Build.yml

# Display Name of the workflow
name: Build - GH Packages and Artifacts

# Event listeners for when the job should start execution
on:
    # Triggers the workflow on push or pull request events to the main branch
    push:
        branches: [main]

    # Allow this workflow to be called from another workflow
    workflow_call:
        inputs:
            correlationId:
                description: 'Correlates the origin job with the child instance since process start does not return an ID.'
                type: string
                required: false

jobs:
    # Generate the TypeScript SDK client code
    TypeScript-Build:
        # Generate each SDK client in a separate build process to speed up execution and publishing
        strategy:
            matrix:
                # Spec and SDK root locations
                specifications:
                    - name: SHIELD
                      sdkPath: 'src/shield/TypeScript'
                      specPath: 'spec/SHIELD.json'
                    - name: DataGateway
                      sdkPath: 'src/dataGateway/TypeScript'
                      specPath: 'spec/Data-Gateway.json'
                    - name: UrlShortener
                      sdkPath: 'src/urlShortener/TypeScript'
                      specPath: 'spec/Url-Shortener.json'

        # Display name of the job
        name: Generate NPM Packages

        # Operating system filter for the runners
        runs-on: ubuntu-latest

        # Allow single failures for SDK publish, e.g. SDG fail due to not getting an update but SHIELD goes through
        continue-on-error: true

        # Sets the scopes available to the github_token injected to the GH Actions runner
        permissions:
            attestations: write
            contents: read
            id-token: write
            packages: write

        # Set of steps required to generate the API client for TypeScript
        steps:
            # Download all of the source code
            - name: Clone Repo Locally
              uses: actions/checkout@v7
              background: true

            # Set up NodeJS on the build host
            - name: Setup Node.JS Runtime
              uses: actions/setup-node@v6
              background: true
              with:
                  node-version: 24
                  registry-url: https://npm.pkg.github.com
                  scope: software-hardware-integration-lab

            # Set up the socket firewall binary
            - name: Install - Socket Firewall
              uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f
              background: true
              with:
                  mode: firewall-free

            # Set up all of the supporting components for SDK generation
            - name: Initialize Kiota Binaries
              uses: microsoft/setup-kiota@v0.6.0
              background: true

            # Bring job back to sync execution by awaiting for all async jobs to finish before continuing
            - name: Steps - Convert Back To Synchronous Execution - Build
              wait-all: true

            # Extract the project version from the package.json
            - name: Extract Project Version
              id: computedVersion
              background: true
              working-directory: ${{ matrix.specifications.sdkPath }}
              run: echo "version=$(npm pkg get version --workspaces=false | tr -d \")" >> "$GITHUB_OUTPUT"

            # Set the experimental tag to indicate if it is an Alpha or Beta build
            - name: Compute Channel
              id: computedChannel
              background: true
              run: |
                  if [ "${{ github.event_name }}" = "release" ] && [ "${{ github.event.release.prerelease }}" = "true" ]; then
                    echo "channel=beta" >> "$GITHUB_OUTPUT"
                  elif [ "${{ github.event_name }}" = "release" ]; then
                    echo "channel=stable" >> "$GITHUB_OUTPUT"
                  else
                    echo "channel=alpha" >> "$GITHUB_OUTPUT"
                  fi

            # Get the first 7 chars of the SHA hash that represents the current commit that the build is operating off of.
            - name: Compute Short SHA - Experimental Channel
              id: shortSha
              background: true
              run: echo "shortSha=$(echo ${{ github.sha }} | head -c 7)" >> "$GITHUB_OUTPUT"

            # Bring job back to sync execution by awaiting for all async jobs to finish before continuing
            - name: Steps - Convert Back To Synchronous Execution - Metadata
              wait-all: true

            # Update the NPM CLI to the latest available version
            - name: Update NPM CLI
              run: sfw npm install -g npm

            # Install the dependencies needed to build the project
            - name: Install Build Dependencies
              run: sfw npm ci
              working-directory: ${{ matrix.specifications.sdkPath }}

            # Cryptographically attest that packages haven't been tampered where supported
            - name: Attest Dependency Provenance
              run: npm audit signatures
              working-directory: ${{ matrix.specifications.sdkPath }}

            # Generate the TypeScript SDK
            - name: Generate SDK Client Code via Kiota
              run: npm run generate:Sdk
              working-directory: ${{ matrix.specifications.sdkPath }}

            # Generate the TypeScript SDK
            - name: Build Project
              run: npm run build:Prod
              working-directory: ${{ matrix.specifications.sdkPath }}

            # Update the version of SHIELD being uploaded to have a different version number to avoid SDG version conflict
            - name: Tattoo Version - Experimental Channel
              if: ${{ steps.computedChannel.outputs.channel != 'stable' }}
              working-directory: ${{ matrix.specifications.sdkPath }}
              run: npm version --no-commit-hooks --no-git-tag-version "${{ steps.computedVersion.outputs.version }}-${{ steps.computedChannel.outputs.channel }}.${{ steps.shortSha.outputs.shortSha }}"

            # Publish the artifact to NPM with attestation
            - name: Upload Package to NPM Registry
              working-directory: ${{ matrix.specifications.sdkPath }}
              env:
                  NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
              run: npm publish --tag ${{ steps.computedChannel.outputs.channel }}

            # Generate the NPM package for beta and stable publishing, if required
            - name: Generate NPM Package
              id: generate-package
              working-directory: ${{ matrix.specifications.sdkPath }}
              run: echo "package-file=$(npm pack --ignore-scripts)" >> "$GITHUB_OUTPUT"

            # Create an attestation for the generated NPM package to ensure integrity and authenticity
            - name: Attest NPM Package
              uses: actions/attest@v4
              with:
                  subject-path: ${{ format('{0}/{1}', matrix.specifications.sdkPath, steps.generate-package.outputs.package-file) }}

            # Upload the compiled HTML as an artifact for future consumption
            - name: Upload a Build Artifact
              uses: actions/upload-artifact@v7
              with:
                  name: ${{ matrix.specifications.name }}
                  if-no-files-found: error
                  path: ${{ matrix.specifications.sdkPath }}/${{ steps.generate-package.outputs.package-file }}