branch.yml

name: v4.x branch

on:
  push:
    branches:
    - v4.x

jobs:
  install:
    name: Install
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Cache node_modules
      id: cacheModules
      uses: actions/cache@v4
      with:
        path: ~/.npm # this is the cache where npm installs from before going out to the network
        key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }}
    - name: Install dependencies
      if: steps.cacheDist.outputs.cache-hit != 'true'
      run: npm install

  build:
    name: Build
    needs: [install]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Restore node_modules
      uses: actions/cache@v4
      with:
        path: ~/.npm # this is the cache where npm installs from before going out to the network
        key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }}
    - name: Cache dist
      id: cacheDist
      uses: actions/cache@v4
      with:
        path: ./dist
        key: ${{ runner.os }}-node-${{ hashFiles('package.json', 'rollup.config.js', 'src/*.js') }}
    - name: Build cross-fetch
      if: steps.cacheDist.outputs.cache-hit != 'true'
      run: make dist

  debug:
    name: Debug
    runs-on: ubuntu-latest
    steps:
    - uses: hmarr/debug-action@v3

  checks:
    name: Check
    needs: [build]
    uses: ./.github/workflows/checks.yml
    with:
      ref: ${{ github.sha }}

  # The security job can't run on pull requests opened from forks because
  # Github doesn't pass down the SNYK_TOKEN environment variable.
  security:
    name: Check Security
    needs: [build]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/cache@v4
      with:
        path: ~/.npm # this is the cache where npm installs from before going out to the network
        key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }}
    - run: npm install --prefer-offline
    - run: make secure
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}