pull-requests.yml

name: CI pull requests, build + lint
on:
  pull_request:
    branches: [ develop ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
permissions:
    actions: none
    artifact-metadata: none
    attestations: none
    checks: none
    contents: none
    deployments: none
    discussions: none
    id-token: none
    issues: none
    models: none
    packages: none
    pages: none
    pull-requests: none
    repository-projects: none
    security-events: none
    statuses: none

# https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#defaults
# Explicit workflow-level cache directive, honored by job/step-level 'actions/cache'.
# This GitHub Actions workflow has a trusted trigger via account-level ruleset,
# and the key job is gated by a deploy environment requiring approval.
# Note that this workflow disables 'actions/setup-node' automatic caching,
# instead 'actions/cache' is configured and invoked (restore point explicit, save via post-jobs hook)
# in order to enable caching of NPM packages and Electron binaries.
# The cache key is specific to this "PR" (pull request) workflow, different from "continuous" integration and deployment (develop branch push) and "release" (version tag push).
cache-mode: write

jobs:
  approval_job:
# github.event.pull_request.head.repo.fork
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest
    environment:
      name: "Thorium Deskop Pull Requests"
      deployment: false
    steps:
      - run: echo "Pull Request approval."

  build_job:
    timeout-minutes: 30
    permissions:
      actions: none
      artifact-metadata: none
      attestations: none
      checks: none
      contents: none
      deployments: none
      discussions: none
      id-token: none
      issues: none
      models: none
      packages: none
      pages: none
      pull-requests: none
      repository-projects: none
      security-events: none
      statuses: none
#   if: "!contains(toJSON(github.event.commits.*.message), '[skip-ci]')"
#   if: ${{ github.ref == 'refs/heads/develop' }}
#   if: "github.event_name == 'pull_request'"
#        !contains(github.event.head_commit.message, 'skip ci') &&
#        github.head_ref is PR branch
    needs: [approval_job]
    if: >-
      !cancelled()
      && (needs.approval_job.result == 'success' || needs.approval_job.result == 'skipped')
      && github.base_ref == 'develop' && github.repository_owner == 'edrlab' && github.repository == 'edrlab/thorium-reader'
    runs-on: ${{ matrix.runson }}
    strategy:
      fail-fast: false
      matrix:
        # osarch: [windows-intel, windows-arm, macos-intel, macos-arm, linux-intel, linux-arm]
        osarch: [linux-intel]
        # osarch: [windows-intel, windows-arm]
# Thorium for MacOS x64 and arm64 is built on GitHub Actions arm64 runners
# Thorium for Linux x64 and arm64 is built on GitHub Actions x64 runners
# Thorium for Windows x64 and arm64 is built on GitHub Actions x64 runners
# To ensure arm64, the trick is:
#       npm ci --ignore-scripts --foreground-scripts --allow-git=root --cpu=arm64
#       Replace "x64" with "arm64" in `package.json` (and optionally the electron-builder `src/package.json`, if needed)
# To ensure x64, the trick is:
#       npm ci --ignore-scripts --foreground-scripts --allow-git=root --cpu=x64
#       `package.json` already specifies "x64"
# windows-latest is currently windows-2022, but becomes windows-2025 in September 2025 (windows-2022 remains supported for 3 years)
#       https://github.com/actions/runner-images/blob/main/images/windows/Windows2022-Readme.md
# windows-2025 is beta / public preview
#       https://github.com/actions/runner-images/issues/11228
# ah, windows-2025 / windows-2025-vs2026 now on Visual Studio 2026 (was 2022)
#       https://github.com/actions/runner-images/blob/main/images/windows/Windows2025-Readme.md
# windows-11-preview_aarch64 ?
#       https://github.com/actions/partner-runner-images/issues/19#issuecomment-2569992032
# macos-latest is currently macos-14-arm64
#       https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md
# macos-15-arm64 is beta / public preview
#       https://github.com/actions/runner-images/blob/main/images/macos/macos-15-arm64-Readme.md
# ubuntu-latest is ubuntu-24.04
#       https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md
# ubuntu-20.04 is the oldest available (good for glibc compat) ... but GitHub says "The Ubuntu 20.04 runner image will be fully unsupported by April 1, 2025"
#       https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2004-Readme.md
        include:
          # - osarch: windows-intel
          #   runson: windows-2025
          #   packname: win
          #   release_tag: latest-windows-intel
          # - osarch: windows-arm
          #   runson: windows-11-vs2026-arm # win11-vs2026-arm64 # https://github.com/actions/runner-images/blob/main/images/windows/Windows11-VS2026-Arm64-Readme.md
          #   packname: win
          #   release_tag: latest-windows-arm
          # - osarch: macos-intel
          #   runson: macos-latest #macos-14-arm64
          #   packname: 'mac:skip-notarize'
          #   release_tag: latest-macos-intel
          # - osarch: macos-arm
          #   runson: macos-latest #macos-14-arm64
          #   packname: 'mac:skip-notarize'
          #   release_tag: latest-macos-arm
          - osarch: linux-intel
            runson: ubuntu-22.04 #ubuntu-latest is ubuntu-24.04
            packname: linux
            release_tag: latest-linux-intel
          # - osarch: linux-arm
          #   runson: ubuntu-22.04-arm #ubuntu-latest is ubuntu-24.04
          #   packname: linux
          #   release_tag: latest-linux-arm
    steps:
###########################
    - name: Checking graceful shell command failure
      run: |-
        pwdx || echo OK || true
      shell: cmd
      continue-on-error: true
###########################
    - name: Microsoft Windows Visual Studio lookup
      if: startsWith(matrix.osarch, 'windows-')
      run: >
        dir /A "C:\Program Files\Microsoft Visual Studio" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\Hostx64" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\Hostx64\x64" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\HostArm64" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\HostArm64\arm64"
      shell: cmd
###########################
    - name: Microsoft Windows dumpbin to PATH (ARM)
      #if: startsWith(matrix.osarch, 'windows-')
      if: ${{ matrix.osarch == 'windows-arm' }}
      run: >
        $VS_ROOT = "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC";
        Get-ChildItem -Path $VS_ROOT -Force;
        $VS_VERSION = (Get-ChildItem -Path $VS_ROOT | Sort-Object Name -Descending | Select-Object -First 1).Name;
        $VS_BIN = "$VS_ROOT\$VS_VERSION\bin\HostArm64\arm64";
        echo $VS_BIN >> $env:GITHUB_PATH;
        echo $VS_BIN
      shell: powershell
###########################
    - name: Microsoft Windows dumpbin to PATH (INTEL)
      #if: startsWith(matrix.osarch, 'windows-')
      if: ${{ matrix.osarch == 'windows-intel' }}
      run: >
        $VS_ROOT = "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC";
        Get-ChildItem -Path $VS_ROOT -Force;
        $VS_VERSION = (Get-ChildItem -Path $VS_ROOT | Sort-Object Name -Descending | Select-Object -First 1).Name;
        $VS_BIN = "$VS_ROOT\$VS_VERSION\bin\Hostx64\x64";
        echo $VS_BIN >> $env:GITHUB_PATH;
        echo $VS_BIN
      shell: powershell
###########################
    - name: Microsoft Windows dumpbin check (ARM)
      #if: startsWith(matrix.osarch, 'windows-')
      if: ${{ matrix.osarch == 'windows-arm' }}
      run: >
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC" &&
        dumpbin /headers "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\HostArm64\arm64\dumpbin.exe" | findstr /i machine
      shell: cmd
###########################
    - name: Microsoft Windows dumpbin check (INTEL)
      #if: startsWith(matrix.osarch, 'windows-')
      if: ${{ matrix.osarch == 'windows-intel' }}
      run: >
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC" &&
        dumpbin /headers "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\Hostx64\x64\dumpbin.exe" | findstr /i machine
      shell: cmd
###########################
# - name: Microsoft Windows msbuild to PATH
#   if: startsWith(matrix.osarch, 'windows-')
#   uses: microsoft/setup-msbuild@v2
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\MSBuild\Current\Bin"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\bin\amd64"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.44.35207\bin\Hostx64\x64"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\Hostx64\x64"
    #- run: exit 1
#    - run: echo 'RELEASE_TAG:' ${{ env.RELEASE_TAG }}
#    - run: 'echo "GITHUB_RUN_NUMBER: ${{ github.run_number }}"'
#    - run: 'echo "GITHUB_RUN_ID: ${{ github.run_id }}"'
#    - run: 'echo "GITHUB_SHA: ${{ github.sha }}"'
###########################
    - run: echo "${{ matrix.osarch }} // ${{ runner.arch }}"
###########################
    - name: System arch (non Windows)
      #if: ${{ matrix.osarch != 'windows-intel' && matrix.osarch != 'windows-arm' }}
      if: ${{ !startsWith(matrix.osarch, 'windows-') }}
      run: uname -m && arch
###########################
    - name: Checkout
# https://github.com/actions/checkout/commits/v7.0.1
# https://github.com/actions/checkout/commits/3d3c42e5aac5ba805825da76410c181273ba90b1
# https://github.com/actions/checkout/compare/v7.0.1...3d3c42e5aac5ba805825da76410c181273ba90b1
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      with:
        persist-credentials: false
    # - name: Git config global dump (pre)
    #   run: 'git config --global --list || echo NO_GIT_GLOBAL_CONFIG || true'
    #   shell: bash
    # - name: Git config local dump (pre)
    #   run: 'git config --list || echo NO_GIT_GLOBAL_CONFIG || true'
    #   shell: bash
    # - name: git HTTP authentication instead SSH (NPM >=7) 1
    #   run: >
    #     git config --global url."https://github.com/".insteadOf ssh://git@github.com/
    #   shell: bash
    # - name: git HTTP authentication instead SSH (NPM >=7) 2
    #   run: >
    #     git config --global url."https://github.com".insteadOf ssh://git@github.com
    #   shell: bash
    # - name: git HTTP authentication instead SSH (NPM >=7) 3
    #   run: >
    #     git config --global url."http://github.com/".insteadOf git@github.com:
    #   shell: bash
    # - name: git HTTP authentication instead SSH (NPM >=7) 4
    #   run: >
    #     git config --global url."http://".insteadOf git://
    #   shell: bash
#    - name: Git config global dump (post)
#      run: 'git config --global --list || echo NO_GIT_GLOBAL_CONFIG || true'
#      shell: bash
#    - name: Git config local dump (post)
#      run: 'git config --list || echo NO_GIT_GLOBAL_CONFIG || true'
#      shell: bash
###########################
# https://github.com/actions/setup-node/commits/v7.0.0
# https://github.com/actions/setup-node/commits/820762786026740c76f36085b0efc47a31fe5020
# https://github.com/actions/setup-node/compare/v7.0.0...820762786026740c76f36085b0efc47a31fe5020
    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
# https://github.com/actions/setup-node#caching-global-packages-data
# https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#caching-packages-data
# https://github.com/actions/cache/blob/main/examples.md#node---npm
# https://github.com/actions/setup-node/issues/1553#issuecomment-4750595425
      with:
        node-version: '24'
        package-manager-cache: false
        cache: ''
#        cache: 'npm'
#        node-version-file: package.json
#        package-manager-cache: true
#        cache-dependency-path: 'package-lock.json'
        #check-latest: true
###########################
    - run: node --version && npm --version
###########################
    - run: npm --global install npm
###########################
    - run: npm --version && npm config get cache
###########################
    - name: Get NPM cache
      id: npm-config-get-cache
      run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
      shell: bash
      # run: echo "dir=$(npm config get cache)" >> ${env:GITHUB_OUTPUT}
      # shell: pwsh
###########################
# https://github.com/actions/cache/commits/v6.1.0
# https://github.com/actions/cache/commits/55cc8345863c7cc4c66a329aec7e433d2d1c52a9
# https://github.com/actions/cache/compare/v6.1.0...55cc8345863c7cc4c66a329aec7e433d2d1c52a9
    - name: Action Cache
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
      id: action-cache
      with:
        path: ${{ steps.npm-config-get-cache.outputs.dir }}
        key: npm-electron-cache-pr-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}
        restore-keys: |
          npm-electron-cache-pr-${{ runner.os }}-${{ runner.arch }}-
###########################
    - name: NPM Cache NOT HIT
      run: echo "NPM Cache NOT HIT - not restored at all, or restored with restore-keys instead of primary key"
      if: steps.action-cache.outputs.cache-hit != 'true'
###########################
    - name: NPM Cache HIT
      run: echo "NPM Cache HIT - restored with primary key"
      if: steps.action-cache.outputs.cache-hit == 'true'
###########################
    - run: ls -als "$(npm config get cache)"
      shell: bash
###########################
    - run: npm cache verify
###########################
    - run: python --version || echo ok || true
###########################
    - run: python3 --version || echo ok || true
###########################
    - run: pip --version || echo ok || true
###########################
    # PYTHON 3.12 distutils deprecation remediation:
    #- run: python3 -m pip install packaging || python -m pip install packaging
    - run: python3 -m pip install setuptools || python -m pip install setuptools
    # - run: npm --global install asar
###########################
    - name: package patch 1
      run: >
        node scripts/package-ci-patch.js package.json ${{ github.run_id }} &&
        cat package.json | grep -i VERSION &&
        cat package.json
      shell: bash
###########################
    - name: package patch 2
      run: >
        node scripts/package-ci-patch.js src/package.json ${{ github.run_id }} &&
        cat src/package.json | grep -i VERSION &&
        cat src/package.json
      shell: bash
###########################
# - name: package lock patch
#   run: node scripts/package-lock-patch.js && cat package-lock.json | grep -i divina-player-js
#   shell: bash
###########################
    - run: git --no-pager diff
###########################
#    - run: npm cache clean --force
###########################
#    - run: npm cache verify
###########################
# - run: cat package-lock.json | grep -i divina-player-js
###########################
    - name: NPM install (arm64)
      #if: ${{ matrix.osarch == 'linux-arm' || matrix.osarch == 'windows-arm' || matrix.osarch == 'macos-arm' }}
      if: endsWith(matrix.osarch, '-arm')
      #(ls -alsR ~/.cache/electron/ || ls -alsR ~/Library/Caches/electron/ || ls -alsR ~/AppData/Local/electron/Cache/ || echo OK)
      run: >
        npm ci --ignore-scripts --foreground-scripts --allow-git=root --cpu=arm64 &&
        cd node_modules/electron &&
        DEBUG=@electron/get* force_no_cache=false electron_config_cache="$(npm config get cache)" npm_config_arch=arm64 ELECTRON_INSTALL_ARCH=arm64 node install.js --cpu=arm64 &&
        cd -
      shell: bash
      #export npm_config_arch=arm64 && export npm_config_cpu=arm64 &&
###########################
    - name: NPM install (x64)
      #if: ${{ matrix.osarch == 'linux-intel' || matrix.osarch == 'windows-intel' || matrix.osarch == 'macos-intel' }}
      if: endsWith(matrix.osarch, '-intel')
      #(ls -alsR ~/.cache/electron/ || ls -alsR ~/Library/Caches/electron/ || ls -alsR ~/AppData/Local/electron/Cache/ || echo OK)
      run: >
        npm ci --ignore-scripts --foreground-scripts --allow-git=root --cpu=x64 &&
        cd node_modules/electron &&
        DEBUG=@electron/get* force_no_cache=false electron_config_cache="$(npm config get cache)" npm_config_arch=x64 ELECTRON_INSTALL_ARCH=x64 node install.js --cpu=x64 &&
        cd -
      shell: bash
      #export npm_config_arch=x64 && export npm_config_cpu=x64 &&
###########################
#    - run: npm cache verify
###########################
    - name: Electron version + arch (Windows)
      #if: ${{ matrix.osarch == 'windows-intel' || matrix.osarch == 'windows-arm' }}
      if: startsWith(matrix.osarch, 'windows-')
      run: >
        (dumpbin /headers "node_modules\electron\dist\electron.exe" | findstr /i machine) &&
        (node_modules\\electron\\dist\\electron.exe --no-sandbox --version || echo INVALID_ARCH || true) &&
        (node_modules\\electron\\dist\\electron.exe --no-sandbox --abi || echo INVALID_ARCH || true)
      shell: cmd
      continue-on-error: true
###########################
    - name: Electron version + arch (Linux)
      #if: ${{ matrix.osarch == 'linux-intel' || matrix.osarch == 'linux-arm' }}
      if: startsWith(matrix.osarch, 'linux-')
      run: >
        (file node_modules/electron/dist/electron) &&
        (node_modules/electron/dist/electron --no-sandbox --version || echo INVALID_ARCH || true) &&
        (node_modules/electron/dist/electron --no-sandbox --abi || echo INVALID_ARCH || true)
###########################
    - name: Electron version + arch (MacOS)
      #if: ${{ matrix.osarch == 'macos-intel' || matrix.osarch == 'macos-arm' }}
      if: startsWith(matrix.osarch, 'macos-')
      run: >
        (file node_modules/electron/dist/Electron.app/Contents/MacOS/Electron) &&
        (node_modules/electron/dist/Electron.app/Contents/MacOS/Electron --no-sandbox --version || echo INVALID_ARCH || true) &&
        (node_modules/electron/dist/Electron.app/Contents/MacOS/Electron --no-sandbox --abi || echo INVALID_ARCH || true)
###########################
    - run: npm list -g node-gyp || echo ok || true
###########################
    - run: npm list node-gyp || echo ok || true
###########################
    - run: >
        node -e '
        const path = require("path");
        const fs = require("fs");
        const filePath = path.join(process.cwd(), "package.json");
        let fileStr = fs.readFileSync(filePath, { encoding: "utf8" });
        fileStr = fileStr.replace(/"sign": true,/g, `"sign": false,`);
        fileStr = fileStr.replace(/"hardenedRuntime": true,/g, `"hardenedRuntime": false, "identity": null,`);
        fs.writeFileSync(filePath, fileStr, { encoding: "utf8" });
        '
      continue-on-error: true
###########################
    - name: PR action (just build)
      run: npm run build:prod
      # && npm run test SEE https://github.com/edrlab/thorium-reader/issues/1697
###########################