pr-validation.yml

name: Pull Request Validation

on:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
      - converted_to_draft
      - edited
    paths-ignore:
      - '**/*.md'
      - '**/*.yml'
      - '**/*.yaml'
      - LICENSE
      - '**/*.gitignore'
      - .editorconfig
      - docs/**
  push:
    branches:
      - develop
  schedule:
    # Keep develop branch Turbo cache warm so PR runs can restore from it.
    - cron: '0 3 * * *'

env:
  APP_NAME: 'rs-compiler'
  CI: true
  TURBO_TELEMETRY_DISABLED: 1
  DO_NOT_TRACK: 1
  CHECKOUT_REF: >-
    ${{
      github.event_name == 'schedule'
      && 'refs/heads/develop'
      || github.event.pull_request.number != null
      && format('refs/pull/{0}/merge', github.event.pull_request.number)
      || github.ref
    }}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

jobs:
  build-public-packages:
    name: Build all public packages
    if: >-
      (github.event_name != 'schedule' || github.ref_name == 'develop') &&
      (github.event.pull_request.number == null || !github.event.pull_request.draft)
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout code
        uses: actions/checkout@v7.0.1
        with:
          ref: ${{ env.CHECKOUT_REF }}
          fetch-depth: 0
          fetch-tags: false

      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          rust-target: 'wasm32-wasip1'

      - name: Cache turbo build setup
        id: turbo-cache
        uses: ./.github/actions/turbo
        with:
          cache-scope: build-public-packages
          restore-cache-scope: build-public-packages
          allow-global-fallback: 'false'

      - name: Build all public packages
        run: pnpm run build --filter "{./packages/*}..." --filter "{./crates/*}..." --continue

      - name: Save turbo build cache
        if: always()
        uses: ./.github/actions/turbo-save
        with:
          cache-key: ${{ steps.turbo-cache.outputs.cache-key }}

  basic-checks:
    name: ${{ matrix.check.name }}
    if: >-
      (github.event_name != 'schedule' || github.ref_name == 'develop') &&
      (github.event.pull_request.number == null || !github.event.pull_request.draft)
    runs-on: ubuntu-24.04-arm
    strategy:
      matrix:
        check:
          - id: conventional-commits
            name: Validate conventional commits
            command: pnpm exec commitlint --from=$(git merge-base origin/develop HEAD)
          - id: version-mismatch
            name: Version mismatch check
            command: ./scripts/git/version-mismatch-check.sh
          - id: format-check
            name: Check formatting
            command: pnpm run format:check
          # Disabled for now; re-enable when we want the dependency graph
          # enforced on every PR. `pnpm run deps:check:typescript` still works
          # locally in the meantime.
          # - id: dependency-graph
          #   name: Dependency graph guards
          #   command: |
          #     pnpm dedupe --check
          #     pnpm exec syncpack lint
          #     pnpm run deps:check:typescript
      fail-fast: false
    steps:
      - name: Checkout PR code
        uses: actions/checkout@v7.0.1
        with:
          ref: ${{ env.CHECKOUT_REF }}
          fetch-depth: 0
          fetch-tags: false

      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          setup-rust: ${{ matrix.check.id == 'format-check' }}

      - name: ${{ matrix.check.name }}
        run: ${{ matrix.check.command }}

  checks:
    name: ${{ matrix.check.name }}
    if: >-
      (github.event_name != 'schedule' || github.ref_name == 'develop') &&
      (github.event.pull_request.number == null || !github.event.pull_request.draft)
    runs-on: ubuntu-24.04-arm
    needs:
      - build-public-packages
      - basic-checks
    strategy:
      fail-fast: false
      matrix:
        check:
          - id: lint-check
            name: Lint Node.js code
            command: pnpm run lint:node
          - id: lint-type-aware
            name: Lint Node.js code (type-aware)
            command: pnpm run lint:type-aware
          - id: lint-check-rust
            name: Lint Rust code
            command: pnpm run lint:rust
          - id: typecheck
            name: Typecheck code
            command: pnpm run typecheck
          - id: tests-nodejs
            name: Tests Node.js
            command:
              pnpm run test --filter="{./packages/*}" --filter="{./apps/*}"
              --filter="@stylexswc/rs-compiler"
          - id: tests-rust
            name: Tests Rust code
            command: pnpm exec turbo run test:crates:workspace:regular --filter="//"
          - id: tests-rust-doc
            name: Tests Rust doc
            command: pnpm exec turbo run test:crates:workspace:doc --filter="//"
          - id: tests-coverage
            name: Tests Rust coverage
            command: pnpm exec turbo run test:coverage:workspace --filter="//"
          - id: check-artifacts
            name: Check artifacts
            command: pnpm run check:artifacts --filter "{./packages/*}" --filter "{./crates/*}"
    steps:
      - name: Checkout code
        uses: actions/checkout@v7.0.1
        with:
          ref: ${{ env.CHECKOUT_REF }}
          fetch-depth: 0
          fetch-tags: false

      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          rust-target: 'wasm32-wasip1'

      - name: Install nightly Rust toolchain
        if: matrix.check.id == 'tests-coverage'
        uses: actions-rust-lang/setup-rust-toolchain@v1.17.0
        with:
          toolchain: nightly

      - name: Install cargo-nextest
        if: matrix.check.id == 'tests-rust'
        uses: taiki-e/install-action@v2.85.5
        with:
          tool: cargo-nextest

      - name: Install cargo-llvm-cov and nightly
        if: matrix.check.id == 'tests-coverage'
        uses: taiki-e/install-action@v2.85.5
        with:
          tool: cargo-nextest,cargo-llvm-cov

      - name: Cache turbo build setup
        id: turbo-cache
        uses: ./.github/actions/turbo
        with:
          cache-scope: checks-${{ matrix.check.id }}
          restore-cache-scope: build-public-packages

      - name: ${{ matrix.check.name }}
        run: ${{ matrix.check.command }}

      - name: Save turbo build cache
        if: always()
        uses: ./.github/actions/turbo-save
        with:
          cache-key: ${{ steps.turbo-cache.outputs.cache-key }}

  playwright-image:
    name: Resolve Playwright image
    if: >-
      (github.event_name != 'schedule' || github.ref_name == 'develop') &&
      (github.event.pull_request.number == null || !github.event.pull_request.draft)
    runs-on: ubuntu-24.04-arm
    outputs:
      image: ${{ steps.detect.outputs.image }}
      version: ${{ steps.detect.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7.0.1
        with:
          ref: ${{ env.CHECKOUT_REF }}
          fetch-depth: 1
          fetch-tags: false
          sparse-checkout: |
            pnpm-lock.yaml
            .github/actions/playwright-version
          sparse-checkout-cone-mode: false

      - name: Detect Playwright version
        id: detect
        uses: ./.github/actions/playwright-version

  visual-tests:
    name: Run visual comparison tests
    if: >-
      (github.event_name != 'schedule' || github.ref_name == 'develop') &&
      (github.event.pull_request.number == null || !github.event.pull_request.draft)
    runs-on: ubuntu-24.04-arm
    needs:
      - build-public-packages
      - basic-checks
      - playwright-image
    container:
      image: ${{ needs.playwright-image.outputs.image }}
      options: --ipc=host
    env:
      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
    steps:
      - name: Checkout code
        uses: actions/checkout@v7.0.1
        with:
          ref: ${{ env.CHECKOUT_REF }}
          fetch-depth: 0
          fetch-tags: false

      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          setup-rust: 'false'

      - name: Cache turbo build setup
        id: turbo-cache
        uses: ./.github/actions/turbo
        with:
          cache-scope: visual-tests
          restore-cache-scope: build-public-packages
          allow-global-fallback: 'false'

      - name: Verify public package build cache
        env:
          RESTORED_TURBO_CACHE_KEY: ${{ steps.turbo-cache.outputs.preferred-cache-matched-key }}
        run: |
          if [ -z "$RESTORED_TURBO_CACHE_KEY" ]; then
            echo "::error::No build-public-packages Turbo cache was restored."
            exit 1
          fi

          echo "Restored $RESTORED_TURBO_CACHE_KEY"

      - name: Run visual comparison tests
        run:
          pnpm run test:visual --filter="./apps/*" --filter="!@stylexswc/rollup-large-example"
          --continue

      - name: Save turbo build cache
        if: always()
        uses: ./.github/actions/turbo-save
        with:
          cache-key: ${{ steps.turbo-cache.outputs.cache-key }}

  benchmark:
    name: Run benchmarks
    if: >-
      (github.event_name != 'schedule' || github.ref_name == 'develop') &&
      (github.event.pull_request.number == null || !github.event.pull_request.draft)
    needs:
      - build-public-packages
      - basic-checks
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read
    env:
      BENCHMARK_CACHE_KEY_PREFIX: >-
        aarch64-unknown-linux-gnu-benchmark-${{
          github.event.pull_request.number != null
          && format('pr-{0}', github.event.pull_request.number)
          || github.ref_name
        }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7.0.1
        with:
          ref: ${{ env.CHECKOUT_REF }}
          fetch-depth: 0
          fetch-tags: false

      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          setup-rust: 'false'

      - name: Cache turbo build setup
        id: turbo-cache
        uses: ./.github/actions/turbo
        with:
          cache-scope: benchmark
          restore-cache-scope: build-public-packages

      - name: Download previous benchmark data
        id: benchmark-cache-restore
        uses: actions/cache/restore@v6
        with:
          path: ./cache
          key: ${{ env.BENCHMARK_CACHE_KEY_PREFIX }}-${{ github.run_attempt }}
          restore-keys: |
            ${{ env.BENCHMARK_CACHE_KEY_PREFIX }}-
            aarch64-unknown-linux-gnu-benchmark-pr-
            aarch64-unknown-linux-gnu-benchmark-

      - name: Run benchmarks
        run: pnpm run bench --filter @stylexswc/rs-compiler

      - name: Store benchmark result
        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
        with:
          tool: 'benchmarkjs'
          output-file-path: 'crates/stylex-rs-compiler/benchmark/results/output.txt'
          external-data-json-path: './cache/benchmark-data.json'
          fail-on-alert: true
          comment-on-alert: true
          alert-comment-cc-users: '@Dwlad90'
          summary-always: true
          github-token: ${{ secrets.GITHUB_TOKEN }}
          alert-threshold: '150%'
          fail-threshold: '175%'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Save benchmark cache
        if: always()
        uses: actions/cache/save@v6
        with:
          path: ./cache
          key: ${{ env.BENCHMARK_CACHE_KEY_PREFIX }}-${{ github.run_attempt }}

      - name: Save turbo build cache
        if: always()
        uses: ./.github/actions/turbo-save
        with:
          cache-key: ${{ steps.turbo-cache.outputs.cache-key }}

  pr-validation:
    name: PR Validation
    if:
      ${{ always() && (github.event_name != 'schedule' || github.ref_name == 'develop') &&
      (github.event.pull_request.number == null || !github.event.pull_request.draft) }}
    needs:
      - build-public-packages
      - basic-checks
      - checks
      - playwright-image
      - visual-tests
      - benchmark
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Verify validation jobs
        env:
          NEEDS_JSON: ${{ toJSON(needs) }}
        run: |
          echo "$NEEDS_JSON" | jq .

          for job in basic-checks checks build-public-packages playwright-image visual-tests benchmark; do
            result=$(echo "$NEEDS_JSON" | jq -r --arg job "$job" '.[$job].result')
            if [[ "$result" != "success" && "$result" != "skipped" ]]; then
              echo "::error::Validation job '$job' finished with status '$result'."
              exit 1
            fi
          done

          echo "All validation jobs passed"

  dependabot:
    runs-on: ubuntu-24.04-arm
    needs: [pr-validation]
    if:
      github.event_name != 'schedule' && github.event.pull_request.number != null &&
      github.event.pull_request.user.login == 'dependabot[bot]'
    permissions:
      contents: write
      issues: write
      pull-requests: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0

      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
        with:
          github-token: '${{ secrets.GITHUB_TOKEN }}'

      - name: Set PR information as environment variables
        env:
          PR_NUMBER_VALUE: ${{ github.event.pull_request.number }}
          PR_URL_VALUE: ${{ github.event.pull_request.html_url }}
          PR_HEAD_REF_VALUE: ${{ github.event.pull_request.head.ref }}
          UPDATE_TYPE_VALUE: ${{ steps.metadata.outputs.update-type }}
          DEPENDENCY_TYPE_VALUE: ${{ steps.metadata.outputs.dependency-type }}
        run: |
          echo "PR_NUMBER=${PR_NUMBER_VALUE}" >> $GITHUB_ENV
          echo "PR_URL=${PR_URL_VALUE}" >> $GITHUB_ENV
          echo "PR_HEAD_REF=${PR_HEAD_REF_VALUE}" >> $GITHUB_ENV
          echo "UPDATE_TYPE=${UPDATE_TYPE_VALUE}" >> $GITHUB_ENV
          echo "DEPENDENCY_TYPE=${DEPENDENCY_TYPE_VALUE}" >> $GITHUB_ENV

      - name: Add labels based on dependency type
        run: |
          if [[ "$DEPENDENCY_TYPE" == "direct:production" ]]; then
            gh pr edit "$PR_NUMBER" --add-label "production"
          else
            gh pr edit "$PR_NUMBER" --add-label "development"
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Approve Pull Request
        run: |
          gh pr review "$PR_NUMBER" --approve -R ${{ github.repository }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure Git
        if: |
          (steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
            steps.metadata.outputs.update-type == 'version-update:semver-minor')
        uses: ./.github/actions/gitconfig

      - name: Auto-merge for safe updates
        if: |
          (steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
            steps.metadata.outputs.update-type == 'version-update:semver-minor')
        run: |
          echo "Auto-merging PR..."
          git checkout develop
          git pull origin develop
          git fetch origin "$PR_HEAD_REF"
          git merge origin/"$PR_HEAD_REF"
          git push origin develop
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Comment on PR if auto-merge is skipped
        if: |
          (steps.metadata.outputs.update-type != 'version-update:semver-patch' &&
            steps.metadata.outputs.update-type != 'version-update:semver-minor')
        run: |
          REASON="The update type ($UPDATE_TYPE) requires manual review"
          gh pr comment "$PR_NUMBER" -b "⚠️ This PR wasn't automatically merged: $REASON"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}