build.yml

on:
    workflow_call:
        inputs:
            environment:
                required: true
                type: string
        outputs:
            artifact-name:
                value: ${{ jobs.build.outputs.artifact-name }}
        secrets:
            NPM_FONTAWESOME_TOKEN:
                required: true

jobs:
    build:
        name: Build for ${{ inputs.environment }}
        runs-on: ubuntu-latest
        environment: ${{ inputs.environment }}

        outputs:
            artifact-name: build-${{ inputs.environment }}-${{ github.run_id }}-${{ github.run_number }}

        steps:
            - name: Check out Git repository
              uses: actions/checkout@v4

            - name: Set up Node 21
              uses: actions/setup-node@v4
              with:
                  node-version: 21
                  cache: npm

            - name: Install NPM dependencies
              # Skip post-install scripts for now to prevent token theft
              run: |
                  npm config set '//npm.fontawesome.com/:_authToken' '${NPM_FONTAWESOME_TOKEN}'
                  npm ci --ignore-scripts
                  npm config delete '//npm.fontawesome.com/:_authToken'
              env:
                  NPM_FONTAWESOME_TOKEN: ${{ secrets.NPM_FONTAWESOME_TOKEN }}

            - name: Run post-install scripts
              run: npm rebuild

            - name: Build project
              run: npm run build

            - name: Upload build artifact
              uses: actions/upload-artifact@v4
              with:
                  name: build-${{ inputs.environment }}-${{ github.run_id }}-${{ github.run_number }}
                  path: dist
                  retention-days: 1