at-mintel/.gitea/workflows/pipeline.yml

name: Monorepo Pipeline

on:
  push:
    branches:
      - '**'
    tags:
      - '*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  prioritize:
    name: ⚡ Prioritize Release
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest
    steps:
      - name: 🛑 Cancel Redundant Runs
        env:
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          RUN_ID: ${{ github.run_id }}
          REF: ${{ github.ref }}
          REF_NAME: ${{ github.ref_name }}
          EVENT: ${{ github.event_name }}
          SHA: ${{ github.sha }}
        run: |
          echo "🔎 Debug: Event=$EVENT, Ref=$REF, RefName=$REF_NAME, RunId=$RUN_ID"
          
          # Fetch recent runs for the repository
          RUNS=$(curl -s -H "Authorization: token $GITEA_TOKEN" "https://git.infra.mintel.me/api/v1/repos/$REPO/actions/runs?limit=30")
          
          case "$REF" in
            refs/tags/*)
              echo "🚀 Release detected ($REF_NAME). Cancelling non-tag runs..."
              
              # Identify runs to cancel: in_progress/queued, NOT this run, and NOT a tag run
              echo "$RUNS" | jq -c '.workflow_runs[] | select(.status == "in_progress" or .status == "queued") | select(.id | tostring != "'$RUN_ID'")' | while read -r run; do
                ID=$(echo "$run" | jq -r '.id')
                RUN_REF=$(echo "$run" | jq -r '.ref')
                TITLE=$(echo "$run" | jq -r '.display_title')
                
                case "$RUN_REF" in
                  refs/tags/*)
                    echo "⏭️ Skipping parallel release run $ID ($TITLE) on $RUN_REF"
                    ;;
                  *)
                    echo "🛑 Cancelling redundant branch run $ID ($TITLE) on $RUN_REF..."
                    curl -X POST -s -H "Authorization: token $GITEA_TOKEN" "https://git.infra.mintel.me/api/v1/repos/$REPO/actions/runs/$ID/cancel"
                    ;;
                esac
              done
              ;;
            *)
              echo "ℹ️ Regular push. Checking for parallel release tag for SHA $SHA..."
              
              # Check if there's a tag run for the SAME commit
              TAG_RUN_ID=$(echo "$RUNS" | jq -r '.workflow_runs[] | select(.ref | startswith("refs/tags/")) | select(.head_sha == "'$SHA'") | .id' | head -n 1)
              
              if [[ -n "$TAG_RUN_ID" && "$TAG_RUN_ID" != "null" ]]; then
                echo "🚀 Found parallel tag run $TAG_RUN_ID for commit $SHA. Cancelling this branch run ($RUN_ID)..."
                curl -X POST -s -H "Authorization: token $GITEA_TOKEN" "https://git.infra.mintel.me/api/v1/repos/$REPO/actions/runs/$RUN_ID/cancel"
                exit 0
              fi
              echo "✅ No parallel tag run found. Proceeding."
              ;;
          esac

  lint:
    name: 🧹 Lint
    needs: prioritize
    if: always() && !cancelled() && (needs.prioritize.result == 'success' || needs.prioritize.result == 'skipped')
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node_version: 20
      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.2.0 --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts --no-color
      - name: Lint
        run: pnpm lint
      - name: Check Dependencies (Depcheck)
        run: pnpm -r exec npx --yes depcheck --skip-missing --ignores="eslint*,@eslint/*,@types/*,typescript,tsup,tsx,vitest,tailwindcss,postcss,autoprefixer,@mintel/*,ts-node,*in-the-middle,pino*,@commitlint/*,@changesets/*,globals"

  test:
    name: 🧪 Test
    needs: prioritize
    if: always() && !cancelled() && (needs.prioritize.result == 'success' || needs.prioritize.result == 'skipped')
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node_version: 20
      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.2.0 --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts --no-color
      - name: Test
        run: pnpm test

  build:
    name: 🏗️ Build
    needs: prioritize
    if: always() && !cancelled() && (needs.prioritize.result == 'success' || needs.prioritize.result == 'skipped')
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node_version: 20
      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.2.0 --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts --no-color
      - name: Build
        run: pnpm build

  release:
    name: 🚀 Release
    needs: [lint, test, build]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node_version: 20
      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.2.0 --activate
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts --no-color
      - name: 🏷️ Sync Versions (if Tagged)
        run: pnpm sync-versions
      - name: 🏷️ Release Packages (Tag-Driven)
        run: |
          echo "🏷️ Tag detected [${{ github.ref_name }}], performing sync release..."
          pnpm release:tag

  build-images:
    name: 🐳 Build ${{ matrix.name }}
    needs: [lint, test, build]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        include:
          - image: nextjs
            file: packages/infra/docker/Dockerfile.nextjs
            name: Build-Base
          - image: runtime
            file: packages/infra/docker/Dockerfile.runtime
            name: Production Runtime
          - image: gatekeeper
            file: packages/infra/docker/Dockerfile.gatekeeper
            name: Gatekeeper (Product)

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: 🐳 Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: 🔐 Discover Valid Registry Token
        id: discover_token
        run: |
          echo "Testing available secrets against git.infra.mintel.me Docker registry..."
          TOKENS="${{ secrets.GITEA_PAT }} ${{ secrets.MINTEL_PRIVATE_TOKEN }} ${{ secrets.NPM_TOKEN }}"
          USERS="${{ github.repository_owner }} ${{ github.actor }} marcmintel mintel mmintel"

          for TOKEN in $TOKENS; do
            if [ -n "$TOKEN" ]; then
              for U in $USERS; do
                if [ -n "$U" ]; then
                  echo "Attempting docker login for a token with user $U..."
                  if echo "$TOKEN" | docker login git.infra.mintel.me -u "$U" --password-stdin > /dev/null 2>&1; then
                    echo "✅ Successfully authenticated with a token."
                    echo "::add-mask::$TOKEN"
                    echo "token=$TOKEN" >> $GITHUB_OUTPUT
                    echo "user=$U" >> $GITHUB_OUTPUT
                    exit 0
                  fi
                fi
              done
            fi
          done
          echo "❌ All available tokens failed to authenticate!"
          exit 1

      - name: 🏗️ Build & Push ${{ matrix.name }}
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ${{ matrix.file }}
          platforms: linux/amd64
          pull: true
          provenance: false
          push: true
          secrets: |
            NPM_TOKEN=${{ steps.discover_token.outputs.token }}
          tags: |
            git.infra.mintel.me/mmintel/${{ matrix.image }}:${{ github.ref_name }}
            git.infra.mintel.me/mmintel/${{ matrix.image }}:latest