs.version }}
        run: |
          UNSCOPED_PACKAGE_NAME=$(echo "$PACKAGE_NAME" | sed -r 's#^@[^/]+/##');
          SBOM_FILE="sbom-packages/$UNSCOPED_PACKAGE_NAME.cdx.json";

          if [[ ",$SBOM_PACKAGE_NAMES," != *",$UNSCOPED_PACKAGE_NAME,"* ]]; then
            echo "SBOM publishing is not configured for $UNSCOPED_PACKAGE_NAME"
            echo "hasSbom=false" >> "$GITHUB_OUTPUT";
            exit 0;
          fi

          if [ ! -f "$SBOM_FILE" ]; then
            echo "No SBOM found for $UNSCOPED_PACKAGE_NAME"
            echo "hasSbom=false" >> "$GITHUB_OUTPUT";
            exit 0;
          fi

          SCOPE=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]');
          SBOM_PACKAGE_NAME="$UNSCOPED_PACKAGE_NAME-sbom";
          SBOM_PACKAGE_DIR="sbom-package/$SBOM_PACKAGE_NAME";
          SBOM_TGZ_DIR="sbom-package-tgz";
          PACKAGE_LICENSE=$(node -p "require('./package.json').license");
          PACKAGE_AUTHOR=$(node -p "require('./package.json').author");

          mkdir -p "$SBOM_PACKAGE_DIR" "$SBOM_TGZ_DIR";
          cp "$SBOM_FILE" "$SBOM_PACKAGE_DIR/";
          cd "$SBOM_PACKAGE_DIR";
          node -e "const fs = require('fs'); const [name, version, license, author] = process.argv.slice(1); fs.writeFileSync('package.json', JSON.stringify({ name, version, license, author }, null, 2));" "$SBOM_PACKAGE_NAME" "$PACKAGE_VERSION" "$PACKAGE_LICENSE" "$PACKAGE_AUTHOR";
          npm pack --pack-destination "../../$SBOM_TGZ_DIR";
          cd ../..;

          SCOPED_SBOM_PACKAGE_DIR=$(pnpm --silent run change-package-scope --tgz "$SBOM_TGZ_DIR/$SBOM_PACKAGE_NAME-$PACKAGE_VERSION.tgz" --scope "$SCOPE");
          echo "hasSbom=true" >> "$GITHUB_OUTPUT";
          echo "packageDir=$SCOPED_SBOM_PACKAGE_DIR" >> "$GITHUB_OUTPUT";
          cd "$SCOPED_SBOM_PACKAGE_DIR";
          pnpm pkg get name | tr -d '"' | sed -r 's/(.*)/name=\1/' >> "$GITHUB_OUTPUT";
          pnpm pkg get version | tr -d '"' | sed -r 's/(.*)/version=\1/' >> "$GITHUB_OUTPUT";
          pnpm pkg get version | tr -d '"' | sed -r 's/([0-9]+\.[0-9]+).*/majorVersion=\1/' >> "$GITHUB_OUTPUT";

        # --ignore-scripts is required for publishing devextreme-angular which fails with error:
        # 'Trying to publish a package that has been compiled by Ivy in full compilation mode.'
        # Should be removed.
      - name: Publish to npm.pkg.github.com
        working-directory: ${{ steps.scopedPackage.outputs.packageDir }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PACKAGE_NAME: ${{ steps.scopedPackage.outputs.name }}
          PACKAGE_VERSION: ${{ steps.scopedPackage.outputs.version }}
          PACKAGE_VERSION_MAJOR: ${{ steps.scopedPackage.outputs.majorVersion }}
        run: |
          pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN";
          pnpm publish --no-git-checks --quiet --ignore-scripts --tag $PACKAGE_VERSION_MAJOR-${{ inputs.tag }} --registry https://npm.pkg.github.com;
          pnpm dist-tag add $PACKAGE_NAME@$PACKAGE_VERSION latest --registry=https://npm.pkg.github.com;

        # --ignore-scripts - like above, should be removed, check if could be removed everywhere
      - name: Publish SBOM to npm.pkg.github.com
        if: ${{ steps.scopedSbomPackage.outputs.hasSbom == 'true' }}
        working-directory: ${{ steps.scopedSbomPackage.outputs.packageDir }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PACKAGE_NAME: ${{ steps.scopedSbomPackage.outputs.name }}
          PACKAGE_VERSION: ${{ steps.scopedSbomPackage.outputs.version }}
          PACKAGE_VERSION_MAJOR: ${{ steps.scopedSbomPackage.outputs.majorVersion }}
        run: |
          pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN";
          pnpm publish --no-git-checks --quiet --ignore-scripts --tag $PACKAGE_VERSION_MAJOR-${{ inputs.tag }} --registry https://npm.pkg.github.com;
          pnpm dist-tag add $PACKAGE_NAME@$PACKAGE_VERSION latest --registry=https://npm.pkg.github.com;

  notify:
    runs-on: devextreme-shr2
    name: Send notifications
    needs: [ build, publish ]
    if: failure()

    steps:
      - uses: actions/checkout@v6
      - uses: DevExpress/github-actions/send-teams-notification@v1
        with:
          hook_url: ${{secrets.TEAMS_ALERT}}
          bearer_token: ${{secrets.GITHUB_TOKEN}}
          specific_repo: DevExpress/DevExtreme