node-matrix-pnpm.yaml

name: Build and Test portable executable bundles

on:
  workflow_call:
    inputs:
      #
      # Common settings
      #
      app-name:
        description: |
          Application name in human-readable form.
          As it is supposed to be shown in messages
        type: string
        required: false
        default: ${{ github.repository }}

      app-name-slug:
        description: |
          Application name slug (part of release file name)
        type: string
        required: true

      #
      # Checkout settings
      #
      checkout-submodules:
        description: |
          'Submodules' mode for 'actions/checkout' action
          '', 'false' - disable submodules support
          'true' - checkout submodules
          'recursive' - checkout submodules recursive
        type: string
        required: false
        default: ""

      #
      # Changed files
      #

      changeset-default-branch:
        description:
          Specify the default branch for changesets to run checks against.
        type: string
        required: false
        default: 'main'

      main-metapackage-name:
        description:
          Specify the name of the main metapackage.
        type: string
        required: false
        default: ''

      #
      # Environment settings
      #
      env:
        description: |
          custom environment variables to set for all jobs in workflow
          as JSON-encoded map:
            { "MY_VAR_1": "awesome value",
              "VARIABLE_2": "not so awesome :)" }

          This input's envs are merged with secrets.env
          This input's envs have lower priority compared than secrets.env
        type: string
        required: false
        default: "{}"

      #
      # Node settings
      #
      node-version:
        description: |
          Node version to use
        type: string
        required: true
      #
      # Cache control
      #
      cache-version:
        description: |
          Simple hack, that allows to 'reset' cache for particular job.

          Just change the value of this parameter and the next run will
          not find build cache and will have to start from scratch.

        type: string
        required: false
        default: "v1"

      cache-hashfiles-search-path:
        description: |
          Hashfiles search path for pnpm-lock.yaml
        type: string
        required: false
        default: 'pnpm-lock.yaml'

      team-id:
        description: |
          The Team ID to use. This controls the directory where turbo cache entries will be saved
        type: string
        required: false
        default: 'ci'

      #
      # PNPM settings
      #
      pnpm-version:
        description: |
          Version of pnpm to install.
        type: string
        required: false
        default: 'latest'

      pnpm-recursive-build:
        description: |
          Run pnpm build with -r flag.
        type: boolean
        required: true

      pnpm-recursive-tests:
        description: |
          Run pnpm tests with -r flag.
        type: boolean
        required: true

      pnpm-build-args:
        description: |
          Additional pnpm build arguments to pass
          for none --recursive pnpm invocations.
        type: string
        required: false

      pnpm-tests-args:
        description: |
          Additional pnpm tests arguments to pass
          for none --recursive pnpm invocations.
        type: string
        required: false

      cache-paths:
        description: |
          Additional paths to be cached after build
        type: string
        required: false
        default: ""

      enable-ccache:
        description: |
          Enable ccache for the build
        type: boolean
        required: false
        default: true

      ccache-options:
        description: |
          Additional options to pass to ccache --set-config.
          One per line. Example:
            hash_dir=false
            max_size=10.0G
            sloppiness=time_macros,include_file_mtime,include_file_ctime
        type: string
        required: false
        default: ""

      #
      # Matrix control
      #
      pre-calculated-task-list:
        description: |
          JSON-formatted string listing of the specific subtasks that have been pre-calculated.
          This list is used to manage and track the execution of parallel builds in the monorepo.
          Example:
            [
              {"os":"windows-latest", "arch":"amd64", "selector":"@platforma-open/milaboratories.runenv-python-3.12.7"},
            ]
        type: string
        required: false
        default: '[]'

      #
      # Build control
      #
      build-script-name:
        description: |
          The name of a build script
        type: string
        required: true
        default: "build"
      #
      # Test control
      #
      test:
        description: |
          Run tests
        type: boolean
        required: false
        default: false

      test-script-name:
        description: |
          The name of a test
        type: string
        required: false
        default: 'test'

      #
      # NPM registry settings
      #
      npmrc-config:
        description: |
          Generates a .npmrc file based on provided configuration.
        type: string
        required: true

      #
      # Distribution control
      #
      publish-to-public:
        description: |
          Whether or not the npm package should be published as public.
        type: string
        required: false
        default: 'false'

      create-tag:
        description: |
          Create a tag after publishing the package.
        type: string
        required: false
        default: 'false'

      package-path:
        description: |
          Relative path to the package.json with package version.
        type: string
        required: false
        default: '.'

      aws-region:
        description: |
          The AWS region
        type: string
        required: false
        default: 'eu-central-1'

      aws-login-duration:
        description: |
          Maximum time AWS credentials will be valid until expiration.
          Defaults to 1 hour.
        type: number
        required: false
        default: 3600

      #
      # Codesign control
      #
      sign-binaries:
        description: |
          List of globbing patterns that match files to be signed after build step.
          When built, the selected files will be signed with methods appropriate for current operating system.
        type: string
        required: false
        default: ""

      notarize-paths:
        description: |
          List of globbing patterns that match files and directories to be notarized.
          Matched files would be notarized for releases.
        type: string
        required: false
        default: ""

      mac-sign-entitlements:
        description: |
          Additional entitlements to be embedded into binaries signature.
          The contents of <dict> tag inside .plist file, like:
            <key>com.apple.security.cs.disable-library-validation</key>
            <true/>

        type: string
        required: false
        default: ""

      gcp-sdk-version:
        description: |
          Version or version constraint of the gcloud SDK to install. If
          unspecified, it will accept any installed version of the gcloud SDK. If
          set to "latest", it will download the latest available SDK. If set to a
          version constraint, it will download the latest available version that
          matches the constraint. Examples: "290.0.1" or ">= 197.0.1".
        type: string
        required: false
        default: "latest"

      gcp-timestamping-mode:
        description: |
          Timestamping mode to use when working with certificates and signatures
          (i.e. when signing the code)
        type: string
        required: false

      # We do not put version into secrets because it has very short value.
      #  '1' in secrets may cause '1' to be replaced with '*' everywhere in github workflow logs
      gcp-kms-key-version:
        description: |
          Version of KMS key.
        type: string
        required: false
        default: "1"

      gcp-kms-digest-algorithm:
        description: |
          The algorithm to digest the input.
          Must be one of: sha256, sha384, sha512.
        type: string
        required: false
        default: "sha256"

      #
      # Docker settings
      #
      docker-quay-push:
        description: |
          Whether or not to push images to quay.io registry.
        type: boolean
        required: false
        default: true

      docker-ga-push:
        description: |
          Whether or not to push images to GA registry.
        type: boolean
        required: false
        default: true

      #
      # Notifications
      #
      notify-telegram:
        description: |
          Enable Telegram notifications
        required: false
        type: boolean
        default: true

      notify-build:
        description: |
          Enable notifications about build status (build ready/failed)
          Possible values are:
           - 'true' - send all notifications about build status (both success and failed)
           - 'failure-only' - send notification about failed builds, don't notify on success
           - 'success-only' - send notification about success builds, don't notify on failures
           - 'false' - don't send notifications about build results at all.
        required: false
        type: string
        default: "true"

      notify-tests:
        description: |
          Enable notifications about tests status (ready/failed)
          Possible values are:
           - 'true' - send all notifications about tests status (both success and failed)
           - 'failure-only' - send notification about failed tests, don't notify on success
           - 'success-only' - send notification about success tests, don't notify on failures
           - 'false' - don't send notifications about tests results at all.
        required: false
        type: string
        default: "true"

    secrets:
      env:
        description: |
          custom environment variables to set for all jobs in workflow
          as JSON-encoded map:
            { "MY_VAR_1": "awesome value",
              "VARIABLE_2": "not so awesome :)" }

          This input's envs are merged with inputs.env
          This input's envs have HIGHER priority compared than inputs.env
        required: false

      TELEGRAM_NOTIFICATION_TARGET:
        description: |
          ID of Telegram Channel or User to notify on build results.
        required: false

      TELEGRAM_API_TOKEN:
        description: |
          Telegram Bot API authorization token
        required: false

      MAC_SIGN_CERT_ID:
        description: |
          The Apple's certificate id. e.g: '5MXXYYZZFF'
        required: false
      MAC_SIGN_CERT:
        description: |
          base64-encoded p12 signing certificate file for the macOS
          (more info here https://www.electron.build/code-signing)
        required: false
      MAC_SIGN_CERT_PWD:
        description: |
          password to decrypt the p12 signing certificate for the macOS
        required: false

      MAC_NOTR_API_KEY:
        description: |
          base64-encoded content of an API key file
        required: false
      MAC_NOTR_API_KEY_ID:
        description: |
          Key ID found on App Store Connect for the API key file
        required: false
      MAC_NOTR_API_KEY_ISSUER_ID:
        description: |
          Issuer ID found on App Store Connect for the API key file
        required: false

      WIN_SIGN_CERT:
        description: |
          Unused: Windows binaries are signed with Azure Trusted Signing.
          Kept so existing callers that still pass it do not fail.
        required: false
      WIN_SIGN_CERT_PWD:
        description: |
          Unused: Windows binaries are signed with Azure Trusted Signing.
          Kept so existing callers that still pass it do not fail.
        required: false

      GCP_TIMESTAMPING_URL:
        description: |
          Timestamping URL of certificate issuer.
        required: false
      GCP_KMS_WORKLOAD_IDENTITY_PROVIDER:
        description: |
          Tha name of the GCP workload identity federation provider.
        required: false
      GCP_KMS_SERVICE_ACCOUNT:
        description: |
          The name of the GCP service account
        required: false
      GCP_KMS_LOCATION:
        description: |
          KMS key and keyring location
        required: false
      GCP_KMS_KEYRING:
        description: |
          KMS keyring name in Google Cloud Platform.
        required: false
      GCP_KMS_KEY_NAME:
        description: |
          KMS key name in Google Cloud Platform.
        required: false

      GH_ZEN_APP_ID:
        description: |
          Zen Artisian Github AppID
        required: false
      GH_ZEN_APP_PRIVATE_KEY:
        description: |
          Zen Artisian Github App PrivateKey
        required: false

jobs:
  init:
    name: Init
    runs-on: ubuntu-latest
    steps:
      - id: context
        uses: milaboratory/github-ci/actions/context@v4
    outputs:
      is-release: ${{ steps.context.outputs.is-release }}
      current-version: ${{ steps.context.outputs.current-version }}

  metadata:
    name: get run metadata
    runs-on: ubuntu-latest
    needs:
      - init
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: ${{ inputs.checkout-submodules }}

      - id: npm-pkg-metadata
        uses: milaboratory/github-ci/actions/shell@v4
        env:
          PACKAGE_PATH: ${{ inputs.package-path }}
        with:
          run: |
            NPM_PKG_VERSION="$(cat "${GITHUB_WORKSPACE}/${PACKAGE_PATH}/package.json" | jq --raw-output '.version')"
            PNPM_VERSION="$(cat "${GITHUB_WORKSPACE}/package.json" | jq --raw-output 'if .packageManager and (.packageManager | length > 0) then .packageManager | split("@")[1] else empty end')"
            ghwa_set_output npm-pkg-version "${NPM_PKG_VERSION}"
            ghwa_set_output pnpm-version "${PNPM_VERSION}"

    outputs:
      npm-pkg-version: ${{ fromJSON(steps.npm-pkg-metadata.outputs.data).npm-pkg-version }}
      pnpm-version: ${{ fromJSON(steps.npm-pkg-metadata.outputs.data).pnpm-version }}

  check-changesets:
    name: check for changesets
    runs-on: ubuntu-latest
    needs:
      - metadata
    if: github.ref_name == 'main' || github.event_name == 'merge_group'
    steps:
      - id: context
        uses: milaboratory/github-ci/actions/context@v4

      - uses: milaboratory/github-ci/actions/env@v4
        with:
          inputs: ${{ inputs.env }}
          secrets: ${{ secrets.env }}

      - uses: actions/checkout@v4
        with:
          submodules: ${{ inputs.checkout-submodules }}
          fetch-depth: '0'

      - name: Prepare environment for building a NodeJS application
        uses: milaboratory/github-ci/actions/node/prepare-pnpm@v4
        env:
          PNPM_VERSION: ${{ needs.metadata.outputs.pnpm-version }}
        with:
          node-version: ${{ inputs.node-version }}
          cache-version: ${{ inputs.cache-version }}
          pnpm-version: ${{ env.PNPM_VERSION || inputs.pnpm-version }}
          cache-hashfiles-search-path: ${{ inputs.cache-hashfiles-search-path }}
          npmrc-config: ${{ inputs.npmrc-config }}

      - name: Install NodeJS packages with pnpm
        uses: milaboratory/github-ci/actions/shell@v4
        with:
          run: |
            pnpm install --frozen-lockfile --prefer-offline

      - name: Check for Changesets
        uses: milaboratory/github-ci/actions/shell@v4
        env:
          BRANCH_NAME: ${{ inputs.changeset-default-branch }}
        with:
          run: |
            pnpm changeset status --since="origin/${BRANCH_NAME}"

  pre-calculated-build:
    name: prebuild
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.pre-calculated-task-list) }}
    needs:
      - check-changesets
      - metadata
    if: >
      !failure() && !cancelled() &&
      (
        needs.check-changesets.result == 'success' ||
        needs.check-changesets.result == 'skipped'
      )
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: milaboratory/github-ci/actions/env@v4
        with:
          inputs: ${{ inputs.env }}
          secrets: ${{ secrets.env }}

      - name: Generate Zen Artisan Token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.GH_ZEN_APP_ID }}
          private-key: ${{ secrets.GH_ZEN_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          submodules: ${{ inputs.checkout-submodules }}
          token: ${{ steps.app-token.outputs.token }}

      - name: Install system build tools on Linux
        if: runner.os == 'Linux'
        uses: milaboratory/github-ci/actions/shell@v4
        with:
          dump-stdout: false
          run: |
            sudo apt-get update
            sudo apt-get install -y build-essential gfortran libopenblas-dev liblapack-dev cmake pkg-config

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.AWS_CI_IAM_MONOREPO_SIMPLE_ROLE }}
          role-duration-seconds: ${{ inputs.aws-login-duration }}
          aws-region: ${{ inputs.aws-region }}

      - name: Login to Quay.io
        if: inputs.docker-quay-push && runner.os == 'Linux'
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ env.QUAY_USERNAME }}
          password: ${{ env.QUAY_ROBOT_TOKEN }}

      - name: Login to Docker GA
        if: inputs.docker-ga-push && runner.os == 'Linux'
        uses: docker/login-action@v3
        with:
          registry: containers.pl-open.science
          username: ${{ env.QUAY_USERNAME }}
          password: ${{ env.QUAY_ROBOT_TOKEN }}

      - uses: milaboratory/github-ci/actions/turborepo/cache-s3@v4
        with:
          storage-provider: 's3'
          storage-path: ${{ env.AWS_CI_TURBOREPO_S3_BUCKET }}
          team-id: ${{ inputs.team-id }}

      - name: Install pipx on Linux
        shell: bash
        if: runner.os == 'Linux'
        run: |
          echo "$HOME/.local/bin" >> $GITHUB_PATH

          if command -v pipx > /dev/null; then
            echo "pipx is already installed"
            python3 -m pipx ensurepath
            exit 0
          fi

          python3 -m pip install --user pipx
          python3 -m pipx ensurepath

      - name: Install pipx on macOS
        shell: bash
        if: runner.os == 'macOS'
        run: |
          echo "$HOME/.local/bin" >> $GITHUB_PATH

          if command -v pipx > /dev/null; then
            echo "pipx is already installed"
            pipx ensurepath
            exit 0
          fi

          brew install pipx
          pipx ensurepath

      # Activate vcvars on Windows runners so any subsequent step that
      # builds a C / C++ extension from source (e.g. `pip wheel` against
      # a setuptools/distutils sdist) finds `cl.exe` and the SDK headers.
      # The action also sets `DISTUTILS_USE_SDK=1`, which tells
      # setuptools' MSVC compiler shim to skip its own VS lookup. No-op
      # on non-Windows runners.
      - name: Setup MSVC Dev Cmd
        if: runner.os == 'Windows'
        uses: milaboratory/github-ci/actions/setup-msvc-dev-cmd@v4
        with:
          arch: ${{ matrix.arch == 'arm64' && 'arm64' || 'amd64' }}

      - name: Configure ccache
        if: inputs.enable-ccache
        uses: milaboratory/github-ci/actions/ccache@v4
        with:
          options: ${{ inputs.ccache-options }}

      - name: Cache additional paths
        uses: actions/cache@v4
        if: inputs.cache-paths != ''
        with:
          path: ${{ inputs.cache-paths }}
          key: ${{ runner.os }}-${{ runner.arch }}-cache-additional-${{ inputs.cache-version }}

      - name: Prepare environment for building a NodeJS application
        uses: milaboratory/github-ci/actions/node/prepare-pnpm@v4
        env:
          PNPM_VERSION: ${{ needs.metadata.outputs.pnpm-version }}
        with:
          node-version: ${{ inputs.node-version }}
          cache-version: ${{ inputs.cache-version }}
          pnpm-version: ${{ env.PNPM_VERSION || inputs.pnpm-version }}
          cache-hashfiles-search-path: ${{ inputs.cache-hashfiles-search-path }}
          npmrc-config: ${{ inputs.npmrc-config }}

      - name: Install NodeJS packages with pnpm
        uses: milaboratory/github-ci/actions/shell@v4
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN  }}
        with:
          dump-stdout: false
          run: |
            pnpm install --frozen-lockfile --prefer-offline

      - name: Run build for - ${{ matrix.selector }}
        shell: bash
        env:
          PRE_CALCULATED_STEP: ${{ matrix.selector }}
        run: |
          pnpm run build --filter="${PRE_CALCULATED_STEP}"

      - name: CodeSign binary on macOS
        uses: milaboratory/github-ci/blocks/signing-tools/macos-sign@v4
        if: runner.os == 'macOS'
          && inputs.sign-binaries != ''
        with:
          binaries: ${{ inputs.sign-binaries }}
          entitlements: ${{ inputs.mac-sign-entitlements }}
          mac-cert-id: ${{ secrets.MAC_SIGN_CERT_ID }}
          mac-cert-base64: ${{ secrets.MAC_SIGN_CERT }}
          mac-cert-passwd: ${{ secrets.MAC_SIGN_CERT_PWD }}

      - name: Notarize binary on macOS
        uses: milaboratory/github-ci/blocks/signing-tools/macos-notarize@v4
        if: runner.os == 'macOS'
          && inputs.sign-binaries != ''
        with:
          paths: ${{ inputs.notarize-paths }}
          mac-api-key-base64: ${{ secrets.MAC_NOTR_API_KEY }}
          mac-api-key-id: ${{ secrets.MAC_NOTR_API_KEY_ID }}
          mac-api-key-issuer-id: ${{ secrets.MAC_NOTR_API_KEY_ISSUER_ID }}

      - name: CodeSign binary on Windows
        if: runner.os == 'Windows'
          && inputs.sign-binaries != ''
        uses: milaboratory/github-ci/blocks/signing-tools/windows-sign@v4
        with:
          binaries: ${{ inputs.sign-binaries }}

      - name: Run after-prebuild for - ${{ matrix.selector }}
        id: after-prebuild
        shell: bash
        env:
          PRE_CALCULATED_STEP: ${{ matrix.selector }}
        run: |
          pnpm run --if-present after-prebuild --filter="${PRE_CALCULATED_STEP}"

      - name: Generate archive name
        id: archive-name
        shell: bash
        env:
          M_SELECTOR: ${{ matrix.selector }}
          M_OS: ${{ matrix.os }}
          M_ARCH: ${{ matrix.arch }}
        run: |
          M_SELECTOR=$(echo "${M_SELECTOR}" | tr \''/.!@#$%^&*(){}[]<>:;"' '_') # cut special symbols from file name
          echo "name=prebuild-results-${M_OS}-${M_ARCH}-${M_SELECTOR}" # report resulting artifact name
          echo "name=prebuild-results-${M_OS}-${M_ARCH}-${M_SELECTOR}" >> $GITHUB_OUTPUT

      - name: Save prebuild results for transfer to final build
        uses: milaboratory/github-ci/actions/artifact/save@v4
        with:
          name: ${{ steps.archive-name.outputs.name }}
          path: '*/dist/'

  build-publish:
    name: unified (build publish)
    runs-on: ubuntu-latest
    needs:
      - check-changesets
      - metadata
      - pre-calculated-build
    permissions:
      id-token: write
      packages: write
      contents: write
      pull-requests: write
      issues: read
    steps:
      - id: context
        uses: milaboratory/github-ci/actions/context@v4

      - uses: milaboratory/github-ci/actions/env@v4
        with:
          inputs: ${{ inputs.env }}
          secrets: ${{ secrets.env }}

      - name: Generate Zen Artisan Token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.GH_ZEN_APP_ID }}
          private-key: ${{ secrets.GH_ZEN_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          submodules: ${{ inputs.checkout-submodules }}
          token: ${{ steps.app-token.outputs.token }}
          fetch-depth: '0'

      - name: Install system build tools on Linux
        if: runner.os == 'Linux'
        uses: milaboratory/github-ci/actions/shell@v4
        with:
          dump-stdout: false
          run: |
            sudo apt-get update
            sudo apt-get install -y build-essential gfortran libopenblas-dev liblapack-dev cmake pkg-config

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.AWS_CI_IAM_MONOREPO_SIMPLE_ROLE }}
          role-duration-seconds: ${{ inputs.aws-login-duration }}
          aws-region: ${{ inputs.aws-region }}

      - name: Login to Quay.io
        if: inputs.docker-quay-push
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ env.QUAY_USERNAME }}
          password: ${{ env.QUAY_ROBOT_TOKEN }}

      - name: Login to Docker GA
        if: inputs.docker-quay-push
        uses: docker/login-action@v3
        with:
          registry: containers.pl-open.science
          username: ${{ env.QUAY_USERNAME }}
          password: ${{ env.QUAY_ROBOT_TOKEN }}

      - name: Prepare environment for building a NodeJS application
        uses: milaboratory/github-ci/actions/node/prepare-pnpm@v4
        env:
          PNPM_VERSION: ${{ needs.metadata.outputs.pnpm-version }}
        with:
          node-version: ${{ inputs.node-version }}
          cache-version: ${{ inputs.cache-version }}
          pnpm-version: ${{ env.PNPM_VERSION || inputs.pnpm-version }}
          cache-hashfiles-search-path: ${{ inputs.cache-hashfiles-search-path }}
          npmrc-config: ${{ inputs.npmrc-config }}

      - uses: milaboratory/github-ci/actions/turborepo/cache-s3@v4
        with:
          storage-provider: 's3'
          storage-path: ${{ env.AWS_CI_TURBOREPO_S3_BUCKET }}
          team-id: ${{ inputs.team-id }}

      - name: Install NodeJS packages with pnpm
        uses: milaboratory/github-ci/actions/shell@v4
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN  }}
        with:
          dump-stdout: false
          run: |
            pnpm install --frozen-lockfile --prefer-offline

      - name: Run changeset version
        if: ( github.event_name == 'push' && github.ref_name == 'main') || github.event_name == 'pull_request' || github.event_name == 'merge_group'
        uses: milaboratory/github-ci/actions/shell@v4
        with:
          run: |
            pnpm run version-packages

      - name: Get changed files staged and unstaged
        if: github.event_name == 'push'
          && github.ref_name == 'main'
        id: check-changes
        shell: bash
        run: |
          # Check for tracked files
          TRACKED_FILES=$(git diff --diff-filter=ACMUXTR --name-only)
          # Check for untracked files
          UNTRACKED_FILES=$(git ls-files --others --exclude-standard)
          # Check for unstaged deleted files
          UNSTAGED_DELETED_FILES=$(git ls-files --deleted)

          if [ -n "${TRACKED_FILES}" ] || [ -n "${UNTRACKED_FILES}" ] || [ -n "${UNSTAGED_DELETED_FILES}" ]; then
            echo "Local changes detected but not committed."
            echo "has-changes=1" >> $GITHUB_OUTPUT
            echo "Tracked files:"
            echo "${TRACKED_FILES}"
            echo "Untracked files:"
            echo "${UNTRACKED_FILES}"
            echo "Unstaged deleted files:"
            echo "${UNSTAGED_DELETED_FILES}"
          else
            echo "No local changes detected."
            echo "has-changes=0" >> $GITHUB_OUTPUT
          fi


      - name: Restore prebuild results
        uses: milaboratory/github-ci/actions/artifact/restore@v4
        with:
          pattern: prebuild-results-*

      - name: Perform security scan checks before publication
        uses: milaboratory/github-ci/actions/docker/scan-pnpm-repo@v4

      - name:  Run build - main metapackage
        uses: milaboratory/github-ci/actions/shell@v4
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN  }}
          MAIN_METAPACKAGE_NAME: ${{ inputs.main-metapackage-name }}
        with:
          dump-stdout: false
          run: |
            pnpm run --if-present before-publish
            pnpm run build --filter="${MAIN_METAPACKAGE_NAME}"

      - name: Get GitHub App User ID
        if: steps.check-changes.outputs.has-changes == '1'
        id: get-user-id
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"

      - name: Commit changed files to main
        uses: milaboratory/github-ci/actions/shell@v4
        if: steps.check-changes.outputs.has-changes == '1'
        env:
          USER_ID: ${{ steps.get-user-id.outputs.user-id }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        with:
          run: |
            git config --global user.name "${APP_SLUG}[bot]"
            git config --global user.email "${USER_ID}+${APP_SLUG}[bot]@users.noreply.github.com>"
            git checkout main
            git add .
            git commit -m "Auto-generated changes"
            git push

      # npm trusted publishing (OIDC). This job runs on a GitHub-hosted runner
      # with id-token: write, so pack and upload run back to back: pack runs
      # prepublishOnly/prepublish and `pnpm pack` for each unpublished
      # package, upload publishes the tarballs. Each package needs a trusted
      # publisher naming the caller's repository and workflow file.
      - name: Pack unpublished npm packages
        id: npm-pack
        if: github.ref_name == 'main'
          && steps.check-changes.outputs.has-changes == '0'
        uses: milaboratory/github-ci/actions/node/pack-unpublished@v4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN }}

      - name: Publish npm packages
        if: steps.npm-pack.outputs.count != '' && steps.npm-pack.outputs.count != '0'
        uses: milaboratory/github-ci/actions/node/publish-tarballs@v4
        with:
          dir: ${{ steps.npm-pack.outputs.dir }}
          access-public: ${{ inputs.publish-to-public }}
          npm-auth-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release with tag
        if: github.ref_name == 'main'
          && steps.check-changes.outputs.has-changes == '0'
          && inputs.create-tag == 'true'
        uses: milaboratory/github-ci/actions/release/create-with-tag@v4
        env:
          NPM_PKG_VERSION: ${{ needs.metadata.outputs.npm-pkg-version }}
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          name: ${{ format('v{0}', env.NPM_PKG_VERSION) }}
          tag: ${{ format('v{0}', env.NPM_PKG_VERSION) }}
          commit: ${{ github.sha }}
          skipIfReleaseExists: true
          draft: false
          prerelease: false

    outputs:
      # Even constant outputs become initialized only after job start.
      # All outputs of skipped jobs are always empty.
      started: 'true'

  notify-release:
    name: notify release
    runs-on: ubuntu-latest
    if: always()
    needs:
      - init
      - metadata
      - check-changesets
      - build-publish
      - pre-calculated-build
    steps:
      - id: search-tags
        if: always()
        uses: milaboratory/github-ci/actions/strings/json-list@v4
        with:
          input: |
            release

      - uses: milaboratory/github-ci/blocks/notify/release@v4
        env:
          NPM_PKG_VERSION: ${{ needs.metadata.outputs.npm-pkg-version }}
        with:
          telegram-target: ${{ secrets.TELEGRAM_NOTIFICATION_TARGET }}
          telegram-token: ${{ secrets.TELEGRAM_API_TOKEN }}
          job-status: |
             ${{ needs.pre-calculated-build.result }}
             ${{ needs.build-publish.result }}
             ${{ needs.check-changesets.result }}
          product-name: ${{ inputs.app-name }}
          override-version: ${{ format('{0}', env.NPM_PKG_VERSION) }}
          override-tag: ${{ format('v{0}', env.NPM_PKG_VERSION) }}
          search-tags: ${{ steps.search-tags.outputs.result }}