penpot/.github/workflows/build-bundle.yml

name: Bundles Builder

on:
  # Create bundle from manual action
  workflow_dispatch:
    inputs:
      gh_ref:
        description: 'Name of the branch or ref'
        type: string
        required: true
        default: 'develop'
      force:
        description: 'Rebuild and overwrite even if this version already exists in S3'
        type: boolean
        required: false
        default: false
  workflow_call:
    inputs:
      gh_ref:
        description: 'Name of the branch or ref'
        type: string
        required: true
        default: 'develop'
      force:
        description: 'Rebuild and overwrite even if this version already exists in S3'
        type: boolean
        required: false
        default: false
    outputs:
      sha:
        description: 'Bundled commit, full 40-char SHA.'
        value: ${{ jobs.check.outputs.sha }}

# Literal group name: under `workflow_call`, `github.workflow` resolves to the
# caller's workflow, which put this workflow and the other reusable one called
# by the same caller into a single shared group, and left a manual dispatch of
# the same ref in a group of its own, free to race on the same artifacts.
concurrency:
  group: build-bundle-${{ inputs.gh_ref }}
  cancel-in-progress: true

jobs:
  # ── 1. Decide whether there is anything to build ───────────────────────
  check:
    name: Check current bundle
    runs-on: penpot-standar-runner
    timeout-minutes: 10
    outputs:
      gh_ref: ${{ steps.vars.outputs.gh_ref }}
      bundle_version: ${{ steps.vars.outputs.bundle_version }}
      short_sha: ${{ steps.vars.outputs.short_sha }}
      sha: ${{ steps.vars.outputs.sha }}
      commit_title: ${{ steps.vars.outputs.commit_title }}
      exists: ${{ steps.check.outputs.exists }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ inputs.gh_ref }}

      - name: Extract some useful variables
        id: vars
        run: |
          echo "gh_ref=${{ inputs.gh_ref || github.ref_name }}" >> $GITHUB_OUTPUT
          echo "bundle_version=$(git describe --tags --always)" >> $GITHUB_OUTPUT
          echo "short_sha=$(git rev-parse --short=12 HEAD)" >> $GITHUB_OUTPUT
          echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
          echo "commit_title=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT

      # Keyed by commit sha, same as build-docker.yml's marker check, so
      # both pipelines agree on what "already built" means: any ref that
      # points at an already-bundled commit skips the build, regardless of
      # which ref built it first. `force` bypasses this check entirely.
      - name: Check if this bundle is already built
        id: check
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
        run: |
          if [ "${{ inputs.force }}" = "true" ]; then
            echo "exists=false" >> $GITHUB_OUTPUT
            {
              echo "### 🔁 Bundle build forced"
              echo ""
              echo "\`force: true\` — skipping the S3 sha check."
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          BUNDLE_EXISTS=$(aws s3api head-object \
            --bucket ${{ secrets.S3_BUCKET }} \
            --key "penpot-sha-${{ steps.vars.outputs.short_sha }}.zip" \
            > /dev/null 2>&1 && echo "true" || echo "false")

          if [ "$BUNDLE_EXISTS" = "true" ]; then
            echo "exists=true" >> $GITHUB_OUTPUT
            {
              echo "### ⏭️ Bundle build skipped"
              echo ""
              echo "The bundle in S3 was already built from \`sha-${{ steps.vars.outputs.short_sha }}\` (\`${{ steps.vars.outputs.bundle_version }}\`)."
            } >> "$GITHUB_STEP_SUMMARY"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
          fi

  # ── 2. Build and upload, only when needed ──────────────────────────────
  build:
    name: Build and Upload Penpot Bundle
    runs-on: penpot-standar-runner
    timeout-minutes: 90
    needs: check
    if: needs.check.outputs.exists == 'false'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ inputs.gh_ref }}

      - name: Build bundle
        env:
          BUILD_WASM: 'yes'
          BUILD_STORYBOOK: 'yes'
        run: ./manage.sh build-bundle

      - name: Prepare directories for zipping
        run: |
          mkdir zips
          mv bundles penpot

      - name: Create zip bundle
        run: |
          echo "📦 Packaging Penpot bundle..."
          zip -r zips/penpot.zip penpot

      - name: Upload Penpot bundle to S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
        run: |
          aws s3 cp zips/penpot.zip \
            s3://${{ secrets.S3_BUCKET }}/penpot-sha-${{ needs.check.outputs.short_sha }}.zip \
            --metadata bundle-version=${{ needs.check.outputs.bundle_version }}

      - name: Write step summary
        run: |
          {
            echo "### ✅ Bundle built"
            echo ""
            echo "- Version: \`${{ needs.check.outputs.bundle_version }}\` (\`git describe --tags --always\`)"
            echo "- Commit: [\`${{ needs.check.outputs.short_sha }}\`](https://github.com/${{ github.repository }}/commit/${{ needs.check.outputs.short_sha }}) — ${{ needs.check.outputs.commit_title }}"
            echo "- Built at: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
          } >> "$GITHUB_STEP_SUMMARY"

  # ── 3. Single failure notification for the whole workflow ─────────────
  notify:
    name: Notify failure
    runs-on: penpot-standar-runner
    timeout-minutes: 5
    needs: [check, build]
    if: failure()

    steps:
      - name: Notify Mattermost
        uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0
        with:
          MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }}
          MATTERMOST_CHANNEL: bot-alerts-cicd
          TEXT: |
            ❌ 📦 *[PENPOT] Error building penpot bundles.*
            📄 Triggered from ref: `${{ needs.check.outputs.gh_ref || inputs.gh_ref }}`
               Bundle version: `${{ needs.check.outputs.bundle_version || 'n/a' }}`
            🔗 Run: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
            @infra