javascript.yml

name: JavaScript

on:
  push:
    branches: [ main ]
    tags:
      - '*'
  pull_request:
    branches: [ main ]
  workflow_dispatch:

env:
  FORCE_COLOR: 3

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "26.3.1"

      - name: Install dependencies
        working-directory: js
        run: npm ci

      - name: Build WASM package
        working-directory: js
        run: npm run wasm

      - name: Rust -> WASM binding tests
        working-directory: js
        run: wasm-pack test --headless --chrome

      - name: Install Playwright browsers
        working-directory: js
        run: npx playwright install --with-deps chromium

      - name: Vitest API tests
        working-directory: js
        run: npm test

      - name: Playwright demo E2E
        working-directory: js
        run: npm run test:e2e

      - name: Packaged tarball smoke test
        working-directory: js
        run: npm run test:pack

  build:
    name: Build demo
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Build WASM
        run: |
          # Build WASM package
          cd js
          wasm-pack build --target web

          # Create build directory if not exists (first time)
          mkdir -p build

          # Copy demo files to build directory
          cp index.html index.js build/
          cp -r pkg build/pkg

      - name: Upload build artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wasm-build
          path: js/build

  deploy:
    name: Deploy demo to GitHub Pages
    if: github.ref == 'refs/heads/main'
    needs: [test, build]
    runs-on: ubuntu-latest
    permissions:
      pages: write  # publish the built demo to GitHub Pages
      id-token: write  # OIDC token for the Pages deployment
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - name: Download build artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: wasm-build
          path: dist

      - name: Setup Pages
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

      - name: Upload artifact
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: 'dist'

      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

  # Build the npm package in an unprivileged job and hand it to the publish job
  # as an artifact, so the Rust toolchain / wasm-pack install never run in a job
  # that holds the npm token (mirrors the PyPI pipeline in python.yml).
  build_npm:
    name: Build npm package
    needs: test
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Build WASM package
        working-directory: js
        run: wasm-pack build --target web

      - name: Upload npm package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-package
          path: js/pkg

  upload_npm:
    name: Publish to npm
    needs: [test, build_npm]
    runs-on: ubuntu-latest
    # Publish to npm only on a `v*` tag push, matching the gate used by the
    # PyPI (python.yml) and crates.io (rust.yml) pipelines.
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
      id-token: write  # npm provenance
    steps:
      - name: Download npm package artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: pkg

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "26.3.1"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false  # never use caching in release builds

      - name: Publish to npm
        run: npm publish ./pkg --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}