Build.yml

# Display Name of the workflow
name: Build - Production

# Event listeners for when the job should start execution
on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

  # Run the build checks on every change
  push:
    branches: [main]

  # Allow this workflow to be called from another workflow
  workflow_call:
    inputs:
      correlationId:
        description: 'Correlates the origin job with the child instance since process start does not return an ID.'
        type: string
        required: false
      isRelease:
        description: 'Indicates that the calling workflow was triggered by a release.'
        type: boolean
        required: false
        default: false
      isPrerelease:
        description: 'Indicates that the calling release is a prerelease.'
        type: boolean
        required: false
        default: false
    outputs:
      channel:
        description: 'The channel that the build should be published to.'
        value: ${{ jobs.Metadata.outputs.channel }}
      packageName:
        description: 'The name of the generated NPM package.'
        value: ${{ jobs.Build-Prod.outputs.packageName }}
      nodeRuntime:
        description: 'The Node.JS runtime version required by the project.'
        value: ${{ jobs.Metadata.outputs.nodeRuntime }}

# Define each session of execution that should be executed
jobs:
  # Execution session that calculates the metadata for the build and makes it available to downstream jobs through outputs
  Metadata:
    # Human friendly name of the job
    name: Calculate - Metadata

    # Grant the required permissions to run the job
    permissions:
      contents: read

    # Execute the workflow
    uses: ./.github/workflows/Metadata.yml
    with:
      isRelease: ${{ inputs.isRelease || false }}
      isPrerelease: ${{ inputs.isPrerelease || false }}

  # Execution session that builds the artifacts that are used for deployment
  Build-Prod:
    # Display name of the job
    name: Build - Log Engine

    # Configures the filter for which operating system that should be used when selecting runners
    runs-on: ubuntu-latest

    # Ensure dependant jobs have completed before running this job
    needs: [Metadata]

    # Sets the scopes available to the github_token injected to the GH Actions runner
    permissions:
      attestations: write
      contents: read
      id-token: write
      packages: write

    # Content that can be reused across multiple workflows to avoid duplication of code and logic
    outputs:
      packageName: ${{ steps.generate-package.outputs.package-file }}

    # Set of steps to execute to build and capture the static HTML
    steps:
      # Used to uniquely identify the specific call to correlate the calling entity with the cross repo build
      - name: ${{ inputs.correlationId || 'No correlation ID' }}
        id: correlationId
        run: echo run identifier "${{ inputs.correlationId || 'No correlation ID' }}"
        background: true

      # Checkout is required before using local composite actions from this repository.
      # Runs synchronously (not background) since the local setup-ci action below
      # reads action.yml from the checked-out working tree and must not start until this completes.
      - name: Checkout Files from Repo
        uses: actions/checkout@v7

      # Prepare runner environment shared across CI workflows.
      - name: Setup CI Environment
        uses: ./.github/actions/setup-ci
        background: true
        with:
          updateNpm: 'true'

      # Bring job back to sync execution by awaiting for all async jobs to finish before continuing
      - name: Steps - Convert Back To Synchronous Execution - Environment Setup
        wait-all: true

      # Cryptographically attest that packages haven't been tampered where supported
      - name: Attest Dependency Provenance
        run: npm audit signatures

      # Update the version of SHIELD being uploaded to have a different version number to avoid SDG version conflict
      - name: Tattoo Version - Experimental Channel
        if: ${{ needs.Metadata.outputs.channel != 'stable' }}
        run: npm version --no-commit-hooks --no-git-tag-version "${{ needs.Metadata.outputs.semver }}"

      # Validate package integrity before publishing (tests, coverage, and production build).
      - name: Validate Package Before Publish
        run: npm run validate:package:skip-reachability

      # Generate the package archive that will be attested and published to both registries.
      - name: Generate NPM Package Archive
        id: generate-package
        run: echo "package-file=$(npm pack --ignore-scripts)" >> "$GITHUB_OUTPUT"

      # Create an attestation for the package archive to ensure integrity and authenticity.
      - name: Attest NPM Package Archive
        uses: actions/attest@v4
        with:
          subject-path: ${{ steps.generate-package.outputs.package-file }}

      # Publish the attested package to GitHub Packages without changing the npmjs install registry.
      - name: Upload Package to GitHub Packages Registry
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          npm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN"
          npm publish ${{ steps.generate-package.outputs.package-file }} --registry=https://npm.pkg.github.com --tag ${{ needs.Metadata.outputs.channel }} --ignore-scripts

      # Upload the attested npm package archive for the publish workflow to consume.
      - name: Upload NPM Package Archive Artifact
        uses: actions/upload-artifact@v7
        with:
          name: NPM-Package
          if-no-files-found: error
          path: ${{ steps.generate-package.outputs.package-file }}