ci.yaml

name: CI
on:
  push:
    branches:
      - main
      - master
    tags:
      - "*"
  pull_request:
  schedule:
    - cron: "0 0 * * *"

jobs:
  test-launcher:
    name: Test npm launcher
    runs-on: ubuntu-latest
    steps:
      - uses: ory/ci/checkout@master
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - run: npm run test:launcher

  test:
    name: Run tests
    runs-on: ubuntu-latest
    steps:
      - uses: ory/ci/checkout@master
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.mod
      - uses: actions/cache@v4
        with:
          path: |
            ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ hashFiles('go.mod') }}
          restore-keys: ${{ runner.os }}-playwright-
      - run:
          go run github.com/mxschmitt/playwright-go/cmd/playwright install
          chromium --with-deps
      - run: make lint
      # cmd/cloudx tests run against live staging, which go test cannot track,
      # so a cached pass would hide a break on the staging side.
      - run: go test -race -count=1 ./...
        env:
          ORY_RATE_LIMIT_HEADER: ${{ secrets.ORY_RATE_LIMIT_HEADER }}
          ORY_CONSOLE_URL: https://console.staging.ory.dev
          ORY_ORYAPIS_URL: https://staging.oryapis.dev
      - uses: actions/upload-artifact@v4
        if: ${{ failure() }}
        with:
          name: playwright-traces
          path: playwright-traces

  docs:
    name: Generate docs
    # Disabled: ory/docs only accepts changes to master through pull requests,
    # and ory/ci/docs/cli-next pushes directly. Re-enable once it opens one.
    if: false
    runs-on: ubuntu-latest
    steps:
      - uses: ory/ci/docs/cli-next@master
        with:
          token: ${{ secrets.ORY_BOT_PAT }}
          output-dir: docs/cli

  release:
    name: Generate release
    runs-on: ubuntu-latest
    if: ${{ github.ref_type == 'tag' }}
    needs:
      - test
    steps:
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          # this might remove tools that are actually needed,
          # if set to "true" but frees about 6 GB
          tool-cache: false

          # all of these default to true, but feel free to set to
          # "false" if necessary for your workflow
          android: true
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: true
          swap-storage: true
      - uses: ory/ci/releaser@master
        with:
          token: ${{ secrets.ORY_BOT_PAT }}
          goreleaser_key: ${{ secrets.GORELEASER_KEY }}
          cosign_pwd: ${{ secrets.COSIGN_PWD }}
          docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
          docker_password: ${{ secrets.DOCKERHUB_PASSWORD }}

  npm-publish:
    name: Publish to npm
    runs-on: ubuntu-latest
    if: ${{ github.ref_type == 'tag' }}
    needs:
      - release
    # Authenticates to npm via OIDC trusted publishing (no token). Each
    # published package must list this repo and workflow file as a trusted
    # publisher in its npmjs.com settings.
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: ory/ci/checkout@master
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      # Trusted publishing requires npm >= 11.5.1; node 22 bundles npm 10.
      - run: npm install -g npm@11
      - env:
          REF_NAME: ${{ github.ref_name }}
        run: node npm/publish.js "$REF_NAME"