webmail/.github/workflows/static-lite.yml

name: "Lite: Static bundle"

# Bulwark Lite: the static export of the webmail (see docs in README.md,
# "Static Lite build"). Runs the build on every push as a regression check,
# attaches the zips to releases, and lets maintainers build a custom variant
# (fixed server URL, sub-path mount, locale subset, demo) on demand.
#
# Two targets are built side by side:
#   - static:   bulwark-lite-<version>.zip for any static web host;
#   - stalwart: bulwark-lite-stalwart.zip, a Stalwart `Application` bundle.
#               Its LITE-README points `resourceUrl` at the tagged release.
#
# Each zip is published with a `.sha256` next to it and a signed build
# provenance attestation: `gh attestation verify <zip> --repo bulwarkmail/webmail`.
#
# scripts/lite/prepare.mjs deletes the server-only trees in place; that is
# safe here because the Actions checkout is disposable (CI=true is the guard).

on:
  release:
    name: Attach to release
    types: [published]
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
    inputs:
      jmap_server_url:
        description: "Default JMAP server URL baked into config.json (static: editable after download; stalwart: leave empty for the serving Stalwart)"
        required: false
      app_name:
        description: "App name"
        required: false
        default: "Bulwark Webmail"
      base_path:
        description: "Sub-path mount for the static target, e.g. /webmail (baked into asset URLs; the stalwart target ignores it)"
        required: false
      locales:
        description: "Comma-separated locale subset, e.g. en,de,fr (default: all)"
        required: false
      demo:
        description: "Build the static demo (built-in demo account, no server)"
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  build:
    name: Build (${{ matrix.target }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        target: [static, stalwart]
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build static export
        env:
          CI: "true"
          GIT_COMMIT: ${{ github.sha }}
          LITE_TARGET: ${{ matrix.target }}
          # The Stalwart bundle learns its mount prefix at runtime.
          NEXT_PUBLIC_BASE_PATH: ${{ matrix.target == 'static' && inputs.base_path || '' }}
          LITE_JMAP_SERVER_URL: ${{ inputs.jmap_server_url }}
          LITE_APP_NAME: ${{ inputs.app_name }}
          LITE_LOCALES: ${{ inputs.locales }}
          LITE_DEMO_MODE: ${{ inputs.demo }}
          # Browser source maps for Bugsink; build:lite moves them out of out/
          # before anything is packed. https://bulwarkmail.org/docs/admin/monitoring
          BULWARK_SOURCE_MAPS: "1"
          SOURCEMAPS_OUT: sourcemaps
        run: npm run build:lite

      # Each target is its own build with its own chunks, so each uploads.
      - name: Upload source maps to Bugsink
        env:
          BUGSINK_AUTH_TOKEN: ${{ secrets.BUGSINK_AUTH_TOKEN }}
        run: bash scripts/upload-sourcemaps.sh sourcemaps

      # Every host literal in the bundle must be a placeholder, the configured
      # JMAP server, a built-in host the no-third-party switch turns off, or a
      # string listed as never requested (#903).
      - name: Scan the bundle for outside hosts
        run: node scripts/lite/scan-hosts.mjs out

      - name: Package zip
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          if [ "${{ matrix.target }}" = "stalwart" ]; then
            # postbuild already packed it (entries at the archive root, no
            # wrapping folder); the name stays version-less on purpose.
            ZIP="bulwark-lite-stalwart.zip"
          else
            if [ "${{ github.event_name }}" = "release" ]; then
              VERSION="${REF_NAME#v}"
            else
              VERSION="$(cat VERSION)-${GITHUB_SHA::7}"
            fi
            ZIP="bulwark-lite-${VERSION}.zip"
            (cd out && zip -qr "../${ZIP}" .)
          fi
          echo "ZIP=${ZIP}" >> "$GITHUB_ENV"
          ls -la "${ZIP}"

      - name: Check the zip holds no source maps
        run: node scripts/sourcemaps.mjs check "$ZIP"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: bulwark-lite-${{ matrix.target }}
          path: ${{ env.ZIP }}
          retention-days: 7

  release:
    name: Attach to release
    # The only job with a write token, and it runs no checked-out code.
    needs: build
    if: github.event_name == 'release'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - name: Download zips
        uses: actions/download-artifact@v8
        with:
          pattern: bulwark-lite-*
          path: zips
          merge-multiple: true

      - name: Checksum zips
        working-directory: zips
        run: for zip in *.zip; do sha256sum "$zip" > "$zip.sha256"; done

      - name: Attest build provenance
        uses: actions/attest@v4
        with:
          subject-path: zips/*.zip

      - name: Upload release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: gh release upload "$TAG_NAME" zips/*.zip zips/*.zip.sha256 --clobber

  e2e:
    name: E2E (static)
    # Boots the demo export on a plain static server and drives it with
    # Playwright: login, open a thread, switch surfaces, reload a deep link.
    # No JMAP server involved, so it is cheap and deterministic.
    runs-on: ubuntu-latest
    timeout-minutes: 30
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright browser
        run: npx playwright install --with-deps chromium

      # prepare.mjs prunes every test tree in the checkout; the E2E suite
      # lives under scripts/lite/smoke, which it leaves alone.
      - name: Build demo export
        env:
          CI: "true"
          GIT_COMMIT: ${{ github.sha }}
          LITE_DEMO_MODE: "true"
          LITE_LOCALES: "en,de"
        run: npm run build:lite

      - name: Run E2E test
        run: npm run test:lite-smoke

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: lite-e2e-report
          path: playwright-report
          retention-days: 7

  e2e-stalwart:
    name: E2E (Stalwart)
    # The Stalwart Application bundle, served by scripts/lite/serve.mjs
    # --stalwart (an emulation of how Stalwart serves Applications) from the
    # zip itself, under two prefixes.
    runs-on: ubuntu-latest
    timeout-minutes: 30
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright browser
        run: npx playwright install --with-deps chromium

      - name: Build demo bundle
        env:
          CI: "true"
          GIT_COMMIT: ${{ github.sha }}
          LITE_TARGET: stalwart
          LITE_DEMO_MODE: "true"
          LITE_LOCALES: "en,de"
        run: npm run build:lite

      - name: Run E2E test
        run: npm run test:lite-smoke:stalwart

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: lite-e2e-stalwart-report
          path: playwright-report
          retention-days: 7