authentik/.github/workflows/ci-docs.yml

---
name: CI - Docs

on:
  push:
    branches:
      - main
      - next
      - version-*
  pull_request:
    branches:
      - main
      - version-*

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: "${{ !startsWith(github.ref, 'refs/heads/version-') && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/next' }}"

jobs:
  lint:
    runs-on: ubuntu-latest
    env:
      NODE_ENV: production
    strategy:
      fail-fast: false
      matrix:
        command:
          - prettier-check
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Pin pnpm store directory
        run: |
          echo "PNPM_HOME=${RUNNER_TEMP}/pnpm-home" >> "$GITHUB_ENV"
          echo "npm_config_store_dir=${RUNNER_TEMP}/pnpm-home/store" >> "$GITHUB_ENV"
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
        with:
          node-version-file: package.json
          cache: pnpm
          cache-dependency-path: |
            pnpm-lock.yaml
            website/pnpm-lock.yaml
      - name: Install dependencies
        run: |
          pnpm install --frozen-lockfile
          pnpm --dir website install --frozen-lockfile
      - name: Lint
        run: pnpm --dir website run ${{ matrix.command }}
  build-docs:
    runs-on: ubuntu-latest
    env:
      NODE_ENV: production
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Pin pnpm store directory
        run: |
          echo "PNPM_HOME=${RUNNER_TEMP}/pnpm-home" >> "$GITHUB_ENV"
          echo "npm_config_store_dir=${RUNNER_TEMP}/pnpm-home/store" >> "$GITHUB_ENV"
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
        name: Setup Node.js
        with:
          node-version-file: package.json
          cache: pnpm
          cache-dependency-path: |
            pnpm-lock.yaml
            website/pnpm-lock.yaml
      - name: Install dependencies
        run: |
          pnpm install --frozen-lockfile
          pnpm --dir website install --frozen-lockfile
      - name: Build Documentation via Docusaurus
        run: pnpm --dir website run build
  build-integrations:
    runs-on: ubuntu-latest
    env:
      NODE_ENV: production
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Pin pnpm store directory
        run: |
          echo "PNPM_HOME=${RUNNER_TEMP}/pnpm-home" >> "$GITHUB_ENV"
          echo "npm_config_store_dir=${RUNNER_TEMP}/pnpm-home/store" >> "$GITHUB_ENV"
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
        with:
          node-version-file: package.json
          cache: pnpm
          cache-dependency-path: |
            pnpm-lock.yaml
            website/pnpm-lock.yaml
      - name: Install dependencies
        run: |
          pnpm install --frozen-lockfile
          pnpm --dir website install --frozen-lockfile
      - name: Build Integrations via Docusaurus
        run: pnpm --dir website run build:integrations
  build-container:
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload container images to ghcr.io
      packages: write
      # Needed for attestation
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
      - id: compute-tags
        uses: ./.github/actions/compute-container-tags
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      - name: Login to Container Registry
        if: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build Docker Image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          file: website/Dockerfile
          context: .
          platforms: linux/amd64,linux/arm64
          cache-from: type=registry,ref=ghcr.io/goauthentik/dev-docs:buildcache
          cache-to: "${{ (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) && 'type=registry,ref=ghcr.io/goauthentik/dev-docs:buildcache,mode=max' || '' }}"
          push: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}"
          tags: |
            ghcr.io/goauthentik/dev-docs:gh-${{ steps.compute-tags.outputs.tag-full }}
            ghcr.io/goauthentik/dev-docs:gh-${{ steps.compute-tags.outputs.tag-branch }}
            ghcr.io/goauthentik/dev-docs:gh-${{ steps.compute-tags.outputs.tag-flux }}
  ci-website-mark:
    if: always()
    needs:
      - lint
      - build-docs
      - build-integrations
      - build-container
    runs-on: ubuntu-latest
    steps:
      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # release/v1
        with:
          jobs: ${{ toJSON(needs) }}