Split GitHub workflows (#8096)

.github/workflows/publish.yml

@@ -0,0 +1,60 @@
+name: Publish
+on:
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: 'publish'
+  cancel-in-progress: true
+
+jobs:
+  publish:
+    name: Build and Publish files
+    if: github.repository == '2factorauth/twofactorauth'
+    permissions:
+      pages: write
+      id-token: write
+    environment: production
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 2
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          ruby-version: '3.0'
+      - name: Generate API files
+        run: |
+          mkdir -p api/v3
+          ./scripts/APIv3.rb
+      - name: Publish changes to Algolia
+        run: bundle exec ruby ./scripts/Algolia.rb
+        env:
+          ALGOLIA_APP_ID: ${{ secrets.ALGOLIA_APP_ID }}
+          ALGOLIA_INDEX_NAME: ${{ vars.ALGOLIA_INDEX_NAME }}
+          ALGOLIA_API_KEY: ${{ secrets.ALGOLIA_API_KEY }}
+      - uses: crazy-max/ghaction-import-gpg@v5
+        id: pgp
+        with:
+          gpg_private_key: ${{ secrets.PGP_KEY }}
+          passphrase: ${{ secrets.PGP_PASSWORD }}
+      - name: Sign API files
+        run: bundle exec ruby scripts/Sign.rb
+        env:
+          PGP_PASSWORD: ${{ secrets.PGP_PASSWORD }}
+          PGP_KEY_ID: ${{ steps.pgp.outputs.keyid }}
+      - name: Prepare publish directory
+        run: |
+          mkdir -p public/icons
+          cp -r api/. public/
+          cp -r img/. public/icons/
+          cp robots.txt public/
+      - uses: actions/upload-pages-artifact@v1
+        with:
+          path: public/
+      - name: Deploy to GitHub Pages
+        uses: actions/deploy-pages@v1
+      - name: Send webhook to Cloudflare
+        run: curl -X POST -IL "${{ secrets.WEBHOOK }}" -o /dev/null -w '%{http_code}\n' -s

.github/workflows/pull_request.yml

@@ -1,16 +1,82 @@
 name: Pull Request tests
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
+on: pull_request
+run-name: "${{github.event.pull_request.title}} (#${{ github.event.number }})"
+concurrency:
+  group: ${{ github.event.number }}
+  cancel-in-progress: true
+
 jobs:
-  validate:
+  ruby-tests:
+    name: Ruby tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          ruby-version: '3.0'
+        env:
+          BUNDLE_WITH: 'tests'
+      - name: Validate JSON structure
+        run: bundle exec ruby ./tests/validate-json.rb
+      - name: Validate Categories
+        run: bundle exec ruby ./tests/validate-categories.rb
+      - name: Validate file extensions and permissions
+        run: tests/validate-fs.sh
+      - name: Validate Images
+        run: bundle exec ruby ./tests/validate-images.rb
+      - name: Validate SVG
+        run: bundle exec ruby ./tests/svg-lint.rb
+      - name: Validate URL/Domain reachability
+        run: bundle exec ruby ./tests/validate-urls.rb
+        continue-on-error: true
+      - name: Quality Checks
+        run: bundle exec ruby ./tests/quality-checks.rb
+      - name: Validate Ruby scripts
+        run: bundle exec rubocop
+
+  node-tests:
+    name: JavaScript tests
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Get modified files
+        id: diff
+        run: |
+          echo "::debug:: Fetching files from ${{ github.api_url }}/repos/${{ github.repository }}/pulls/${{ github.event.number }}/files"
+          FILES=$(curl -s "${{ github.api_url }}/repos/${{ github.repository }}/pulls/${{ github.event.number }}/files" | jq -r '.[].filename' | tr '\n' ' ')
+          echo "name=${FILES}" >> $GITHUB_OUTPUT
+          ENTRIES=$(echo "$FILES" | tr ' ' '\n' | grep -E '^entries/.*\.json$' | tr '\n' ' ')
+          if [ -n "$ENTRIES" ]; then
+            echo "entries=${ENTRIES}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate Language codes
+        if: steps.diff.outputs.entries
+        run: node tests/languages.js ${{ steps.diff.outputs.entries }}
+
+      - name: Validate Region codes
+        if: steps.diff.outputs.entries
+        run: node tests/regions.js ${{ steps.diff.outputs.entries }}
+
+  external-tests:
+    name: External Tests
+    runs-on: ubuntu-latest
+    steps:
       - name: Call PR Validator
         run: |
-          curl -s --fail-with-body "https://pr-validator.2factorauth.workers.dev/${{ github.event.repository.name }}/${{ github.event.number }}/" \
+          curl -s --fail-with-body "https://pr-validator.2fa.directory/${{ github.event.repository.name }}/${{ github.event.number }}/" \
           -H "Content-Type: application/json"

package.json

@@ -0,0 +1,8 @@
+{
+  "name": "twofactorauth",
+  "private": true,
+  "dependencies": {
+    "@actions/core": "^1.10.1",
+    "dotenv": "^16.4.5"
+  }
+}

tests/languages.js

@@ -0,0 +1,36 @@
+const fs = require('fs').promises;
+const core = require('@actions/core');
+
+const url = new URL(
+  'https://pkgstore.datahub.io/core/language-codes/language-codes_json/data/97607046542b532c395cf83df5185246/language-codes_json.json');
+
+async function main() {
+  let errors = false;
+  const files = process.argv.slice(2);
+  const res = await fetch(url, {
+    'accept': 'application/json',
+    'user-agent': '2factorauth/twofactorauth +https://2fa.directory/bots',
+  });
+
+  if (!res.ok) throw new Error('Unable to fetch language codes');
+
+  const data = await res.json();
+  const codes = Object.values(data).map(language => language.alpha2);
+
+  if (files) {
+    for (const file of files) {
+      const data = await fs.readFile(file, 'utf8');
+      const json = await JSON.parse(data);
+      const entry = json[Object.keys(json)[0]];
+      const language = entry.contact?.language;
+
+      if (language && !codes.includes(language)) {
+        core.error(`${language} is not a valid language`, {file});
+        errors = true;
+      }
+    }
+  }
+  process.exit(+errors);
+}
+
+module.exports = main();