ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
  # Manual runs, so a fresh podkey-extension artefact can be produced without a
  # code change (CI artefacts expire after 90 days).
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-test-lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Test
        run: npm test

      - name: Lint
        run: npm run lint

      # The artefact is the unpacked extension itself: GitHub zips an uploaded
      # folder once, so the download unzips straight to the folder Chrome loads
      # (uploading a .zip would hand people a zip inside a zip).
      - name: Stage extension (unpacked folder)
        env:
          # on a pull request, the PR's own head (github.sha there is a temporary merge commit)
          BUILD_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          mkdir -p dist/podkey
          # vendor/ holds the sidestr engine the spend window imports (MV3 forbids remote code)
          cp -r manifest.json src popup vendor $([ -d icons ] && echo icons) LICENSE PRIVACY.md dist/podkey/
          find dist/podkey -name '*.test.js' -delete
          # the commit this package was built from, shown beside the version in the popup
          printf '{"commit":"%s","built":"%s"}\n' "$BUILD_COMMIT" "$(date -u +%Y-%m-%dT%H:%MZ)" > dist/podkey/build.json

      - name: Check the folder holds every file the extension loads
        run: |
          python3 - <<'PY'
          import json, os, re
          root = 'dist/podkey'
          have = {os.path.relpath(os.path.join(d, f), root).replace(os.sep, '/') for d, _, fs in os.walk(root) for f in fs}
          m = json.load(open('manifest.json'))
          need = [m['background']['service_worker'], m['action']['default_popup'], *m['icons'].values()]
          need += [f for c in m['content_scripts'] for f in c['js']]
          need += [f for w in m.get('web_accessible_resources', []) for f in w['resources']]
          for page in ['popup/popup.html', 'popup/approve.html', 'popup/spend.html']:
              need += ['popup/' + r for r in re.findall(r'(?:src|href)="([^"#?:]+)"', open(page).read())]
          # the spend window's engine: every vendored file PINS.json records
          for pin in json.load(open('vendor/sidestr/PINS.json'))['pins']:
              need += [f"vendor/sidestr/{pin['name']}/{f}" for f in pin['files']]
          missing = sorted(set(need) - have)
          if missing:
              raise SystemExit('missing from the package: ' + ', '.join(missing))
          print(f'package holds all {len(set(need))} files the extension loads')
          PY

      - name: Upload extension artifact
        uses: actions/upload-artifact@v4
        with:
          name: podkey-extension
          path: dist/podkey/
          if-no-files-found: error