otpauth/.github/workflows/main.yml

name: "Main"

on:
  push:
    tags: ["*"]
    branches: ["*"]
  pull_request:
    branches: ["*"]
  schedule:
    - cron: "25 12 * * 3"
  workflow_dispatch:

permissions: {}

jobs:
  build:
    name: "Build on ${{ matrix.os }}"
    runs-on: "${{ matrix.os }}"
    permissions:
      contents: "read"
    strategy:
      fail-fast: false
      matrix:
        os: ["ubuntu-latest", "windows-latest", "macos-latest"]
    steps:
      - name: "Checkout"
        uses: "actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29"
      - name: "Use Node.js lts/*"
        uses: "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
        with:
          node-version: "lts/*"
          cache: "npm"
      - name: "Install dependencies"
        run: "npm ci"
      - name: "Build types"
        run: "npm run types"
      - name: "Build lib"
        run: "npm run build"
      - name: "Build docs"
        run: "npm run docs"
      - name: "Lint"
        run: "npm run lint"
      - name: "Verify that the build is reproducible"
        if: "startsWith(github.ref, 'refs/tags/v')"
        shell: "bash"
        run: '[ -z "$(git status --porcelain ./dist/)" ] || { git diff >&2; exit 1; }'
      - name: "Upload dist artifact"
        if: "runner.os == 'Linux'"
        uses: "actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808"
        with:
          name: "dist"
          path: "./dist/"
          retention-days: 1
      - name: "Upload docs artifact"
        if: "runner.os == 'Linux' && startsWith(github.ref, 'refs/tags/v')"
        uses: "actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa"
        with:
          path: "./docs/"
          retention-days: 1

  test-node:
    name: "Test on Node.js ${{ matrix.node_version }} on ${{ matrix.os }}"
    needs: ["build"]
    runs-on: "${{ matrix.os }}"
    permissions:
      contents: "read"
    strategy:
      fail-fast: false
      matrix:
        node_version: ["lts/-1", "lts/*", "current"]
        os: ["ubuntu-latest", "windows-latest", "macos-latest"]
    steps:
      - name: "Checkout"
        uses: "actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29"
      - name: "Remove dist directory"
        shell: "bash"
        run: "rm -rf ./dist/"
      - name: "Download dist artifact"
        uses: "actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e"
        with:
          name: "dist"
          path: "./dist/"
      - name: "Use Node.js ${{ matrix.node_version }}"
        uses: "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
        with:
          node-version: "${{ matrix.node_version }}"
          cache: "npm"
      - name: "Install dependencies"
        run: "npm ci"
      - name: "Test"
        run: "npm run test:node"

  test-deno:
    name: "Test on Deno ${{ matrix.deno_version }} on ${{ matrix.os }}"
    needs: ["build"]
    runs-on: "${{ matrix.os }}"
    permissions:
      contents: "read"
    strategy:
      fail-fast: false
      matrix:
        deno_version: ["vx.x.x"]
        os: ["ubuntu-latest", "windows-latest", "macos-latest"]
    steps:
      - name: "Checkout"
        uses: "actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29"
      - name: "Remove dist directory"
        shell: "bash"
        run: "rm -rf ./dist/"
      - name: "Download dist artifact"
        uses: "actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e"
        with:
          name: "dist"
          path: "./dist/"
      - name: "Use Deno ${{ matrix.deno_version }}"
        uses: "denoland/setup-deno@041b854f97b325bd60e53e9dc2de9cb9f9ac0cba"
        with:
          deno-version: "${{ matrix.deno_version }}"
      - name: "Use Node.js lts/*"
        uses: "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
        with:
          node-version: "lts/*"
          cache: "npm"
      - name: "Install dependencies"
        run: "npm ci"
      - name: "Test"
        run: "npm run test:deno"

  test-bun:
    name: "Test on Bun ${{ matrix.bun_version }} on ${{ matrix.os }}"
    needs: ["build"]
    runs-on: "${{ matrix.os }}"
    permissions:
      contents: "read"
    strategy:
      fail-fast: false
      matrix:
        bun_version: ["latest"]
        os: ["ubuntu-latest", "macos-latest"]
    steps:
      - name: "Checkout"
        uses: "actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29"
      - name: "Remove dist directory"
        shell: "bash"
        run: "rm -rf ./dist/"
      - name: "Download dist artifact"
        uses: "actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e"
        with:
          name: "dist"
          path: "./dist/"
      - name: "Use Bun ${{ matrix.bun_version }}"
        uses: "oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7"
        with:
          bun-version: "${{ matrix.bun_version }}"
      - name: "Install dependencies"
        run: "bun install --frozen-lockfile"
      - name: "Test"
        run: "bun run test:bun"

  test-browser:
    name: "Test on ${{ matrix.browser }} browser on ${{ matrix.os }}"
    needs: ["build"]
    runs-on: "${{ matrix.os }}"
    permissions:
      contents: "read"
    strategy:
      fail-fast: false
      matrix:
        browser: ["chromium", "firefox", "webkit"]
        os: ["ubuntu-latest"]
    steps:
      - name: "Checkout"
        uses: "actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29"
      - name: "Remove dist directory"
        shell: "bash"
        run: "rm -rf ./dist/"
      - name: "Download dist artifact"
        uses: "actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e"
        with:
          name: "dist"
          path: "./dist/"
      - name: "Use Node.js lts/*"
        uses: "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
        with:
          node-version: "lts/*"
          cache: "npm"
      - name: "Install dependencies"
        run: 'npm ci && npx playwright install --with-deps "${{ matrix.browser }}"'
      - name: "Test"
        run: 'npm run test:browser:"${{ matrix.browser }}"'

  publish-npm:
    name: "Publish npm package"
    if: "startsWith(github.ref, 'refs/tags/v')"
    needs: ["test-node", "test-deno", "test-bun", "test-browser"]
    runs-on: "ubuntu-latest"
    permissions:
      contents: "read"
      id-token: "write"
    steps:
      - name: "Checkout"
        uses: "actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29"
      - name: "Remove dist directory"
        shell: "bash"
        run: "rm -rf ./dist/"
      - name: "Download dist artifact"
        uses: "actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e"
        with:
          name: "dist"
          path: "./dist/"
      - name: "Use Node.js lts/*"
        uses: "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
        with:
          node-version: "lts/*"
          registry-url: "https://registry.npmjs.org"
      - name: "Publish"
        env:
          NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}"
        run: |
          PKG_NAME="$(jq -r '.name' ./package.json)"; PKG_VERSION="$(jq -r '.version' ./package.json)"
          if [ "$(npm view "${PKG_NAME:?}" versions --json | jq -r --arg v "${PKG_VERSION:?}" 'index($v)')" = 'null' ]; then
            npm publish --provenance --access public
          fi

  publish-jsr:
    name: "Publish JSR package"
    if: "startsWith(github.ref, 'refs/tags/v')"
    needs: ["test-node", "test-deno", "test-bun", "test-browser"]
    runs-on: "ubuntu-latest"
    permissions:
      contents: "read"
      id-token: "write"
    steps:
      - name: "Checkout"
        uses: "actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29"
      - name: "Remove dist directory"
        shell: "bash"
        run: "rm -rf ./dist/"
      - name: "Download dist artifact"
        uses: "actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e"
        with:
          name: "dist"
          path: "./dist/"
      - name: "Use Node.js lts/*"
        uses: "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
        with:
          node-version: "lts/*"
      - name: "Publish"
        run: |
          npx jsr publish

  publish-github-release:
    name: "Publish GitHub release"
    if: "startsWith(github.ref, 'refs/tags/v')"
    needs: ["test-node", "test-deno", "test-bun", "test-browser"]
    runs-on: "ubuntu-latest"
    permissions:
      contents: "write"
    steps:
      - name: "Publish"
        uses: "hectorm/ghaction-release@066200d04c3549852afa243d631ea3dc93390f68"

  publish-github-pages:
    name: "Publish GitHub Pages"
    if: "startsWith(github.ref, 'refs/tags/v')"
    needs: ["test-node", "test-deno", "test-bun", "test-browser"]
    runs-on: "ubuntu-latest"
    permissions:
      id-token: "write"
      pages: "write"
    environment:
      name: "github-pages"
      url: "${{ steps.deployment.outputs.page_url }}"
    steps:
      - name: "Publish"
        id: "deployment"
        uses: "actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e"