continuous-integration.yml

---
name: Continuous integration

on:
  pull_request:
    # we want to run the continuous integration on every pull request targetting those branches
    branches: [main, release/*, maintenance/*]

  merge_group:
    branches: [main, release/*, maintenance/*]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  workflow-security:
    runs-on: ubuntu-26.04
    name: Workflow security analysis
    permissions:
      actions: read # required by zizmor online audits in private repositories
      contents: read # required for actions/checkout to read the workflow source
      security-events: write # required by zizmor-action to upload SARIF to code scanning
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Run zizmor
        id: zizmor
        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
        with:
          inputs: .github/workflows/continuous-integration.yml
          version: 1.25.2
          persona: pedantic
          min-severity: informational
          min-confidence: low
          config: .github/zizmor.yml

      - name: Fail if zizmor reported findings
        env:
          sarifFilePath: ${{ steps.zizmor.outputs.output-file }}
        run: |
          findingsCount="$(jq '[.runs[].results[]] | length' "$sarifFilePath")"
          echo "zizmor findings: $findingsCount"
          test "$findingsCount" -eq 0

  generated-artifacts:
    runs-on: ubuntu-26.04-arm
    name: generated artifacts check
    permissions:
      contents: read

    steps:
      # Do not set ref to github.event.pull_request.head.sha. pull request continuous integration must use the default
      # merge commit so the workflow and checked-out files stay aligned.
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Verify sparse runtime validation entry point
        run: bash ./tools/runtimeVerification/verifySparseRuntimeValidation.sh

      - name: Install dependencies
        run: npm clean-install && npx just setup

      - name: Verify deployment CLI from clean install
        run: |
          rm -rf libraries/config/lib
          published_charts_path="$(mktemp)"
          printf '%s\n' '[]' > "${published_charts_path}"

          helm_action="$(
            ./tools/productionDistribution/runProductionDistributionCli.sh \
              select-helm-chart \
              --charts-path "${published_charts_path}" \
              --image-tag "dev-test-image"
          )"

          test "${helm_action}" = 'publish'
          test -f libraries/config/lib/index.js
          test -f libraries/config/lib/index.d.ts

      - name: Verify generated i18n artifacts are committed
        run: |
          npx just translate-merge

          if ! test -z "$(git status --porcelain)"; then
            echo "Repository is not clean after generation. Run generation locally and commit the changes."
            git status
            exit 1
          fi

      - name: Validate translation markers
        run: npx just translate-validate

  build-libraries:
    runs-on: ubuntu-26.04-arm
    name: build libraries
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm clean-install && npx just setup

      - name: Build libraries
        run: npx just build-libraries

  rspack-build:
    runs-on: ubuntu-26.04
    name: Rspack production build
    permissions:
      contents: read
    container:
      image: quay.io/wire/mirror-images/playwright:v1.64.1-noble@sha256:7852dc5a7d72f5fe458a597d690f6c42fbc8e9e26ddfa95f8e6ef552558d9bbf
      options: --ipc=host
    defaults:
      run:
        shell: bash

    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm clean-install && npx just setup

      - name: Build webapps and assemble the internal production server with Just
        id: public_rspack_build
        env:
          WIRE_WEBAPP_BUILD_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          short_commit_sha="${WIRE_WEBAPP_BUILD_COMMIT::7}"
          expected_version="dev-${short_commit_sha}"
          export WIRE_WEBAPP_BUILD_VERSION="${expected_version}"
          npx just package-server-internal build-webapp-development build-webapp-public
          echo "expected_version=${expected_version}" >> "$GITHUB_OUTPUT"

      - name: Verify internal server assembly
        run: |
          test -s apps/server/dist/index.js
          test -s apps/server/dist/static/index.html
          test -s apps/server/dist/version.json
          test -s apps/server/dist/libs/wire/telemetry/embed.js
          test -s apps/server/dist/s3/ebs.zip

      - name: Run Rspack browser smoke tests
        run: npx playwright test --config apps/webapp/playwright.rspack.config.ts

      - name: Build and package public webapp with Rspack
        env:
          WIRE_WEBAPP_BUILD_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
          WIRE_WEBAPP_BUILD_VERSION: ${{ steps.public_rspack_build.outputs.expected_version }}
        run: |
          npx just package-server-public

      - name: Install unzip for artifact verification
        run: |
          apt-get update
          apt-get install --yes --no-install-recommends unzip
          rm -rf /var/lib/apt/lists/*

      - name: Verify public Rspack deployment package
        env:
          BUILD_ARTIFACT_PATH: apps/server/dist/s3/ebs.zip
          EXPECTED_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
          EXPECTED_VERSION: ${{ steps.public_rspack_build.outputs.expected_version }}
        run: |
          set -euo pipefail

          test -f "$BUILD_ARTIFACT_PATH"
          unzip -tq "$BUILD_ARTIFACT_PATH"
          npx just validate-build-artifact

          archive_entries="$(unzip -Z1 "$BUILD_ARTIFACT_PATH")"
          required_entry_scripts=(
            static/min/app.js
            static/min/auth.js
            static/min/checkBrowser.js
            static/min/runtime.js
            static/min/vendor.js
            static/min/dexie.js
            static/min/pdf.worker.mjs
            static/min/worker.js
          )

          for entry_script_path in "${required_entry_scripts[@]}"; do
            if ! grep -Fqx -- "$entry_script_path" <<< "$archive_entries"; then
              echo "Public Rspack deployment package is missing required entry script: $entry_script_path" >&2
              exit 1
            fi
          done

          public_rspack_runtime="$(unzip -p "$BUILD_ARTIFACT_PATH" static/min/runtime.js)"
          if ! grep -Fq 'rspackChunk_wireapp_webapp' <<< "$public_rspack_runtime"; then
            echo "Public deployment package does not contain the Rspack runtime fingerprint." >&2
            exit 1
          fi

          if grep -Fq 'webpackChunk_wireapp_webapp' <<< "$public_rspack_runtime"; then
            echo "Public deployment package contains the Webpack runtime fingerprint." >&2
            exit 1
          fi

      - name: Upload Rspack smoke diagnostics
        if: ${{ failure() }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rspack-browser-smoke-diagnostics
          path: |
            apps/webapp/playwright-report/rspack-smoke/
            apps/webapp/test-results/rspack-smoke/
          if-no-files-found: ignore
          retention-days: 3

  type-check:
    runs-on: ubuntu-26.04-arm
    name: type check
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm clean-install && npx just setup

      - name: Type check
        run: npx just type-check

  lint-file-names:
    runs-on: ubuntu-26.04-arm
    name: lint file names
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm clean-install && npx just setup

      - name: Lint file names
        run: npx just lint-file-names

  lint:
    runs-on: ubuntu-26.04-arm
    name: lint
    permissions:
      contents: read
    env:
      # Pin the comparison to the target branch commit from the event, even if the branch advances.
      BASE_REF: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 1
          # Keep this shallow. Git-dependent checks get the base commit explicitly in the next step.

      - name: Fetch base commit for Git-dependent checks
        run: |
          git fetch --no-tags --depth=1 origin "${BASE_REF:?Missing event base revision}"

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm clean-install && npx just setup

      - name: Check code duplication
        id: duplication
        run: npx just lint-duplication

      - name: Upload duplication report
        if: ${{ !cancelled() && steps.duplication.outcome != 'skipped' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: duplication-report
          path: target/reports/duplication/
          if-no-files-found: error
          retention-days: 3

      - name: Build libraries for lint import resolution
        run: npx just build-libraries

      - name: Lint repository
        run: npx just eslint

      - name: Check formatting
        run: npx just format-check

      - name: Stylelint
        run: npx just stylesheet-lint

  unit-tests:
    runs-on: ubuntu-26.04-arm
    name: unit tests
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm clean-install && npx just setup

      - name: Test
        run: ./tools/ci/runWithNetworkIsolation.sh npx just test-ci

      - name: Upload coverage reports
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage-reports
          if-no-files-found: error
          retention-days: 1
          path: |
            target/coverage/apps/webapp
            target/coverage/apps/server
            target/coverage/apps/webapp/core
            target/coverage/libraries/api-client

  public-production-package:
    runs-on: ubuntu-26.04
    name: Public production package verification
    if: ${{ github.event_name == 'pull_request' }}
    needs:
      - generated-artifacts
      - build-libraries
      - type-check
      - lint-file-names
      - lint
      - unit-tests
    permissions:
      contents: read

    steps:
      - name: Checkout (pull_request)
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm clean-install && npx just setup

      - name: Build and verify public production package
        env:
          WIRE_WEBAPP_BUILD_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          short_commit_sha="${WIRE_WEBAPP_BUILD_COMMIT::7}"
          expected_version="dev-${short_commit_sha}"
          WIRE_WEBAPP_BUILD_VERSION="${expected_version}" \
            npx just package-server-public

          BUILD_ARTIFACT_PATH=apps/server/dist/s3/ebs.zip \
          EXPECTED_COMMIT="${WIRE_WEBAPP_BUILD_COMMIT}" \
          EXPECTED_VERSION="${expected_version}" \
            npx just validate-build-artifact

      - name: Build and smoke-test sparse production Docker context
        env:
          DOCKER_IMAGE_TAG: wire-webapp-production-ci:${{ github.run_id }}-${{ github.run_attempt }}
          DISTRIBUTION_CONTEXT_PATH: ${{ runner.temp }}/production-docker-context
        run: |
          set -euo pipefail

          mkdir -p \
            "${DISTRIBUTION_CONTEXT_PATH}/apps/server" \
            "${DISTRIBUTION_CONTEXT_PATH}/libraries/config"

          cp -a package.json package-lock.json .npmrc run.sh .env.defaults "${DISTRIBUTION_CONTEXT_PATH}/"
          cp -a apps/server/Dockerfile apps/server/package.json apps/server/dist "${DISTRIBUTION_CONTEXT_PATH}/apps/server/"
          cp -a libraries/config/package.json libraries/config/lib "${DISTRIBUTION_CONTEXT_PATH}/libraries/config/"

          docker build \
            "${DISTRIBUTION_CONTEXT_PATH}" \
            --file "${DISTRIBUTION_CONTEXT_PATH}/apps/server/Dockerfile" \
            --tag "${DOCKER_IMAGE_TAG}"

          docker run --rm --entrypoint sh "${DOCKER_IMAGE_TAG}" -c '
            set -eu
            test -s /dist/index.js
            test -s /dist/version.json
            test -d /dist/static
            test -s /app/run.sh
            test -s /dist/.env.defaults
            grep -q "^BACKEND_NAME=" /dist/.env.defaults
            grep -q "^BRAND_NAME=" /dist/.env.defaults
            grep -q "^URL_ACCOUNT_BASE=" /dist/.env.defaults
            grep -q "^BACKEND_REST=" /dist/.env.defaults
            grep -q "^BACKEND_WS=" /dist/.env.defaults
            node -e "require(\"@wireapp/config\")"

            ENFORCE_HTTPS=false NODE_PORT=8080 /bin/bash /app/run.sh &
            server_pid=$!
            trap "kill \"$server_pid\" 2>/dev/null || true; wait \"$server_pid\" 2>/dev/null || true" EXIT

            attempt=0
            while [ "$attempt" -lt 20 ]; do
              if node -e "fetch(\"http://127.0.0.1:8080/version\").then(response => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"; then
                exit 0
              fi

              attempt=$((attempt + 1))
              sleep 1
            done

            echo "Server did not return a successful /version response within 20 seconds." >&2
            exit 1
          '