analyze-bundle.yml

name: F/E bundle diff

# For Truss and how we use this repo, pull_request and
# pull_request_target have no differences
#
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
#
#    Workflows triggered via pull_request_target have write permission
#    to the target repository. They also have access to target
#    repository secrets. The same is true for workflows triggered on
#    pull_request from a branch in the same repository, but not from
#    external forks.
#
# Truss always uses branches in the same repository
#
# Using pull_request means changes to the workflow file are used in
# the PR, which is incredibly helpful when testing out changes
on:
  pull_request:
  pull_request_target:
    branches:
      - main


jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      frontend: ${{ steps.filter.outputs.frontend }}
    steps:
      - uses: dorny/paths-filter@v2
        id: filter
        with:
          filters: |
            frontend:
              - 'src/**'
              - 'yarn.lock'

  build-head:
    concurrency:
      group: bundle-build-head-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: true
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    name: 'Build head'
    runs-on: ubuntu-latest
    steps:
      - name: Check out branch
        uses: actions/checkout@v3.6.0

      - name: Set up node
        uses: actions/setup-node@v3
        with:
          node-version-file: '.tool-versions'

      - name: Install dependencies
        run: yarn install

      - name: Build head with options
        run: |
          export NODE_OPTIONS="--max-old-space-size=4096"
          echo "Using NODE_OPTIONS:${NODE_OPTIONS}"
          yarn build --stats

      - name: Upload stats.json
        uses: actions/upload-artifact@v3
        with:
          name: head-stats
          path: ./build/bundle-stats.json

  build-base:
    concurrency:
      group: bundle-build-base-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: true
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    name: 'Build base'
    runs-on: ubuntu-latest
    steps:
      - name: Check out base branch
        uses: actions/checkout@v3.6.0
        with:
          ref: ${{ github.base_ref }}

      - name: Set up node
        uses: actions/setup-node@v3
        with:
          node-version-file: '.tool-versions'

      - name: Install dependencies
        run: yarn install

      - name: Build base with options
        run: |
          export NODE_OPTIONS="--max-old-space-size=4096"
          echo "Using NODE_OPTIONS:${NODE_OPTIONS}"
          yarn build --stats

      - name: Upload stats.json
        uses: actions/upload-artifact@v3
        with:
          name: base-stats
          path: ./build/bundle-stats.json

  # run the action against the stats.json files
  compare:
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    concurrency:
      group: bundle-compare-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: true
    name: 'Compare base & head bundle sizes'
    runs-on: ubuntu-latest
    needs: [build-base, build-head]
    permissions:
      pull-requests: write
    steps:
      - uses: actions/download-artifact@v3
      - uses: github/webpack-bundlesize-compare-action@v1.8.2
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          current-stats-json-path: ./head-stats/bundle-stats.json
          base-stats-json-path: ./base-stats/bundle-stats.json

  noop:
    name: 'Noop job to prevent notification'
    runs-on: ubuntu-latest
    steps:
      - run: 'echo "No build required" '