Modular deployments

.github/workflows/build-and-deploy.yml

@@ -81,7 +81,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     concurrency:
-      group: "dito-apps-deploy"
+      group: "digitalcheck-apps-deploy"
       cancel-in-progress: false
     permissions:
       packages: read

.github/workflows/check-and-test.yml

@@ -0,0 +1,88 @@
+name: Pipeline
+
+on:
+  workflow_call:
+    inputs:
+      flag:
+        required: false
+        type: string
+        description: "Additional flag to pass to the build script (e.g. --workspace=dito)"
+
+jobs:
+  check-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+          cache: npm
+          cache-dependency-path: "**/package-lock.json"
+
+      - name: Cache npm dependencies
+        id: cache-npm-deps
+        uses: actions/cache@v4
+        with:
+          path: |
+            **/node_modules
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Install dependencies
+        if: steps.cache-npm-deps.outputs.cache-hit != 'true'
+        run: npm ci
+
+      - name: Audit used licences
+        run: npm run audit:licences
+
+      - name: Check format
+        run: npm run format:check
+
+      - name: Lint
+        run: npm run lint:check
+
+      - name: Check types
+        run: npm run typecheck ${{ inputs.flag }}
+
+      - name: Run unit tests
+        run: npm test ${{ inputs.flag }}
+
+      - name: Install E2E & A11y test dependencies
+        run: |
+          npx --yes playwright install --with-deps
+
+      - name: Run E2E tests
+        id: e2e
+        run: npm run test:e2e ${{ inputs.flag }}
+
+      - uses: actions/upload-artifact@v4
+        if: ${{ failure() && steps.e2e.outcome == 'failure' }}
+        with:
+          name: playwright-e2e-test-results
+          path: packages/*/test/e2e/playwright-report
+
+      - name: Run A11y tests
+        id: a11y
+        run: npm run test:a11y ${{ inputs.flag }}
+        env:
+          # Use a different port (from the one used with E2E tests) to workaround problem in CI/GitHub Actions,
+          # starting to occur with playwright/test 1.28.0:
+          # Error: http://localhost:4173 is already used ...
+          # See https://github.com/digitalservicebund/typescript-vite-application-template/actions/runs/3486985178/jobs/5834089375
+          VITE_PORT: 4183
+
+      - uses: actions/upload-artifact@v4
+        if: ${{ failure() && steps.a11y.outcome == 'failure' }}
+        with:
+          name: playwright-a11y-test-results
+          path: packages/*/test/a11y/playwright-report
+
+      - name: Send failure to Slack
+        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
+        if: ${{ failure() }}
+        with:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

.github/workflows/pipeline-dito.yml

@@ -0,0 +1,38 @@
+name: PipelineDiTo
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "packages/dito/**"
+      - ".github/workflows/**"
+      - "!.github/workflows/shared.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "packages/dito/**"
+      - ".github/workflows/**"
+      - "!.github/workflows/shared.yml"
+
+jobs:
+  check-and-test:
+    uses: ./.github/workflows/check-and-test.yml
+    with:
+      flag: "--workspace=packages/dito"
+    secrets: inherit
+
+  vulnerability-scan:
+    uses: ./.github/workflows/scan.yml
+    secrets: inherit
+
+  build-and-deploy:
+    needs:
+      - check-and-test
+      - vulnerability-scan
+    if: ${{ github.ref == 'refs/heads/main' }}
+    uses: ./.github/workflows/build-and-deploy.yml
+    with:
+      package: dito
+      environment: production
+    secrets: inherit

.github/workflows/pipeline-shared.yml

@@ -0,0 +1,42 @@
+name: PipelineShared
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths-ignore:
+      - "packages/dito/**"
+      - ".github/workflows/pipeline-dito.yml"
+      - "packages/tool-finder/**"
+      - ".github/workflows/pipeline-tool-finder.yml"
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - "packages/dito/**"
+      - ".github/workflows/pipeline-dito.yml"
+      - "packages/tool-finder/**"
+      - ".github/workflows/pipeline-tool-finder.yml"
+
+jobs:
+  check-and-test:
+    uses: ./.github/workflows/check-and-test.yml
+    secrets: inherit
+
+  vulnerability-scan:
+    uses: ./.github/workflows/scan.yml
+    secrets: inherit
+
+  build-and-deploy:
+    needs:
+      - check-and-test
+      - vulnerability-scan
+    if: ${{ github.ref == 'refs/heads/main' }}
+    uses: ./.github/workflows/build-and-deploy.yml
+    strategy:
+      fail-fast: false
+      matrix:
+        package: [dito, tool-finder]
+    with:
+      package: ${{ matrix.package }}
+      environment: production
+    secrets: inherit

.github/workflows/pipeline-tool-finder.yml

@@ -0,0 +1,38 @@
+name: PipelineToolFinder
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "packages/tool-finder/**"
+      - ".github/workflows/**"
+      - "!.github/workflows/shared.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "packages/tool-finder/**"
+      - ".github/workflows/**"
+      - "!.github/workflows/shared.yml"
+
+jobs:
+  check-and-test:
+    uses: ./.github/workflows/check-and-test.yml
+    with:
+      flag: "--workspace=packages/tool-finder"
+    secrets: inherit
+
+  vulnerability-scan:
+    uses: ./.github/workflows/scan.yml
+    secrets: inherit
+
+  build-and-deploy:
+    needs:
+      - check-and-test
+      - vulnerability-scan
+    if: ${{ github.ref == 'refs/heads/main' }}
+    uses: ./.github/workflows/build-and-deploy.yml
+    with:
+      package: tool-finder
+      environment: production
+    secrets: inherit