ci: major refactors (#2423)

* Migrate CF Pages to CF Wrangler action (based on jellyfin/jellyfin-web#5894)
* Create event-based workflows, all the specific actions are now reusable workflows

Signed-off-by: Fernando Fernández <[email protected]>

.github/workflows/TODO

@@ -0,0 +1 @@
+* Reusable workflows should be under a `reusable` folder. Track https://github.com/orgs/community/discussions/10773

.github/workflows/codeql.yml → .github/workflows/__codeql.yml

@@ -1,29 +1,15 @@
 name: GitHub CodeQL 🔬
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref || github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
 on:
-  push:
-    branches:
-      - master
-  pull_request:
-    paths-ignore:
-      - '**/*.md'
-  merge_group:
   workflow_call:
-  schedule:
-    - cron: 0 0 * * MON,FRI
-
+    inputs:
+      commit:
+        required: true
+        type: string
 jobs:
   analyze:
     name: Analyze 🔬
     runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
 
     strategy:
       fail-fast: false
@@ -35,6 +21,7 @@ jobs:
       - name: Checkout repository ⬇️
         uses: actions/[email protected]
         with:
+          ref: ${{ inputs.commit }}
           show-progress: false
 
       - name: Initialize CodeQL 🛠️

.github/workflows/__deploy.yml

@@ -0,0 +1,75 @@
+name: Deploy 🏗️
+
+on:
+  workflow_call:
+    inputs:
+      branch:
+        required: true
+        type: string
+      commit:
+        required: false
+        type: string
+      pr_number:
+        required: false
+        type: number
+      comment:
+        required: false
+        type: boolean
+      artifact_name:
+        required: false
+        type: string
+        default: frontend
+
+jobs:
+  cf-pages:
+    name: CloudFlare Pages 📃
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.branch == 'master' && 'production' || 'preview' }}
+    outputs:
+      url: ${{ steps.cf.outputs.deployment-url }}
+
+    steps:
+      - name: Download workflow artifact ⬇️
+        uses: actions/[email protected]
+        with:
+          name: ${{ inputs.artifact_name }}
+          path: dist
+
+      - name: Publish to Cloudflare Pages 📃
+        uses: cloudflare/[email protected]
+        id: cf
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy dist --project-name=jf-vue --branch=${{ inputs.branch }}
+
+  compose-comment:
+    name: Compose comment 📝
+    if: ${{ always() && inputs.comment }}
+    uses: ./.github/workflows/__job_messages.yml
+    needs:
+      - cf-pages
+
+    with:
+      branch: ${{ inputs.branch }}
+      commit: ${{ inputs.commit }}
+      preview_url: ${{ needs.cf-pages.outputs.url }}
+      build_workflow_run_id: ${{ github.run_id}}
+      commenting_workflow_run_id: ${{ github.run_id }}
+      in_progress: false
+
+  comment-status:
+    name: Create comment status 📊
+    if: ${{ always() && inputs.comment && inputs.pr_number }}
+    runs-on: ubuntu-latest
+    needs:
+      - compose-comment
+
+    steps:
+      - name: Update job summary in PR comment 🔃
+        uses: thollander/[email protected]
+        with:
+          GITHUB_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
+          message: ${{ needs.compose-comment.outputs.msg }}
+          pr_number: ${{ inputs.pr_number }}
+          comment_tag: ${{ needs.compose-comment.outputs.marker }}

.github/workflows/package.yml → .github/workflows/__package.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       commit:
-        required: true
+        required: false
         type: string
       tag_name:
         required: false
@@ -28,10 +28,6 @@ env:
   COMMIT_TAG: unstable
   DOCKER_BUILD_RECORD_UPLOAD: false
 
-permissions:
-  id-token: write
-  attestations: write
-
 defaults:
   run:
     shell: bash
@@ -60,6 +56,7 @@ jobs:
       - name: Checkout ⬇️
         uses: actions/[email protected]
         with:
+          ref: ${{ inputs.commit || github.sha }}
           show-progress: false
 
       - name: Setup node environment ⚙️
@@ -169,6 +166,7 @@ jobs:
       - name: Checkout ⬇️
         uses: actions/[email protected]
         with:
+          ref: ${{ inputs.commit || github.sha }}
           show-progress: false
 
       - name: Configure QEMU ⚙️
@@ -262,6 +260,7 @@ jobs:
       - name: Checkout ⬇️
         uses: actions/[email protected]
         with:
+          ref: ${{ inputs.commit || github.sha }}
           show-progress: false
 
       - name: Configure QEMU ⚙️

.github/workflows/quality_checks.yml → .github/workflows/__quality_checks.yml

@@ -1,16 +1,11 @@
 name: Quality checks 👌🧪
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
 on:
-  pull_request:
-    paths-ignore:
-      - '**/*.md'
-  merge_group:
-  schedule:
-    - cron: 30 7 * * 6
+  workflow_call:
+    inputs:
+      commit:
+        required: true
+        type: string
   workflow_dispatch:
 
 jobs:
@@ -21,6 +16,7 @@ jobs:
       - name: Checkout Repository
         uses: actions/[email protected]
         with:
+          ref: ${{ inputs.commit }}
           show-progress: false
 
       - name: Scan
@@ -42,6 +38,7 @@ jobs:
       - name: Checkout ⬇️
         uses: actions/[email protected]
         with:
+          ref: ${{ inputs.commit }}
           show-progress: false
 
       - name: Setup node environment ⚙️
@@ -67,6 +64,7 @@ jobs:
       - name: Checkout ⬇️
         uses: actions/[email protected]
         with:
+          ref: ${{ inputs.commit }}
           show-progress: false
 
       - name: Setup node environment ⚙️
@@ -81,21 +79,15 @@ jobs:
       - name: Run typecheck 📖
         run: npm run typecheck
 
-  build:
-    name: Build 🏗️
-    uses: ./.github/workflows/package.yml
-    with:
-      commit: ${{ github.sha }}
-
   conventional_commits:
     name: Conventional commits check 💬
-    if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout ⬇️
         uses: actions/[email protected]
         with:
+          ref: ${{ inputs.commit }}
           show-progress: false
 
       - name: Check if all commits comply with the specification