update and refactor

.github/workflows/build.yml → .github/workflows/build-artifacts.yml

@@ -1,4 +1,4 @@
-name: Build
+name: Build Artifacts
 
 on:
   workflow_call:
@@ -22,62 +22,55 @@ jobs:
       chrome-extension-id: ${{ steps.get-chrome-id.outputs.extension-id }}
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "22"
 
-      - name: Corepack enable
-        run: corepack enable
+      - run: corepack enable
 
-      - name: Install dependencies
+      # Extension has its own lockfile and package manager — install separately
+      - name: Install extension dependencies
         working-directory: ./extension
         run: yarn install --immutable
 
       - name: Build Chrome extension (development)
         if: ${{ !inputs.release-mode }}
         working-directory: ./extension
-        run: yarn run build
+        run: yarn build
 
       - name: Build Firefox extension (development)
         if: ${{ !inputs.release-mode }}
         working-directory: ./extension
-        run: yarn run build:firefox
+        run: yarn build:firefox
 
-      - name: Zip Chrome extension (release mode)
+      - name: Zip Chrome extension (release)
         if: ${{ inputs.release-mode }}
         working-directory: ./extension
-        run: yarn run zip
+        run: yarn zip
 
-      - name: Zip Firefox extension (release mode)
+      - name: Zip Firefox extension (release)
         if: ${{ inputs.release-mode }}
         working-directory: ./extension
-        run: yarn run zip:firefox
+        run: yarn zip:firefox
 
       - name: Get Chrome extension ID
         id: get-chrome-id
         working-directory: ./extension
         run: |
-          # Read the extension key from manifest.json and compute the ID
-          # Chrome extension ID is derived from the "key" field in manifest.json
           MANIFEST_PATH=".output/chrome-mv3/manifest.json"
           if [ -f "$MANIFEST_PATH" ]; then
-            # Extract the key and compute the extension ID
             KEY=$(jq -r '.key // empty' "$MANIFEST_PATH")
             if [ -n "$KEY" ]; then
               # Decode base64 key, hash with SHA256, take first 32 chars, map to a-p
               EXTENSION_ID=$(echo -n "$KEY" | base64 -d | sha256sum | head -c 32 | tr '0-9a-f' 'a-p')
               echo "extension-id=$EXTENSION_ID" >> $GITHUB_OUTPUT
               echo "Chrome extension ID: $EXTENSION_ID"
             else
-              echo "No key found in manifest, extension ID will be empty"
               echo "extension-id=" >> $GITHUB_OUTPUT
             fi
           else
-            echo "Manifest not found at $MANIFEST_PATH"
             echo "extension-id=" >> $GITHUB_OUTPUT
           fi
 
@@ -114,7 +107,7 @@ jobs:
           retention-days: ${{ inputs.retention-days }}
 
   build-electron:
-    name: Build Electron App
+    name: Build Electron App (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     needs: build-extension
 
@@ -123,25 +116,22 @@ jobs:
         os: [ubuntu-latest, macos-latest]
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "22"
 
-      - name: Corepack enable
-        run: corepack enable
+      - run: corepack enable
 
+      # Install from root so the shared workspace package is available to the app
       - name: Install dependencies
-        working-directory: ./app
         run: yarn install --immutable
 
       - name: Build Electron app (development)
         if: ${{ !inputs.release-mode }}
         working-directory: ./app
-        run: yarn run package
+        run: yarn package
         env:
           NODE_ENV: production
           NODE_OPTIONS: --max-old-space-size=4096
@@ -151,7 +141,7 @@ jobs:
       - name: Build Electron app (release)
         if: ${{ inputs.release-mode }}
         working-directory: ./app
-        run: yarn run make
+        run: yarn make
         env:
           NODE_ENV: production
           NODE_OPTIONS: --max-old-space-size=4096
@@ -171,6 +161,5 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: electron-release-${{ matrix.os }}
-          path: |
-            app/out/make/**/*
+          path: app/out/make/**/*
           retention-days: ${{ inputs.retention-days }}

.github/workflows/ci.yml

@@ -1,18 +1,66 @@
-name: CI Build
+name: CI
 
 on:
+  push:
+    branches:
+      - main
+      - next
   pull_request:
     branches:
       - main
       - next
-  push:
+  pull_request_target:
     branches:
       - main
       - next
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
 
 jobs:
+  lint:
+    name: Lint & Typecheck
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - run: corepack enable
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Lint
+        run: yarn lint
+
+      - name: Typecheck
+        run: yarn typecheck
+
   build:
-    uses: ./.github/workflows/build.yml
+    name: Build Artifacts
+    needs: lint
+    uses: ./.github/workflows/build-artifacts.yml
     with:
       release-mode: false
       retention-days: 7
+
+  deploy-web:
+    name: Deploy Web Wallet
+    needs: lint
+    uses: ./.github/workflows/deploy-web.yml
+    with:
+      production: false
+      ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      pr-number: ${{ github.event.pull_request.number || 0 }}
+    secrets:
+      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+      VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}

.github/workflows/deploy-web.yml

@@ -1,54 +1,66 @@
-name: Deploy Web Wallet to Vercel
+name: Deploy Web Wallet
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-      - next
-  workflow_dispatch:
+  workflow_call:
+    inputs:
+      production:
+        description: "Deploy to production (true) or preview (false)"
+        required: false
+        type: boolean
+        default: false
+      ref:
+        description: "Git ref to check out"
+        required: false
+        type: string
+        default: ""
+      pr-number:
+        description: "PR number to comment on (omit to skip comment)"
+        required: false
+        type: number
+        default: 0
+    secrets:
+      VERCEL_TOKEN:
+        required: true
+      VERCEL_ORG_ID:
+        required: true
+      VERCEL_PROJECT_ID:
+        required: true
 
 env:
   VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
   VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
 
-permissions:
-  contents: read
-  pull-requests: write
-
 jobs:
-  deploy-web:
+  deploy:
+    name: ${{ inputs.production && 'Deploy (production)' || 'Deploy (preview)' }}
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: "22"
 
-      - name: Enable Corepack
-        run: corepack enable
+      - run: corepack enable
 
       - name: Install dependencies
         run: yarn install --immutable
 
       - name: Install Vercel CLI
         run: npm install --global vercel@latest
 
-      - name: Pull Vercel Environment Information
+      - name: Pull Vercel environment
         working-directory: ./web
         run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
 
-      - name: Build and deploy to Vercel
+      - name: Build and deploy
         id: deploy
         working-directory: ./web
         run: |
-          if [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref }}" == "refs/heads/main" ]; then
+          if [ "${{ inputs.production }}" == "true" ]; then
             vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
             DEPLOY_URL=$(vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }} --archive=tgz --yes)
           else
@@ -57,14 +69,14 @@ jobs:
           fi
           echo "url=$DEPLOY_URL" >> $GITHUB_OUTPUT
 
-      - name: Comment deployment URL on PR
-        if: github.event_name == 'pull_request'
+      - name: Comment preview URL on PR
+        if: ${{ inputs.pr-number != 0 }}
         uses: actions/github-script@v7
         with:
           script: |
             github.rest.issues.createComment({
-              issue_number: context.issue.number,
+              issue_number: ${{ inputs.pr-number }},
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: '🚀 Web wallet deployed to Vercel!\n\n**Preview URL:** ${{ steps.deploy.outputs.url }}'
+              body: '🚀 Web wallet deployed!\n\n**Preview URL:** ${{ steps.deploy.outputs.url }}'
             })

.github/workflows/release.yml

@@ -9,8 +9,32 @@ on:
         type: string
 
 jobs:
+  lint:
+    name: Lint & Typecheck
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - run: corepack enable
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Lint
+        run: yarn lint
+
+      - name: Typecheck
+        run: yarn typecheck
+
   build:
-    uses: ./.github/workflows/build.yml
+    name: Build Artifacts
+    needs: lint
+    uses: ./.github/workflows/build-artifacts.yml
     with:
       release-mode: true
       retention-days: 30
@@ -28,17 +52,24 @@ jobs:
         with:
           path: release-artifacts
 
-      - name: Display structure of downloaded files
-        run: ls -R release-artifacts
-
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ inputs.version }}
           name: Release ${{ inputs.version }}
           draft: true
           generate_release_notes: true
-          files: |
-            release-artifacts/**/*
+          files: release-artifacts/**/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  deploy-web:
+    name: Deploy Web Wallet
+    needs: build
+    uses: ./.github/workflows/deploy-web.yml
+    with:
+      production: true
+    secrets:
+      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+      VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}