javascript-build.yml

name: JavaScript Build

concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

on:
    workflow_dispatch:
        inputs:
            logLevel:
                description: 'Log level'
                required: true
                default: 'warning'
                type: choice
                options:
                    - info
                    - warning
                    - debug
    push:
        branches:
            - 'main'
        paths:
            - 'Source/**'
            - 'Migrator/**'
            - 'ESLint/**'
            - 'Conformance/**'
            - 'Adapters/**'
            - 'Storybook/**'
            - 'scripts/**'
            - 'compat-manifest.json'
            - 'README.md'
            - 'release.md'
            - 'run-task-on-workspaces.js'
            - 'package.json'
            - 'rollup.config.mjs'
            - 'yarn.lock'
            - '.yarnrc.yml'
            - '.yarn/releases/yarn-4.17.1.cjs'
            - '.github/workflows/javascript-build.yml'
            - '.github/workflows/publish.yml'
    pull_request:
        branches:
            - '**'
        paths:
            - 'Source/**'
            - 'Migrator/**'
            - 'ESLint/**'
            - 'Conformance/**'
            - 'Adapters/**'
            - 'Storybook/**'
            - 'scripts/**'
            - 'compat-manifest.json'
            - 'README.md'
            - 'release.md'
            - 'run-task-on-workspaces.js'
            - 'package.json'
            - 'rollup.config.mjs'
            - 'yarn.lock'
            - '.yarnrc.yml'
            - '.yarn/releases/yarn-4.17.1.cjs'
            - '.github/workflows/javascript-build.yml'
            - '.github/workflows/publish.yml'

permissions:
    contents: read

jobs:
    # Cratis/Components#303: the ten-workspace `yarn ci` pipeline used to run as one serial
    # step (~12.7 min), followed by the Storybook axe matrix as a later step in the same job
    # (~6 min more). Sharded below into four independent jobs so wall clock falls to roughly
    # the longest shard instead of their sum. Every command that used to run in `build` still
    # runs; only which job runs it changed. `source`, `tooling`, and `storybook` each build
    # `@cratis/components` (and, for `tooling`/`storybook`, the adapters) themselves before the
    # checks that need the packed/dist output - that mirrors what `run-task-on-workspaces.js ci`
    # already did per workspace, and what every other job in this file already does in its own
    # "Build the published artifact" step; sharding does not add new duplicate work, it just lets
    # the existing duplication happen in parallel instead of in sequence.
    source:
        runs-on: ubuntu-latest
        timeout-minutes: 20

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build JS/TS (Source)
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn workspace @cratis/components run ci

            # Source's ci script also checks public API TSDoc, the packed CSS budgets, and that the
            # built declarations match the committed api-surface.json snapshot.

            # Informational: which exports this change removes, changes, or adds compared with the
            # latest published release. Release intent stays with the semver label and the reviewer.
            - name: Report public API changes against the latest release
              run: yarn workspace @cratis/components run report-api-compatibility

    # Matrix over the renderer-adapter workspaces that today run one after another inside
    # `run-task-on-workspaces.js ci`: Conformance, MUI, PrimeReact 11, PrimeReact 10. In that
    # serial pipeline `@cratis/components` (Source) always ran first, so every adapter's `ci`
    # resolved the package's `exports` map (which points at `Source/dist`, not `src`) against
    # an already-built package. Only Conformance's own `ci` rebuilds Source itself
    # (`prepare-core`, ahead of its `build`); MUI's and both PrimeReact legs' `ci` run `build`
    # before their `typecheck-specs` step's own `prepare-core`, so on an isolated matrix runner
    # with no prior Source build they fail resolving `@cratis/components/*` subpaths (TS2307).
    # Each leg here now builds Source first itself, mirroring the already-working
    # `verify-renderer-adapters` job's `prepareCore()` (`yarn prepare` in Source before any
    # adapter work) rather than depending on per-workspace `ci` script ordering. This means
    # Source is rebuilt redundantly by all four legs in parallel (already fully redundant with
    # Conformance's own internal `prepare-core`) instead of once - a deliberate, bounded cost
    # matrix isolation requires, not a new build step design.
    adapters:
        name: Workspace checks (${{ matrix.name }})
        runs-on: ubuntu-latest
        timeout-minutes: 20
        strategy:
            fail-fast: false
            matrix:
                include:
                    - name: conformance
                      workspace: '@cratis/components.conformance'
                    - name: mui
                      workspace: '@cratis/components.mui'
                    - name: primereact11
                      workspace: '@cratis/components.primereact'
                    - name: primereact10
                      workspace: '@cratis/components.primereact10'

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build Source
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn workspace @cratis/components run prepare

            - name: Build, lint, and test ${{ matrix.name }}
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn workspace ${{ matrix.workspace }} run ci

            - name: Verify packed renderer conformance package
              if: matrix.name == 'conformance'
              working-directory: Conformance
              run: yarn verify-package

    # Root-level policy/tooling/evidence self-tests, the ESLint and Migrator workspace
    # pipelines, and the packed-consumer verification under TypeScript 6 and 7
    # (`verify-typescript-consumers`). The last of these needs the packed/dist output of
    # `@cratis/components`, Conformance, and all three adapters, so this job builds them
    # itself first - the `build` script only (no lint/test/clean), which is materially
    # cheaper than the full `ci` pipelines the `source` and `adapters` jobs already run.
    tooling:
        runs-on: ubuntu-latest
        timeout-minutes: 25

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Root tooling, policy, and workspace checks
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn test-tooling
                  yarn verify-compat-manifest
                  yarn test-release-policy
                  yarn test-release-evidence
                  yarn test-renderer-adapter-matrix
                  yarn workspace @cratis/eslint-plugin-components run ci
                  yarn workspace @cratis/components.migrator run ci
                  yarn workspace @cratis/components.conformance run build
                  yarn workspace @cratis/components.mui run build
                  yarn workspace @cratis/components.primereact run build
                  yarn workspace @cratis/components.primereact10 run build
                  yarn verify-typescript-consumers

            - name: Verify root-import codemod
              working-directory: Migrator
              run: |
                  yarn test
                  yarn verify-package

            - name: Verify packed ESLint plugin
              working-directory: ESLint
              run: yarn verify-package

    # The Storybook workspace is `private`, so `run-task-on-workspaces.js ci` always skipped
    # it; its checks ran as their own steps at the end of the old `build` job instead, after
    # that job's single step had already built `@cratis/components` and every adapter. This
    # job rebuilds those same packages itself (build only, matching the `tooling` job) so the
    # composed Storybook and its axe matrix - unchanged, still the long pole here - have the
    # packed output they import.
    storybook:
        runs-on: ubuntu-latest
        timeout-minutes: 25

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build packages the composed Storybook imports
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn workspace @cratis/components.conformance run build
                  yarn workspace @cratis/components.mui run build
                  yarn workspace @cratis/components.primereact run build
                  yarn workspace @cratis/components.primereact10 run build

            - name: Verify renderer Storybook type, inventory, specs, and peer isolation
              working-directory: Storybook
              run: yarn ci:preflight

            - name: Build composed renderer Storybook
              run: yarn workspace @cratis/components build-storybook

            - name: Verify every renderer Storybook index and build attestation
              working-directory: Source
              run: yarn verify-storybook-index

            - name: Install Storybook browser
              run: yarn playwright install --with-deps chromium

            - name: Test every Storybook story
              working-directory: Source
              run: yarn test-storybook

    # Aggregates the four shards above into the single check this repository's branch
    # protection historically pointed at (`build`). No branch protection rule or ruleset
    # exists on `main` as of this change (checked via the GitHub API), so nothing currently
    # requires this job - it is added defensively so that if/when branch protection is
    # configured to require one `javascript-build.yml` check, `build` keeps meaning "every
    # shard passed" rather than needing four rules kept in sync by hand.
    build:
        name: Build
        runs-on: ubuntu-latest
        needs: [source, adapters, tooling, storybook]
        if: always()
        steps:
            - name: Require every shard to have succeeded
              run: |
                  if [ "${{ contains(needs.*.result, 'failure') }}" = "true" ] || [ "${{ contains(needs.*.result, 'cancelled') }}" = "true" ]; then
                    echo "One or more JavaScript Build shards did not succeed:" >&2
                    echo '${{ toJSON(needs) }}' >&2
                    exit 1
                  fi

    # Builds and retains exact archives and SBOM evidence. This job is read-only; publication
    # authority remains isolated to the Publish workflow's OIDC-enabled npm job.
    release-evidence:
        runs-on: ubuntu-latest
        timeout-minutes: 20
        permissions:
            contents: read

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Test release-evidence generator
              run: yarn test-release-evidence

            - name: Generate release evidence
              run: >-
                  yarn generate-release-evidence
                  --output "${{ runner.temp }}/components-v4-release-evidence"

            - name: Upload release evidence
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
              with:
                  name: components-v4-release-evidence-${{ github.sha }}
                  path: |
                      ${{ runner.temp }}/components-v4-release-evidence/*.tgz
                      ${{ runner.temp }}/components-v4-release-evidence/SHA256SUMS
                      ${{ runner.temp }}/components-v4-release-evidence/SHA512SUMS
                      ${{ runner.temp }}/components-v4-release-evidence/*.cdx.json
                      ${{ runner.temp }}/components-v4-release-evidence/release-evidence.json
                  if-no-files-found: error
                  retention-days: 30

    # Builds the artifact that actually ships to npm (the `prepare` script: tsc -b +
    # rollup + copy-css) and loads every subpath of the `exports` map from it.
    #
    # The `build` job above only runs `tsc -p tsconfig.json`, so nothing in CI had ever
    # imported the published shape. That gap is how Cratis/Components#118 - the published
    # ESM contains directory imports, so no node-environment spec can render Dialog or
    # CommandDialog - reached a release unnoticed.
    #
    # This job landed deliberately non-blocking, because it reproduced #118 and both of
    # that issue's causes were still open: the bare `primereact/*` directory imports
    # (fixed by the PrimeReact 11 migration) and the CSS side-effect imports rollup
    # externalised via /\.css$/ (fixed by moving component CSS out of the JavaScript
    # graph and into the `./styles` entry point). Both are resolved as of 3.0.0; all 25
    # subpaths load cleanly - so `continue-on-error` is gone and this is now a real gate.
    verify-published-exports:
        runs-on: ubuntu-latest
        timeout-minutes: 10

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build the published artifact
              working-directory: Source
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn run prepare

            - name: Verify packed production tree shaking
              working-directory: Source
              run: yarn verify-packed-production

            - name: Verify published exports
              working-directory: Source
              run: node scripts/verify-exports.mjs

    # Verifies every public JS subpath's declarations against strict external TypeScript 6 and 7
    # consumer of the packed artifact. Bounded upstream exceptions live in
    # Source/scripts/verify-public-types.exceptions.json; any Components-owned or otherwise
    # unlisted diagnostic fails this job, as does an exception that stops reproducing.
    verify-public-types:
        runs-on: ubuntu-latest
        timeout-minutes: 15
        strategy:
            fail-fast: false
            matrix:
                typescript: ['6', '7']

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build the published artifact
              working-directory: Source
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn run prepare

            - name: Verify public types
              working-directory: Source
              env:
                  CRATIS_TYPESCRIPT_VERSION: ${{ matrix.typescript }}
              run: node scripts/verify-public-types.mjs --report "${{ runner.temp }}/verify-public-types-report.json"

            - name: Upload verify-public-types report
              if: always()
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
              with:
                  name: verify-public-types-report-ts${{ matrix.typescript }}
                  path: ${{ runner.temp }}/verify-public-types-report.json
                  if-no-files-found: ignore

    # Deterministic dependency-closure check for the setup-only root architecture: every
    # non-spatial subpath (everything except ./Canvas and ./PivotViewer) must never reach
    # a file under Canvas/ or PivotViewer/, nor the external specifier pixi.js, in either
    # its runtime or declaration closure; ./Canvas and ./PivotViewer must still reach
    # pixi.js; and pixi.js must never be imported directly by any emitted file outside
    # those two directories, regardless of exports-map reachability.
    verify-package-graph:
        runs-on: ubuntu-latest
        timeout-minutes: 10

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build the published artifact
              working-directory: Source
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn run prepare

            - name: Verify package graph
              working-directory: Source
              run: node scripts/verify-package-graph.mjs --report "${{ runner.temp }}/verify-package-graph-report.json"

            - name: Upload verify-package-graph report
              if: always()
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
              with:
                  name: verify-package-graph-report
                  path: ${{ runner.temp }}/verify-package-graph-report.json
                  if-no-files-found: ignore

    # Proves a consumer who installs only the mandatory peers - never pixi.js - can fully
    # use the package root and every non-spatial subpath: runtime import, strict Bundler
    # and NodeNext TypeScript for the root with pixi.js genuinely absent from
    # node_modules, an SSR provider smoke test, and a clean packed root closure.
    verify-no-pixi-consumer:
        runs-on: ubuntu-latest
        timeout-minutes: 15

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build the published artifact
              working-directory: Source
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn run prepare

            - name: Verify no-Pixi consumer
              working-directory: Source
              run: node scripts/verify-no-pixi-consumer.mjs

    # Complements verify-no-pixi-consumer: proves a consumer who installs the mandatory
    # peers and the optional pixi.js peer can use the spatial subpaths (./Canvas,
    # ./PivotViewer), that pixi.js resolves to exactly one instance with no nested copy,
    # and that ./Canvas type-checks with pixi.js installed.
    verify-spatial-consumer:
        runs-on: ubuntu-latest
        timeout-minutes: 15

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build the published artifact
              working-directory: Source
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn run prepare

            - name: Verify spatial consumer
              working-directory: Source
              run: node scripts/verify-spatial-consumer.mjs

    # Proves the shared CratisComponentsContext (custom labels) and react-aria-components'
    # I18nProvider locale context stay one singleton across the root barrel and every
    # separately built subpath, against the packed artifact - source-level relative
    # imports would trivially share one module graph regardless of how the published
    # entry points are structured, so only the packed boundary can exercise this risk.
    verify-provider-context-identity:
        runs-on: ubuntu-latest
        timeout-minutes: 15

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              id: yarn-cache
              with:
                  path: |
                      .yarn/cache
                      **/node_modules
                      **/.eslintcache
                  key: ${{ runner.os }}-yarn-v2-${{ hashFiles('yarn.lock', '**/package.json', '.yarnrc.yml', '.yarn/releases/yarn-4.17.1.cjs') }}

            - name: Yarn install
              run: yarn install --immutable

            - name: Build the published artifact
              working-directory: Source
              run: |
                  export NODE_OPTIONS="--max-old-space-size=4096"
                  yarn run prepare

            - name: Verify provider-context identity
              working-directory: Source
              run: node scripts/verify-provider-context-identity.mjs

    verify-arc-consumers:
        runs-on: ubuntu-latest
        timeout-minutes: 15
        strategy:
            fail-fast: false
            matrix:
                arc-version: ['20.3.1', '21.19.4', '22.6.2', '22.16.0']

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - name: Yarn install
              run: yarn install --immutable

            - name: Build and pack Components
              run: |
                  yarn workspace @cratis/components prepare
                  yarn workspace @cratis/components pack --out /tmp/cratis-components.tgz
                  yarn workspace @cratis/components verify-package-archive /tmp/cratis-components.tgz

            - name: Verify Arc ${{ matrix.arc-version }} rendering consumer
              run: |
                  CONSUMER="$(mktemp -d)"
                  cd "$CONSUMER"
                  printf '{"private":true,"type":"module"}\n' > package.json
                  npm install --ignore-scripts \
                    /tmp/cratis-components.tgz \
                    "@cratis/arc@${{ matrix.arc-version }}" \
                    "@cratis/arc.react@${{ matrix.arc-version }}" \
                    @cratis/fundamentals react@19 react-dom@19 reflect-metadata
                  cp "$GITHUB_WORKSPACE/Source/scripts/lib/peer-absent-consumer-probe.mjs" verify-peers.mjs
                  node verify-peers.mjs
                  node --input-type=module - <<'NODE'
                  const commandDialog = await import('@cratis/components/CommandDialog');
                  const dataPage = await import('@cratis/components/DataPage');
                  const notifications = await import('@cratis/components/Notifications');
                  const required = {
                      CommandDialog: commandDialog.CommandDialog,
                      DataPage: dataPage.DataPage,
                      toast: notifications.toast,
                  };
                  for (const [name, value] of Object.entries(required)) {
                      if (!value) throw new Error(`Missing ${name}`);
                  }
                  for (const forbidden of ['primereact', '@primereact/core', '@primeuix/themes']) {
                      try {
                          import.meta.resolve(forbidden);
                          throw new Error(`Unexpected renderer dependency: ${forbidden}`);
                      } catch (error) {
                          if (error instanceof Error && error.message.startsWith('Unexpected')) throw error;
                      }
                  }
                  NODE

    verify-package-managers:
        runs-on: ubuntu-latest
        timeout-minutes: 20
        strategy:
            fail-fast: false
            matrix:
                include:
                    - manager: npm
                      pixi: absent
                    - manager: npm
                      pixi: present
                    - manager: pnpm
                      pixi: absent
                    - manager: pnpm
                      pixi: present
                    - manager: yarn-pnp
                      pixi: absent
                    - manager: yarn-pnp
                      pixi: present

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: 24.x
                  registry-url: 'https://registry.npmjs.org'

            - name: Enable Corepack
              run: corepack enable

            - name: Yarn install
              run: yarn install --immutable

            - name: Build and pack Components
              run: |
                  yarn workspace @cratis/components prepare
                  yarn workspace @cratis/components pack --out /tmp/cratis-components.tgz
                  yarn workspace @cratis/components verify-package-archive /tmp/cratis-components.tgz

            - name: Create consumer fixture
              run: |
                  mkdir /tmp/components-consumer
                  cat > /tmp/components-consumer/package.json <<'JSON'
                  {"private":true,"type":"module"}
                  JSON
                  cp Source/scripts/lib/package-manager-consumer-probe.mjs \
                    /tmp/components-consumer/verify.mjs
                  cp Source/scripts/lib/peer-absent-consumer-probe.mjs \
                    /tmp/components-consumer/verify-peers.mjs

            - name: Verify npm consumer
              if: matrix.manager == 'npm'
              working-directory: /tmp/components-consumer
              run: |
                  PIXI=()
                  if [ "${{ matrix.pixi }}" = 'present' ]; then PIXI+=(pixi.js@8.20.0); fi
                  npm install --ignore-scripts --no-audit --no-fund \
                    /tmp/cratis-components.tgz \
                    @cratis/arc@22.16.0 @cratis/arc.react@22.16.0 \
                    @cratis/fundamentals@7.19.2 @types/react@19.2.18 \
                    react@19.2.8 react-dom@19.2.8 reflect-metadata@0.2.2 "${PIXI[@]}"
                  node verify.mjs "${{ matrix.pixi }}"
                  node verify-peers.mjs

            - name: Verify pnpm consumer
              if: matrix.manager == 'pnpm'
              working-directory: /tmp/components-consumer
              run: |
                  corepack prepare pnpm@10.17.1 --activate
                  PIXI=()
                  if [ "${{ matrix.pixi }}" = 'present' ]; then PIXI+=(pixi.js@8.20.0); fi
                  pnpm add --ignore-scripts --strict-peer-dependencies \
                    /tmp/cratis-components.tgz \
                    @cratis/arc@22.16.0 @cratis/arc.react@22.16.0 \
                    @cratis/fundamentals@7.19.2 @types/react@19.2.18 \
                    react@19.2.8 react-dom@19.2.8 reflect-metadata@0.2.2 "${PIXI[@]}"
                  pnpm exec node verify.mjs "${{ matrix.pixi }}"
                  pnpm exec node verify-peers.mjs

            - name: Verify Yarn PnP consumer
              if: matrix.manager == 'yarn-pnp'
              working-directory: /tmp/components-consumer
              run: |
                  corepack prepare yarn@4.5.3 --activate
                  cat > .yarnrc.yml <<'YAML'
                  nodeLinker: pnp
                  YAML
                  PIXI=()
                  if [ "${{ matrix.pixi }}" = 'present' ]; then PIXI+=(pixi.js@8.20.0); fi
                  yarn add \
                    /tmp/cratis-components.tgz \
                    @cratis/arc@22.16.0 @cratis/arc.react@22.16.0 \
                    @cratis/fundamentals@7.19.2 @types/react@19.2.18 \
                    react@19.2.8 react-dom@19.2.8 \
                    reflect-metadata@0.2.2 rxjs@7.8.2 "${PIXI[@]}"
                  yarn node verify.mjs "${{ matrix.pixi }}"
                  yarn node verify-peers.mjs

    verify-renderer-adapters:
        name: Renderer adapter (${{ matrix.adapter }}, ${{ matrix.boundary }}, ${{ matrix.manager }}, Node ${{ matrix.node }})
        runs-on: ubuntu-latest
        timeout-minutes: 25
        strategy:
            fail-fast: false
            matrix:
                adapter: [mui, primereact11, primereact10]
                boundary: [minimum, current]
                manager: [npm, pnpm, yarn-pnp]
                node: [24.x]
                # The oldest Node.js the published packages declare in engines. npm with
                # engine-strict refuses to install a package whose engines exclude the running
                # Node.js, so these legs prove both the declared range and that the adapter works.
                include:
                    - adapter: mui
                      boundary: current
                      manager: npm
                      node: 22.x
                    - adapter: primereact11
                      boundary: current
                      manager: npm
                      node: 22.x
                    - adapter: primereact10
                      boundary: current
                      manager: npm
                      node: 22.x
        env:
            npm_config_engine_strict: ${{ matrix.node == '22.x' }}

        steps:
            - name: Checkout code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  persist-credentials: false

            - name: Setup node
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: ${{ matrix.node }}
                  registry-url: 'https://registry.npmjs.org'

            - name: Enable Corepack
              run: corepack enable

            - name: Yarn install
              run: yarn install --immutable

            - name: Test renderer adapter matrix validation
              run: yarn test-renderer-adapter-matrix

            - name: Verify packed ${{ matrix.adapter }} ${{ matrix.boundary }} boundary with ${{ matrix.manager }}
              run: >-
                  yarn verify-renderer-adapters
                  --adapter ${{ matrix.adapter }}
                  --boundary ${{ matrix.boundary }}
                  --manager ${{ matrix.manager }}