keycloak/.github/workflows/js-ci.yml

name: Keycloak JavaScript CI

on:
  push:
    branches-ignore:
      - main
      - dependabot/**
      - quarkus-next
  pull_request:
  workflow_dispatch:

env:
  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"

concurrency:
  # Only cancel jobs for PR updates
  group: js-ci-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

permissions:
  contents: read

jobs:
  conditional:
    name: Check conditional workflows and jobs
    runs-on: ubuntu-latest
    outputs:
      js-ci: ${{ steps.conditional.outputs.js }}
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - id: conditional
        uses: ./.github/actions/conditional
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  build-keycloak:
    name: Build Keycloak
    needs: conditional
    if: needs.conditional.outputs.js-ci == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Build Keycloak
        uses: ./.github/actions/build-keycloak

      - name: Prepare archive for upload
        run: |
          mv ./quarkus/dist/target/keycloak-999.0.0-SNAPSHOT.tar.gz ./keycloak-999.0.0-SNAPSHOT.tar.gz

      - name: Upload Keycloak dist
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: keycloak
          path: keycloak-999.0.0-SNAPSHOT.tar.gz

  admin-client:
    name: Admin Client
    needs: conditional
    if: needs.conditional.outputs.js-ci == 'true'
    runs-on: ubuntu-latest
    env:
      WORKSPACE: "@keycloak/keycloak-admin-client"
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - uses: ./.github/actions/pnpm-setup

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} lint
        working-directory: js

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} build
        working-directory: js

  ui-shared:
    name: UI Shared
    needs: conditional
    if: needs.conditional.outputs.js-ci == 'true'
    runs-on: ubuntu-latest
    env:
      WORKSPACE: "@keycloak/keycloak-ui-shared"
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - uses: ./.github/actions/pnpm-setup

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} lint
        working-directory: js

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} build
        working-directory: js

  account-ui:
    name: Account UI
    needs: conditional
    if: needs.conditional.outputs.js-ci == 'true'
    runs-on: ubuntu-latest
    env:
      WORKSPACE: "@keycloak/keycloak-account-ui"
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - uses: ./.github/actions/pnpm-setup

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} lint
        working-directory: js

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} build
        working-directory: js

  admin-ui:
    name: Admin UI
    needs: conditional
    if: needs.conditional.outputs.js-ci == 'true'
    runs-on: ubuntu-latest
    env:
      WORKSPACE: keycloak-admin-ui
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - uses: ./.github/actions/pnpm-setup

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} lint
        working-directory: js

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test
        working-directory: js

      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} build
        working-directory: js

  account-ui-e2e:
    name: Account UI E2E
    needs:
      - conditional
      - build-keycloak
    if: needs.conditional.outputs.js-ci == 'true'
    runs-on: ubuntu-latest
    env:
      WORKSPACE: "@keycloak/keycloak-account-ui"
    strategy:
      matrix:
        browser: [chromium, firefox]
        exclude:
          # Only test with Firefox on scheduled runs
          - browser: ${{ github.event_name != 'workflow_dispatch' && 'firefox' || '' }}
      fail-fast: false
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - uses: ./.github/actions/pnpm-setup

      - name: Download Keycloak server
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: keycloak

      - name: Setup Java
        uses: ./.github/actions/java-setup

      - name: Start Keycloak server
        run: |
          tar xfvz keycloak-999.0.0-SNAPSHOT.tar.gz
          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --features=transient-users,oid4vc-vci &> ~/server.log &
        env:
          KC_BOOTSTRAP_ADMIN_USERNAME: admin
          KC_BOOTSTRAP_ADMIN_PASSWORD: admin

      - name: Install Playwright browsers
        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} exec playwright install --with-deps
        working-directory: js

      - name: Run Playwright tests
        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test -- --project=${{ matrix.browser }}
        working-directory: js

      - name: Upload Playwright report
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        if: always()
        with:
          name: account-ui-playwright-report-${{ matrix.browser }}
          path: js/apps/account-ui/playwright-report
          retention-days: 30

      - name: Upload server logs
        if: always()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: account-ui-server-log-${{ matrix.browser }}
          path: ~/server.log

  admin-ui-e2e:
    name: Admin UI E2E
    needs:
      - conditional
      - build-keycloak
    if: needs.conditional.outputs.js-ci == 'true'
    runs-on: ubuntu-latest
    env:
      WORKSPACE: "@keycloak/keycloak-admin-ui"
      RETRY_COUNT: 3
    strategy:
      matrix:
        browser: [chromium, firefox]
        exclude:
          # Only test with Firefox on scheduled runs
          - browser: ${{ github.event_name != 'workflow_dispatch' && 'firefox' || '' }}
      fail-fast: false
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - uses: ./.github/actions/pnpm-setup

      - name: Download Keycloak server
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: keycloak

      - name: Setup Java
        uses: ./.github/actions/java-setup

      - name: Start Keycloak server
        run: |
          tar xfvz keycloak-999.0.0-SNAPSHOT.tar.gz
          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --features=admin-fine-grained-authz:v2,transient-users,spiffe,oid4vc-vci,kubernetes-service-accounts,jwt-authorization-grant,workflows &> ~/server.log &
        env:
          KC_BOOTSTRAP_ADMIN_USERNAME: admin
          KC_BOOTSTRAP_ADMIN_PASSWORD: admin
          KC_BOOTSTRAP_ADMIN_CLIENT_ID: temporary-admin-service
          KC_BOOTSTRAP_ADMIN_CLIENT_SECRET: temporary-admin-service

      - name: Install Playwright browsers
        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} exec playwright install --with-deps
        working-directory: js

      - name: Run Playwright tests
        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test:integration -- --project=${{ matrix.browser }}
        working-directory: js

      - name: Upload Playwright report
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        if: always()
        with:
          name: admin-ui-playwright-report-${{ matrix.browser }}
          path: js/apps/admin-ui/playwright-report
          retention-days: 30

      - name: Upload server logs
        if: always()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: admin-ui-server-log-${{ matrix.browser }}
          path: ~/server.log

  keycloak-admin-client:
    name: Keycloak Admin Client
    needs:
      - conditional
      - build-keycloak
    if: needs.conditional.outputs.js-ci == 'true'
    runs-on: ubuntu-latest
    env:
      WORKSPACE: "@keycloak/keycloak-admin-client"
      RETRY_COUNT: 3
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Download Keycloak server
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: keycloak

      - name: Setup Java
        uses: ./.github/actions/java-setup

      - name: Start Keycloak server
        run: |
          tar xfvz keycloak-999.0.0-SNAPSHOT.tar.gz
          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --http-port 8180 --features transient-users,oid4vc-vci,declarative-ui,quick-theme,spiffe,kubernetes-service-accounts,workflows,client-auth-federated,jwt-authorization-grant &> ~/server.log &
          curl --connect-timeout 5 --max-time 10 --retry 10 --retry-all-errors --retry-delay 10 --retry-max-time 120 -s -o /dev/null http://127.0.0.1:8180
        env:
          KC_BOOTSTRAP_ADMIN_USERNAME: admin
          KC_BOOTSTRAP_ADMIN_PASSWORD: admin

      - uses: ./.github/actions/pnpm-setup

      - name: Run tests
        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} run test
        working-directory: js

  check:
    name: Status Check - Keycloak JavaScript CI
    if: always()
    needs:
      - conditional
      - build-keycloak
      - admin-client
      - ui-shared
      - account-ui
      - account-ui-e2e
      - admin-ui
      - admin-ui-e2e
      - keycloak-admin-client
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./.github/actions/status-check
        with:
          jobs: ${{ toJSON(needs) }}