node.yml

on:
  workflow_call:
    inputs:
      range:
        description: "node.js semver range"
        required: true
        type: string
      notable:
        description: "notable versions range"
        required: false
        type: string
      type:
        description: 'majors or minors'
        default: majors
        required: false
        type: string
      build-command:
        description: 'optional build command to run once, prior to all the matrix steps'
        default: ''
        required: false
        type: string
      build-output-dir:
        description: 'build output directory to cache'
        default: ''
        required: false
        type: string
      command:
        description: '`run:` step'
        required: true
        type: string
      continue-on-error:
        description: 'whether to continue on error'
        default: false
        required: false
        type: boolean
      skip-ls-check:
        description: 'skip `npm ls`'
        default: false
        required: false
        type: boolean
      after_install:
        description: 'command to run after `npm install` but before `npm ls`'
        required: false
        type: string
      timeout-minutes:
        required: false
        type: number
        default: 30
      coverage:
        description: coverage provider
        required: false
        type: string
        default: codecov
      subpackage:
        description: 'subdirectory to `npm install` in'
        required: false
        type: string
        default: ''

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read

jobs:
  build:
    runs-on: ubuntu-22.04
    steps:
      - uses: ljharb/actions/node/build@main
        with:
          build-command: ${{ inputs.build-command }}
        if: ${{ inputs.build-command != '' }}
      - name: 'cache build output'
        uses: actions/cache/save@v4
        with:
          path: ${{ inputs.build-output-dir }}
          key: build-output-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
        if: ${{ inputs.build-command != '' && inputs.build-output-dir != '' }}
      - run: true
        if: ${{ inputs.build-command == '' }}

  matrix:
    runs-on: ubuntu-22.04
    outputs:
      latest: ${{ steps.set-matrix.outputs.requireds }}
      nonlatest: ${{ steps.set-matrix.outputs.optionals }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            raw.githubusercontent.com:443
            nodejs.org:443
            iojs.org:443
            registry.npmjs.org:443
            actions-results-receiver-production.githubapp.com:443

      - uses: ljharb/actions/node/matrix@main
        id: set-matrix
        with:
          versionsAsRoot: true
          type: ${{ inputs.type }}
          preset: ${{ inputs.range }}
          notable: ${{ inputs.notable || '' }}

  vlt-matrix:
    runs-on: ubuntu-22.04
    outputs:
      latest: ${{ steps.set-matrix.outputs.requireds }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            raw.githubusercontent.com:443
            nodejs.org:443
            iojs.org:443
            registry.npmjs.org:443
            actions-results-receiver-production.githubapp.com:443

      - uses: ljharb/actions/node/matrix@main
        id: set-matrix
        with:
          versionsAsRoot: true
          type: ${{ inputs.type }}
          empty: ${{ contains(inputs.range, '-') }}
          preset: "${{ inputs.range }} >=22" # vlt is `20 || >= 22`
          notable: ${{ inputs.notable || '' }}

  bun-matrix:
    runs-on: ubuntu-22.04
    outputs:
      latest: ${{ steps.set-matrix.outputs.requireds }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            raw.githubusercontent.com:443
            nodejs.org:443
            iojs.org:443
            registry.npmjs.org:443
            actions-results-receiver-production.githubapp.com:443

      - uses: ljharb/actions/node/matrix@main
        id: set-matrix
        with:
          versionsAsRoot: true
          type: ${{ inputs.type }}
          empty: ${{ contains(inputs.range, '-') }}
          preset: '${{ inputs.range }} >= 22' # only run bun install on node 22+
          notable: ${{ inputs.notable || '' }}

  vlt-latest:
    if: ${{ needs.vlt-matrix.outputs.latest != '[]' || inputs.after_install != '' }}
    needs: [build, vlt-matrix]
    name: 'latest (vlt i)'
    runs-on: ubuntu-22.04
    continue-on-error: true # see https://github.com/vltpkg/vltpkg/issues/267 # ${{ inputs.continue-on-error }}
    timeout-minutes: ${{ inputs.timeout-minutes }}

    strategy:
      fail-fast: false
      matrix:
        node-version: ${{ fromJson(needs.vlt-matrix.outputs.latest) }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            raw.githubusercontent.com:443
            nodejs.org:443
            iojs.org:443
            registry.npmjs.org:443
            actions-results-receiver-production.githubapp.com:443

      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          show-progress: false

      - uses: ljharb/actions/node/install@main
        name: 'nvm install ${{ matrix.node-version }}'
        with:
          node-version: ${{ matrix.node-version }}
          skip-ls-check: true
          skip-install: true

      - run: echo "NVM_DIR=${NVM_DIR}" >> $GITHUB_ENV

      - uses: ljharb/actions/vlt/install@main
        name: 'vlt install'
        with:
          nvm-dir: "${{ env.NVM_DIR }}"
          cache-node-modules-key: vlt-node_modules-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
          skip-ls-check: ${{ inputs.skip-ls-check && 'true' || 'false' }}

      - uses: ljharb/actions/vlt/install@main
        if: ${{ inputs.subpackage != '' }}
        name: 'vlt install, subpackage: ${{ inputs.subpackage }}'
        with:
          nvm-dir: "${{ env.NVM_DIR }}"
          before_install: cd ${{ inputs.subpackage }}
          cache-node-modules-key: vlt-node_modules-${{ inputs.subpackage }}-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
          skip-ls-check: ${{ inputs.skip-ls-check && 'true' || 'false' }}

      - run: echo "PACKAGE_JSON=$(jq -c . < package.json)" >> $GITHUB_ENV

      - name: 'restore build output'
        uses: actions/cache/restore@v4
        with:
          path: ${{ inputs.build-output-dir }}
          key: build-output-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
        if: ${{ inputs.build-command != '' && inputs.build-output-dir != '' }}

      - if: ${{ startsWith(fromJson(env.PACKAGE_JSON).name, '@') && startsWith(matrix.node-version, '0.') && ! startsWith(matrix.node-version, '0.1') }}
        run: eval $(node -e 'console.log(require("./package.json").scripts["${{ inputs.command }}".slice(8)])')
        env:
          PATH: "./node_modules/.bin/:${{ env.PATH }}"
      - run: ${{ inputs.command }}
        if: ${{ ! startsWith(fromJson(env.PACKAGE_JSON).name, '@') || ! startsWith(matrix.node-version, '0') || startsWith(matrix.node-version, '0.1') }}

      - uses: codecov/codecov-action@v3.1.5
        if: ${{ inputs.coverage == 'codecov' }}
      - uses: coverallsapp/github-action@v2
        if: ${{ inputs.coverage == 'coveralls' }}
        with:
          parallel: true
          flag-name: run ${{ join(matrix.*, ' - ') }}

  bun-latest:
    if: ${{ needs.bun-matrix.outputs.latest != '[]' || inputs.after_install != '' }}
    needs: [build, bun-matrix]
    name: 'latest (bun i)'
    runs-on: ubuntu-22.04
    continue-on-error: true # see https://github.com/oven-sh/bun/issues/8780 # ${{ inputs.continue-on-error }}
    timeout-minutes: ${{ inputs.timeout-minutes }}

    strategy:
      fail-fast: false
      matrix:
        node-version: ${{ fromJson(needs.bun-matrix.outputs.latest) }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            raw.githubusercontent.com:443
            nodejs.org:443
            iojs.org:443
            registry.npmjs.org:443
            actions-results-receiver-production.githubapp.com:443

      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          show-progress: false

      - uses: ljharb/actions/node/install@main
        name: 'nvm install ${{ matrix.node-version }}'
        with:
          node-version: ${{ matrix.node-version }}
          skip-ls-check: true
          skip-install: true

      - run: echo "NVM_DIR=${NVM_DIR}" >> $GITHUB_ENV

      - uses: ljharb/actions/bun/install@main
        name: 'bun install'
        with:
          nvm-dir: "${{ env.NVM_DIR }}"
          cache-node-modules-key: bun-node_modules-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
          skip-ls-check: ${{ inputs.skip-ls-check && 'true' || 'false' }}

      - uses: ljharb/actions/bun/install@main
        if: ${{ inputs.subpackage != '' }}
        name: 'bun install, subpackage: ${{ inputs.subpackage }}'
        with:
          nvm-dir: "${{ env.NVM_DIR }}"
          before_install: cd ${{ inputs.subpackage }}
          cache-node-modules-key: bun-node_modules-${{ inputs.subpackage }}-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
          skip-ls-check: ${{ inputs.skip-ls-check && 'true' || 'false' }}

      - run: echo "PACKAGE_JSON=$(jq -c . < package.json)" >> $GITHUB_ENV

      - name: 'restore build output'
        uses: actions/cache/restore@v4
        with:
          path: ${{ inputs.build-output-dir }}
          key: build-output-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
        if: ${{ inputs.build-command != '' && inputs.build-output-dir != '' }}

      - if: ${{ startsWith(fromJson(env.PACKAGE_JSON).name, '@') && startsWith(matrix.node-version, '0.') && ! startsWith(matrix.node-version, '0.1') }}
        run: eval $(node -e 'console.log(require("./package.json").scripts["${{ inputs.command }}".slice(8)])')
        env:
          PATH: "./node_modules/.bin/:${{ env.PATH }}"
      - run: ${{ inputs.command }}
        if: ${{ ! startsWith(fromJson(env.PACKAGE_JSON).name, '@') || ! startsWith(matrix.node-version, '0') || startsWith(matrix.node-version, '0.1') }}

      - uses: codecov/codecov-action@v3.1.5
        if: ${{ inputs.coverage == 'codecov' }}
      - uses: coverallsapp/github-action@v2
        if: ${{ inputs.coverage == 'coveralls' }}
        with:
          parallel: true
          flag-name: run ${{ join(matrix.*, ' - ') }}

  latest:
    needs: [build, matrix]
    name: 'latest'
    runs-on: ubuntu-22.04
    continue-on-error: ${{ inputs.continue-on-error }}
    timeout-minutes: ${{ inputs.timeout-minutes }}

    strategy:
      fail-fast: false
      matrix:
        node-version: ${{ fromJson(needs.matrix.outputs.latest) }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            raw.githubusercontent.com:443
            nodejs.org:443
            iojs.org:443
            registry.npmjs.org:443
            actions-results-receiver-production.githubapp.com:443

      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          show-progress: false

      - uses: ljharb/actions/node/install@main
        name: 'nvm install ${{ matrix.node-version }} && npm install'
        with:
          node-version: ${{ matrix.node-version }}
          cache-node-modules-key: node_modules-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
          skip-ls-check: ${{ inputs.skip-ls-check || startsWith(matrix.node-version, '0') && 'true' || 'false' }}
          after_install: ${{ inputs.after_install }}

      - run: echo "NVM_DIR=${NVM_DIR}" >> $GITHUB_ENV
      - uses: ljharb/actions/npm/install@main
        if: ${{ inputs.subpackage != '' }}
        name: 'npm install, subpackage: ${{ inputs.subpackage }}'
        with:
          nvm-dir: "${{ env.NVM_DIR }}"
          before_install: cd ${{ inputs.subpackage }}
          cache-node-modules-key: node_modules-${{ inputs.subpackage }}-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
          skip-ls-check: ${{ inputs.skip-ls-check || startsWith(matrix.node-version, '0') && 'true' || 'false' }}

      - run: echo "PACKAGE_JSON=$(jq -c . < package.json)" >> $GITHUB_ENV

      - name: 'restore build output'
        uses: actions/cache/restore@v4
        with:
          path: ${{ inputs.build-output-dir }}
          key: build-output-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
        if: ${{ inputs.build-command != '' && inputs.build-output-dir != '' }}

      - if: ${{ startsWith(fromJson(env.PACKAGE_JSON).name, '@') && startsWith(matrix.node-version, '0.') && ! startsWith(matrix.node-version, '0.1') }}
        run: eval $(node -e 'console.log(require("./package.json").scripts["${{ inputs.command }}".slice(8)])')
        env:
          PATH: "./node_modules/.bin/:${{ env.PATH }}"
      - run: ${{ inputs.command }}
        if: ${{ ! startsWith(fromJson(env.PACKAGE_JSON).name, '@') || ! startsWith(matrix.node-version, '0') || startsWith(matrix.node-version, '0.1') }}

      - uses: codecov/codecov-action@v3.1.5
        if: ${{ inputs.coverage == 'codecov' }}
      - uses: coverallsapp/github-action@v2
        if: ${{ inputs.coverage == 'coveralls' }}
        with:
          parallel: true
          flag-name: run ${{ join(matrix.*, ' - ') }}

  nonlatest:
    needs: [build, matrix, latest]
    name: 'non-latest'
    timeout-minutes: ${{ inputs.timeout-minutes }}
    if: ${{ needs.matrix.outputs.nonlatest != '[]' && (!github.head_ref || !startsWith(github.head_ref, 'renovate')) }}
    runs-on: ubuntu-22.04

    strategy:
      fail-fast: false
      matrix:
        node-version: ${{ fromJson(needs.matrix.outputs.nonlatest) }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            raw.githubusercontent.com:443
            nodejs.org:443
            iojs.org:443
            registry.npmjs.org:443
            actions-results-receiver-production.githubapp.com:443

      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          show-progress: false
      - uses: ljharb/actions/node/install@main
        name: 'nvm install ${{ matrix.node-version }} && npm install'
        with:
          node-version: ${{ matrix.node-version }}
          cache-node-modules-key: node_modules-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
          skip-ls-check: true
          after_install: ${{ inputs.after_install }}

      - run: echo "NVM_DIR=${NVM_DIR}" >> $GITHUB_ENV
      - uses: ljharb/actions/npm/install@main
        if: ${{ inputs.subpackage != '' }}
        name: 'npm install, subpackage: ${{ inputs.subpackage }}'
        with:
          node-version: ${{ matrix.node-version }}
          nvm-dir: "${{ env.NVM_DIR }}"
          before_install: cd ${{ inputs.subpackage }}
          cache-node-modules-key: node_modules-${{ inputs.subpackage }}-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
          skip-ls-check: ${{ inputs.skip-ls-check || startsWith(matrix.node-version, '0') && 'true' || 'false' }}

      - run: echo "PACKAGE_JSON=$(jq -c . < package.json)" >> $GITHUB_ENV

      - name: 'restore build output'
        uses: actions/cache/restore@v4
        with:
          path: ${{ inputs.build-output-dir }}
          key: build-output-${{ github.workflow }}-${{ github.action }}-${{ github.run_id }}
        if: ${{ inputs.build-command != '' && inputs.build-output-dir != '' }}

      - if: ${{ startsWith(fromJson(env.PACKAGE_JSON).name, '@') && startsWith(matrix.node-version, '0.') && ! startsWith(matrix.node-version, '0.1') }}
        run: eval $(node -e 'console.log(require("./package.json").scripts["${{ inputs.command }}".slice(8)])')
        env:
          PATH: "./node_modules/.bin/:${{ env.PATH }}"
        continue-on-error: true
      - run: ${{ inputs.command }}
        if: ${{ ! startsWith(fromJson(env.PACKAGE_JSON).name, '@') || ! startsWith(matrix.node-version, '0') || startsWith(matrix.node-version, '0.1') }}
        continue-on-error: true

  node:
    name: node tests
    needs: [latest, nonlatest, vlt-latest, bun-latest]
    if: ${{ ! cancelled() }}
    runs-on: ubuntu-22.04
    steps:
      - name: fail if previous jobs failed
        if: ${{ contains(needs.*.result, 'failure') }}
        run: exit 1
      - name: Harden Runner
        if: ${{ inputs.coverage == 'coveralls' }}
        uses: step-security/harden-runner@v2
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
            raw.githubusercontent.com:443
            nodejs.org:443
            iojs.org:443
            registry.npmjs.org:443
            actions-results-receiver-production.githubapp.com:443

      - uses: coverallsapp/github-action@v2
        if: ${{ inputs.coverage == 'coveralls' }}
        with:
          parallel-finished: true
      - run: true