ci.yml

name: CI
on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    # Ref: GHA Filter pattern syntax: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#filter-pattern-cheat-sheet
    # Run on pushes to main, release branches, and previous/future major version branches
    branches:
      - main
      - 'v[0-9]+.*' # Matches any release branch, e.g. v6.0.3, v12.1.0
      - '[0-9]+.x' # Matches any major version branch, e.g. 5.x, 23.x
    tags:
      - 'v[0-9]*' # Version tags trigger release publishing (npm, GitHub Release, Docker)

env:
  FORCE_COLOR: 1
  HEAD_COMMIT: ${{ github.sha }}
  NODE_VERSION: 22.18.0
  # Disable v8-compile-cache to prevent intermittent V8 deserializer crashes
  # when multiple parallel Nx workers race to read/write shared bytecode cache
  # files. The cache lives in /tmp and is discarded after each run anyway,
  # so disabling it has no meaningful performance impact in CI.
  # See: https://github.com/nodejs/node/issues/51555
  DISABLE_V8_COMPILE_CACHE: 1

concurrency:
  # Tag pushes get a unique uninterruptible group so a release CI run always
  # finishes; branch / PR pushes keep cancel-on-newer behavior.
  group: ${{ startsWith(github.ref, 'refs/tags/') && format('release-{0}', github.ref) || github.head_ref || github.ref }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}

jobs:
  job_setup:
    name: Setup
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      IS_MAIN: ${{ github.ref == 'refs/heads/main' }}
      IS_TAG: ${{ startsWith(github.ref, 'refs/tags/v') }}
      IS_DEVELOPMENT: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/6.x' }}
      IS_SIX: ${{ github.ref == 'refs/heads/6.x' }}
      IS_SIX_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref == '6.x' }}
    permissions:
      actions: read
      contents: read
      # Required by dorny/paths-filter, which calls pulls.listFiles on
      # pull_request events. Private forks of this repo don't grant this
      # implicitly when an explicit permissions block is present, so it must
      # be listed here for the Setup job to succeed on those forks.
      pull-requests: read
    steps:
      - name: Checkout current commit
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ env.HEAD_COMMIT }}
          fetch-depth: 0
          # fetch a treeless clone to improve checkout speed, the job will fetch contents later if needed
          filter: 'tree:0'

      - name: Output GitHub context
        if: env.RUNNER_DEBUG == '1'
        run: |
          echo "GITHUB_EVENT_NAME: ${{ github.event_name }}"
          echo "GITHUB_CONTEXT: ${{ toJson(github.event) }}"

      - name: Set SHAs for Nx Commands
        if: env.IS_TAG != 'true'
        uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1
        with:
          main-branch-name: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || github.ref_name }}
          error-on-no-successful-workflow: ${{ env.IS_MAIN == 'true' }}

      - name: Check user org membership
        id: check_user_org_membership
        if: github.event_name == 'pull_request'
        run: |
          echo "Looking up: ${{ github.triggering_actor }}"
          ENCODED_USERNAME=$(printf '%s' '${{ github.triggering_actor }}' | jq -sRr @uri)

          LOOKUP_USER=$(curl --write-out "%{http_code}" --silent --output /dev/null --location "https://api.github.com/orgs/tryghost/members/$ENCODED_USERNAME" --header "Authorization: Bearer ${{ secrets.CANARY_DOCKER_BUILD }}")

          if [ "$LOOKUP_USER" == "204" ]; then
            echo "User is in the org"
            echo "is_member=true" >> $GITHUB_OUTPUT
          else
            echo "User is not in the org"
            echo "is_member=false" >> $GITHUB_OUTPUT
          fi

      - name: Determine changed packages
        if: env.IS_TAG != 'true'
        uses: AurorNZ/paths-filter@c9dd42e99db87803313ff6f4b1150cc9f6c836af # v5.0.0
        id: changed
        with:
          base: ${{ env.NX_BASE }}
          filters: |
            shared: &shared
              - '.github/**'
              # Renovate config / workflow files have no Ghost
              # runtime/test impact. Anchored as &renovate_only and
              # referenced from every filter below so a PR touching
              # only these files skips all downstream jobs; the
              # rollup gate passes on skipped deps.
              - &renovate_only
                - '!.github/renovate.json5'
                - '!.github/renovate-bot.cjs'
                - '!.github/workflows/renovate.yml'
              - '.npmrc'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
            ci:
              - '.github/workflows/**'
              - *renovate_only
              - '.github/actions/**'
              - '.github/scripts/**'
            core:
              - *shared
              - 'ghost/**'
              - '!ghost/admin/**'
              - '!ghost/core/core/server/data/tinybird/**'
              # Unit tests + vitest config are exercised only by job_unit-tests;
              # they never affect the acceptance / legacy / ghost-cli jobs.
              - '!ghost/core/test/unit/**'
              - '!ghost/core/vitest.config.ts'
              - '!ghost/core/test/utils/vitest-setup.ts'
            tinybird:
              - '.github/workflows/ci.yml'
              - 'compose.dev.analytics.yaml'
              - 'ghost/core/core/server/data/tinybird/**'
              - '!ghost/core/core/server/data/tinybird/**/*.md'
            tinybird-datafiles:
              - 'ghost/core/core/server/data/tinybird/**'
              - '!ghost/core/core/server/data/tinybird/**/*.md'
            unit-test-globals:
              - 'vitest.config.mjs'
            core-unit-test-globals:
              - 'ghost/core/vitest.config.ts'
              - 'ghost/core/test/utils/vitest-*.ts'
            any-code:
              - '!**/*.md'
              - '!.devcontainer/**'
              - '!.vscode/**'
              - *renovate_only
            # Drives the run_e2e output: matches any changed file that could
            # affect a running Ghost instance. Test files, test config and
            # docs are excluded — a change confined to them cannot alter
            # product behaviour, so the build + E2E lane is skipped.
            # ghost/core test paths are listed today; app test paths can be
            # added here as their conventions are confirmed.
            e2e:
              - '!**/*.md'
              - '!.devcontainer/**'
              - '!.vscode/**'
              - '!ghost/core/test/**'
              - '!ghost/core/vitest.config.ts'
              - *renovate_only

      - name: Define Node test matrix
        id: node_matrix
        run: |
          echo 'matrix=["22.18.0"]' >> $GITHUB_OUTPUT

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Determine Affected Projects
        id: affected
        run: |
          # if the ci files have changed or we're in a tag, ensure we don't just look at affected
          # projects and we run the necessary jobs on all projects
          AFFECTED_ARG="--affected"
          if [[ "${{ steps.changed.outputs.ci }}" == 'true' || "${{ env.IS_TAG }}" == 'true' ]]; then
            AFFECTED_ARG=""
          fi

          AFFECTED_PROJECTS=$(pnpm -s nx show projects ${AFFECTED_ARG} --json)
          echo "affected_projects=$AFFECTED_PROJECTS" >> "$GITHUB_OUTPUT"
          # string list for use in run-many commands
          AFFECTED_PROJECTS_STR=$(pnpm -s nx show projects ${AFFECTED_ARG} --sep=, | tr -d '\n')
          echo "affected_projects_str=$AFFECTED_PROJECTS_STR" >> "$GITHUB_OUTPUT"

          UNIT_TEST_AFFECTED_ARG="$AFFECTED_ARG"
          if [[ "${{ steps.changed.outputs.unit-test-globals }}" == 'true' ]]; then
            UNIT_TEST_AFFECTED_ARG=""
          fi
          UNIT_TEST_PROJECTS_STR=$(pnpm -s nx show projects ${UNIT_TEST_AFFECTED_ARG} --withTarget test:unit --sep=, | tr -d '\n')
          if [[ "${{ steps.changed.outputs.core-unit-test-globals }}" == 'true' ]]; then
            UNIT_TEST_PROJECTS_STR=$(printf '%s\n%s\n' "$UNIT_TEST_PROJECTS_STR" "ghost" | awk 'NF && !seen[$0]++' | paste -sd, -)
          fi
          echo "unit_test_projects_str=$UNIT_TEST_PROJECTS_STR" >> "$GITHUB_OUTPUT"

          # "i18n" tag = packages whose source is scanned by @tryghost/i18n's
          # translate:* scripts (not packages that merely import @tryghost/i18n).
          I18N_PROJECTS=$(pnpm -s nx show projects ${AFFECTED_ARG} --projects 'tag:i18n' --sep=, | tr -d '\n')
          echo "affected_i18n_projects=${I18N_PROJECTS}" >> "$GITHUB_OUTPUT"

          PLAYWRIGHT_PROJECTS=$(pnpm -s nx show projects ${AFFECTED_ARG} \
            --withTarget test:acceptance \
            --projects 'apps/*' \
            --json)
          echo "affected_playwright_projects=$PLAYWRIGHT_PROJECTS" >> "$GITHUB_OUTPUT"

    outputs:
      affected_projects: ${{ steps.affected.outputs.affected_projects }}
      affected_projects_str: ${{ steps.affected.outputs.affected_projects_str }}
      unit_test_projects_str: ${{ steps.affected.outputs.unit_test_projects_str }}
      affected_playwright_projects: ${{ steps.affected.outputs.affected_playwright_projects }}
      changed_i18n_apps: ${{ steps.affected.outputs.affected_i18n_projects != '' }}
      changed_core: ${{ steps.changed.outputs.core }}
      changed_tinybird: ${{ steps.changed.outputs.tinybird }}
      changed_tinybird_datafiles: ${{ steps.changed.outputs.tinybird-datafiles }}
      changed_any_code: ${{ steps.changed.outputs.any-code }}
      # Single gate for the build + browser-E2E lane. True for tags, or when a
      # changed file could affect a running Ghost instance (see the `e2e` path
      # filter above). A test-only / docs-only change keeps this false.
      run_e2e: ${{ env.IS_TAG == 'true' || steps.changed.outputs.e2e == 'true' }}
      is_main: ${{ env.IS_MAIN }}
      is_tag: ${{ env.IS_TAG }}
      is_development: ${{ env.IS_DEVELOPMENT }}
      is_six: ${{ env.IS_SIX }}
      is_six_pr: ${{ env.IS_SIX_PR }}
      member_is_in_org: ${{ steps.check_user_org_membership.outputs.is_member }}
      node_version: ${{ env.NODE_VERSION }}
      node_test_matrix: ${{ steps.node_matrix.outputs.matrix }}
      nx_base: ${{ env.NX_BASE }}

  job_app_version_bump_check:
    name: Check app version bump
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout PR head commit
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Fetch main branch
        run: git fetch --no-tags origin main

      - name: Check app version bump
        env:
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_COMPARE_SHA: ${{ github.event.pull_request.head.sha }}
        run: node .github/scripts/check-app-version-bump.js

  job_migration_integrity_check:
    name: Check migration integrity
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout PR head commit
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Fetch PR base branch
        run: git fetch --no-tags origin "${{ github.event.pull_request.base.ref }}"

      - name: Check migration integrity
        env:
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_COMPARE_SHA: ${{ github.event.pull_request.head.sha }}
        run: node .github/scripts/check-migration-integrity.js

  job_lint:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.affected_projects_str != ''
    name: Lint
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1000
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ghost/**/.eslintcache
          key: eslint-cache

      - name: Lint projects
        run: pnpm nx run-many -t lint -p "${{ needs.job_setup.outputs.affected_projects_str }}"
        env:
          NX_BASE: ${{ needs.job_setup.outputs.nx_base }}
          NX_HEAD: ${{ env.HEAD_COMMIT }}

      - uses: tryghost/actions/actions/slack-build@128d496a57fb11e44e97d690f0d5381c58e52489 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_i18n:
    runs-on: ubuntu-latest
    needs: [job_setup]
    name: i18n
    if: |
      needs.job_setup.outputs.is_tag == 'true'
      || needs.job_setup.outputs.changed_i18n_apps == 'true'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --filter @tryghost/i18n... --ignore-scripts

      - name: Run i18n tests
        run: pnpm --filter @tryghost/i18n test

  job_admin-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: |
      needs.job_setup.outputs.is_tag == 'true'
      || contains(fromJSON(needs.job_setup.outputs.affected_projects), 'ghost-admin')
    name: Admin tests - Chrome
    env:
      MOZ_HEADLESS: 1
      JOBS: 1
      CI: true
      COVERAGE: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - run: pnpm nx run ghost-admin:test
        env:
          BROWSER: Chrome

      # Merge coverage reports and upload
      - name: Merge Admin test coverage
        run: pnpm ember coverage-merge
        working-directory: ghost/admin
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: admin-coverage
          path: ghost/*/coverage/cobertura-coverage.xml

      - uses: tryghost/actions/actions/slack-build@128d496a57fb11e44e97d690f0d5381c58e52489 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_unit-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.unit_test_projects_str != ''
    strategy:
      matrix:
        node: ${{ fromJSON(needs.job_setup.outputs.node_test_matrix) }}
    name: Unit tests (Node ${{ matrix.node }})
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1000
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm

      - name: Install dependencies
        # sqlite3 is an optionalDependency. Without --force, pnpm may skip
        # installing/linking it when restoring from a cached store. --force
        # ensures all optional deps are installed regardless.
        # (ghost core's test:unit job requires sqlite3)
        run: pnpm install --frozen-lockfile --force

      - name: Set timezone (non-UTC)
        uses: szenius/set-timezone@1f9716b0f7120e344f0c62bb7b1ee98819aefd42 # v2.0
        with:
          timezoneLinux: "America/New_York"

      - name: Run unit tests
        # ghost/core's unit tests run on vitest (see ghost/core/vitest.config.ts);
        # other packages run their own test:unit target.
        #
        # Retried up to 3 attempts: ghost/core's vitest run intermittently
        # crashes a worker on loaded CI runners — an abnormal process exit,
        # not a reported test failure. nx caches the projects that already
        # passed, so a retry only re-runs the crashed one. Interim stopgap
        # until the vitest worker/teardown issue is fixed.
        run: |
          for attempt in 1 2 3; do
            pnpm nx run-many -t test:unit -p "${{ needs.job_setup.outputs.unit_test_projects_str }}" && exit 0
            if [ "${attempt}" -lt 3 ]; then
              echo "::warning::Unit tests attempt ${attempt} failed — retrying"
            else
              echo "::error::Unit tests failed after ${attempt} attempts — no more retries"
            fi
          done
          exit 1
        env:
          FORCE_COLOR: 0
          NX_SKIP_LOG_GROUPING: true
          logging__level: fatal

      - name: Check for unexpected file changes
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "Tests generated unexpected file changes. Commit them before merging:"
            git status
            git diff
            exit 1
          fi

      - uses: tryghost/actions/actions/slack-build@128d496a57fb11e44e97d690f0d5381c58e52489 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_acceptance-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.changed_core == 'true'
    services:
      mysql:
        image: ${{ matrix.env.DB == 'mysql8' && 'mysql:8.0' || '' }}
        env:
          MYSQL_DATABASE: ghost_testing
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306
        options: >-
          --tmpfs /var/lib/mysql
          --health-cmd "mysqladmin ping -h 127.0.0.1 -uroot -proot"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=12
      redis:
        image: redis:7.0@sha256:352c1fdadc91926edda08f45aeb3f27f37194c2f14101229c0523a11195c96e3
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=12
    strategy:
      matrix:
        node: ${{ fromJSON(needs.job_setup.outputs.node_test_matrix) }}
        env:
          - DB: mysql8
            NODE_ENV: testing-mysql
        include:
          - node: ${{ needs.job_setup.outputs.node_version }}
            env:
              DB: sqlite3
              NODE_ENV: testing
    env:
      DB: ${{ matrix.env.DB }}
      NODE_ENV: ${{ matrix.env.NODE_ENV }}
    name: Acceptance tests (Node ${{ matrix.node }}, ${{ matrix.env.DB }})
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm

      - name: Install dependencies
        # sqlite3 is an optionalDependency. Without --force, pnpm may skip
        # installing/linking it when restoring from a cached store. --force
        # ensures all optional deps are installed regardless.
        run: |
          if [ "${{ matrix.env.DB }}" = "sqlite3" ]; then
            pnpm install --frozen-lockfile --force
          else
            pnpm install --frozen-lockfile
          fi

      - name: Set timezone (non-UTC)
        uses: szenius/set-timezone@1f9716b0f7120e344f0c62bb7b1ee98819aefd42 # v2.0
        with:
          timezoneLinux: "America/New_York"

      - name: Set env vars (SQLite)
        if: contains(matrix.env.DB, 'sqlite')
        run: echo "database__connection__filename=/dev/shm/ghost-test.db" >> $GITHUB_ENV

      - name: Set env vars (MySQL)
        if: contains(matrix.env.DB, 'mysql')
        run: |
          echo "database__connection__host=127.0.0.1" >> $GITHUB_ENV
          echo "database__connection__port=${{ job.services.mysql.ports['3306'] }}" >> $GITHUB_ENV
          echo "database__connection__password=root" >> $GITHUB_ENV

      - name: E2E tests
        run: pnpm nx run ghost:test:ci:e2e

      - name: Start MinIO for integration tests
        run: |
          docker run -d --rm --name minio \
            -p 9000:9000 \
            -e MINIO_ROOT_USER=minio-user \
            -e MINIO_ROOT_PASSWORD=minio-pass \
            minio/minio:RELEASE.2024-12-13T22-19-12Z@sha256:149fdd73108553247ceee85fc65466f51034bd6e145d6e0c0e415167f5f1274f \
            server /data
          for i in $(seq 1 30); do
            if curl -sf http://127.0.0.1:9000/minio/health/ready; then
              echo "MinIO ready after ${i}s"
              exit 0
            fi
            sleep 1
          done
          echo "MinIO did not become ready in time" >&2
          docker logs minio
          exit 1

      - name: Integration tests
        run: pnpm nx run ghost:test:ci:integration

      - name: Check for unexpected file changes
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "Tests generated unexpected file changes. Commit them before merging:"
            git status
            git diff
            exit 1
          fi

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: matrix.node == env.NODE_VERSION && contains(matrix.env.DB, 'mysql')
        with:
          name: e2e-coverage
          path: |
            ghost/*/coverage-e2e/cobertura-coverage.xml
            ghost/*/coverage-integration/cobertura-coverage.xml

      - uses: tryghost/actions/actions/slack-build@128d496a57fb11e44e97d690f0d5381c58e52489 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_legacy-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.changed_core == 'true'
    services:
      mysql:
        image: ${{ matrix.env.DB == 'mysql8' && 'mysql:8.0' || '' }}
        env:
          MYSQL_DATABASE: ghost_testing
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306
        options: >-
          --tmpfs /var/lib/mysql
          --health-cmd "mysqladmin ping -h 127.0.0.1 -uroot -proot"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=12
    strategy:
      matrix:
        include:
          - node: ${{ needs.job_setup.outputs.node_version }}
            env:
              DB: mysql8
              NODE_ENV: testing-mysql
          - node: ${{ needs.job_setup.outputs.node_version }}
            env:
              DB: sqlite3
              NODE_ENV: testing
    env:
      DB: ${{ matrix.env.DB }}
      NODE_ENV: ${{ matrix.env.NODE_ENV }}
    name: Legacy tests (Node ${{ matrix.node }}, ${{ matrix.env.DB }})
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm

      - name: Install dependencies
        # sqlite3 is an optionalDependency. Without --force, pnpm may skip
        # installing/linking it when restoring from a cached store. --force
        # ensures all optional deps are installed regardless.
        run: |
          if [ "${{ matrix.env.DB }}" = "sqlite3" ]; then
            pnpm install --frozen-lockfile --force
          else
            pnpm install --frozen-lockfile
          fi

      - name: Set env vars (SQLite)
        if: contains(matrix.env.DB, 'sqlite')
        run: echo "database__connection__filename=/dev/shm/ghost-test.db" >> $GITHUB_ENV

      - name: Set env vars (MySQL)
        if: contains(matrix.env.DB, 'mysql')
        run: |
          echo "database__connection__host=127.0.0.1" >> $GITHUB_ENV
          echo "database__connection__port=${{ job.services.mysql.ports['3306'] }}" >> $GITHUB_ENV
          echo "database__connection__password=root" >> $GITHUB_ENV

      - name: Legacy tests
        run: pnpm nx run ghost:test:ci:legacy

      - name: Check for unexpected file changes
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "Tests generated unexpected file changes. Commit them before merging:"
            git status
            git diff
            exit 1
          fi

      - uses: tryghost/actions/actions/slack-build@128d496a57fb11e44e97d690f0d5381c58e52489 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_apps_acceptance-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.affected_playwright_projects != '[]'
    name: App Playwright Acceptance Tests
    strategy:
      fail-fast: false
      matrix:
        app: ${{ fromJSON(needs.job_setup.outputs.affected_playwright_projects) }}
    env:
      CI: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Setup Playwright
        uses: ./.github/actions/setup-playwright

      - name: Run Playwright tests
        run: pnpm nx run ${{ matrix.app }}:test:acceptance

      - name: Get App Name
        if: always()
        id: app_name
        # trim '@tryghost/' prefix for better readability in test report artifact names
        run: |
          APP_NAME="${{ matrix.app }}"
          echo "name=${APP_NAME#@tryghost/}" >> $GITHUB_OUTPUT

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ steps.app_name.outputs.name }}-playwright-report
          path: apps/${{ steps.app_name.outputs.name }}/playwright-report
          retention-days: 30

      - uses: tryghost/actions/actions/slack-build@128d496a57fb11e44e97d690f0d5381c58e52489 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_tinybird-tests:
    name: Tinybird Tests
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.changed_tinybird == 'true'
    defaults:
        run:
          working-directory: ghost/core/core/server/data/tinybird
    services:
      tinybird:
        image: tinybirdco/tinybird-local:latest@sha256:49f65a4197ae7ff4aa923ec53e969c03220fbc1ddc38fba5edfe6832aacbb5db
        ports:
          - 7181:7181
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Install Tinybird CLI
        run: curl -fsSL https://tinybird.co/install.sh | sh
      - name: Build project
        run: tb build
      - name: Test project
        run: tb test run
      - name: Trigger and watch traffic analytics infra Tinybird workflow
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        env:
          GH_TOKEN: ${{ secrets.TRAFFIC_ANALYTICS_GITHUB_TOKEN }}
        uses: ./.github/actions/dispatch-workflow
        with:
          repo: TryGhost/traffic-analytics-infra
          workflow: tinybird.yml
          branch: main
          dispatch-inputs: >-
            {
              "ghost_ref": "${{ github.sha }}",
              "caller_run_id": "${{ github.run_id }}",
              "run_local_tests": false
            }

  job_ghost-cli:
    name: Ghost-CLI tests
    needs: [job_setup, job_build_artifacts]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.changed_core == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install Ghost-CLI
        run: npm install -g ghost-cli@latest

      # Test against the same tarball that npm-publish ships, not a parallel rebuild.
      - name: Download npm tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ghost-npm-tarball

      - run: mv ghost-*.tgz ghost.tgz

      - name: Verify packaged package.json
        run: tar -xOf ghost.tgz package/package.json | jq -e '.packageManager' >/dev/null

      - name: Save Ghost CLI Debug Logs
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ghost-cli-debug-logs
          path: /home/runner/.ghost/logs/

      - name: Clean Install
        run: |
          DIR=$(mktemp -d)
          ghost install local -d "$DIR" --archive "$(pwd)/ghost.tgz"
          URL=$(ghost config get url -d "$DIR" --no-prompt --no-color | tail -n1)
          curl --retry 10 --retry-connrefused --retry-delay 3 -fsSI "$URL"
          ghost stop -d "$DIR"

      - name: Latest Release
        run: |
          DIR=$(mktemp -d)
          ghost install local -d "$DIR"
          ghost update -d "$DIR" --archive "$(pwd)/ghost.tgz"
          URL=$(ghost config get url -d "$DIR" --no-prompt --no-color | tail -n1)
          curl --retry 10 --retry-connrefused --retry-delay 3 -fsSI "$URL"
          ghost stop -d "$DIR"

      - name: Print debug logs
        if: failure()
        run: |
          [ -f ~/.ghost/logs/*.log ] && cat ~/.ghost/logs/*.log

      - uses: tryghost/actions/actions/slack-build@128d496a57fb11e44e97d690f0d5381c58e52489 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_build_artifacts:
    name: Build & Publish Artifacts
    needs: [job_setup]
    # Root of the build + browser-E2E lane (see run_e2e in job_setup).
    if: needs.job_setup.outputs.run_e2e == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build server and admin assets
        run: |
          PKG_VERSION=$(node -p "require('./ghost/core/package.json').version")
          SHORT_SHA="${GITHUB_SHA:0:7}"
          if [ "${{ github.ref_type }}" != "tag" ]; then
            export GHOST_BUILD_VERSION="${PKG_VERSION}+${SHORT_SHA}"
            echo "GHOST_BUILD_VERSION=${GHOST_BUILD_VERSION}" >> $GITHUB_ENV
          fi
          pnpm build:production

      - name: Verify tag matches package.json
        if: startsWith(github.ref, 'refs/tags/v')
        working-directory: ghost/core
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Tag ${GITHUB_REF_NAME} doesn't match package.json version ${PKG_VERSION}"
            exit 1
          fi

      - name: Build standalone distribution
        run: pnpm --filter ghost archive

      - name: Upload npm tarball
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ghost-npm-tarball
          path: ghost/core/ghost-*.tgz
          retention-days: 7
          if-no-files-found: error

      - name: Prepare Docker build context
        run: mv ghost/core/package/ /tmp/ghost-production/

      - name: Determine push strategy
        id: strategy
        run: |
          # Only the canonical repo publishes to GHCR by default.
          # Direct clones, external forks, and cross-repo PRs use artifact-based image transfer instead.
          USE_ARTIFACT="false"
          if [ "${{ github.repository }}" != "TryGhost/Ghost" ]; then
            # Non-canonical repo - no GHCR push
            USE_ARTIFACT="true"
          elif [ "${{ github.event_name }}" = "pull_request" ] && \
               [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
            # Cross-repo PR (fork PR into this repo) — no GHCR push
            USE_ARTIFACT="true"
          fi

          OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')

          # Derive GHCR image names from repository name so each repo gets its own namespace
          # TryGhost/Ghost → ghost-core / ghost, TryGhost/Ghost-Security → ghost-security-core / ghost-security
          REPO_NAME=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')
          if [ "$REPO_NAME" = "ghost" ]; then
            IMAGE_CORE_NAME="ghcr.io/${OWNER}/ghost-core"
            IMAGE_FULL_NAME="ghcr.io/${OWNER}/ghost"
          else
            IMAGE_CORE_NAME="ghcr.io/${OWNER}/${REPO_NAME}-core"
            IMAGE_FULL_NAME="ghcr.io/${OWNER}/${REPO_NAME}"
          fi

          # Force push on canonical tag pushes (release images must always be published)
          IS_TAG="${{ startsWith(github.ref, 'refs/tags/v') }}"
          if [ "$IS_TAG" = "true" ] && [ "${{ github.repository }}" = "TryGhost/Ghost" ]; then
            USE_ARTIFACT="false"
          fi

          echo "use-artifact=$USE_ARTIFACT" >> $GITHUB_OUTPUT
          echo "should-push=$( [ "$USE_ARTIFACT" = "false" ] && echo "true" || echo "false" )" >> $GITHUB_OUTPUT
          echo "owner=$OWNER" >> $GITHUB_OUTPUT
          echo "image-core-name=$IMAGE_CORE_NAME" >> $GITHUB_OUTPUT
          echo "image-full-name=$IMAGE_FULL_NAME" >> $GITHUB_OUTPUT
          echo "image-e2e-name=${IMAGE_FULL_NAME}-e2e" >> $GITHUB_OUTPUT

      - name: Upload admin artifact for CD
        id: upload-admin
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: admin-build-cd
          path: apps/admin/dist
          retention-days: 7
          if-no-files-found: error

      - name: Setup Docker Registry Mirrors
        uses: ./.github/actions/setup-docker-registry-mirrors

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Log in to GitHub Container Registry
        if: steps.strategy.outputs.should-push == 'true'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta (core)
        id: meta-core
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ steps.strategy.outputs.image-core-name }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
            type=semver,pattern=v{{version}}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.title=Ghost Core
            org.opencontainers.image.description=Ghost production build (server only, no admin)
            org.opencontainers.image.vendor=TryGhost

      - name: Docker meta (full)
        id: meta-full
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ steps.strategy.outputs.image-full-name }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
            type=semver,pattern=v{{version}}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.title=Ghost
            org.opencontainers.image.description=Ghost production build (server + admin)
            org.opencontainers.image.vendor=TryGhost

      - name: Build & push core image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        env:
          BUILDKIT_PROGRESS: plain
        with:
          context: /tmp/ghost-production
          file: Dockerfile.production
          target: core
          build-args: |
            NODE_VERSION=${{ env.NODE_VERSION }}
            GHOST_BUILD_VERSION=${{ env.GHOST_BUILD_VERSION }}
          push: ${{ steps.strategy.outputs.should-push }}
          load: ${{ steps.strategy.outputs.should-push == 'false' }}
          tags: ${{ steps.meta-core.outputs.tags }}
          labels: ${{ steps.meta-core.outputs.labels }}
          cache-from: type=registry,ref=${{ steps.strategy.outputs.image-core-name }}:cache-main
          cache-to: ${{ steps.strategy.outputs.should-push == 'true' && format('type=registry,ref={0}:cache-{1},mode=max', steps.strategy.outputs.image-core-name, github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'main') || '' }}

      - name: Build & push full image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        env:
          BUILDKIT_PROGRESS: plain
        with:
          context: /tmp/ghost-production
          file: Dockerfile.production
          target: full
          build-args: |
            NODE_VERSION=${{ env.NODE_VERSION }}
            GHOST_BUILD_VERSION=${{ env.GHOST_BUILD_VERSION }}
          push: ${{ steps.strategy.outputs.should-push }}
          load: ${{ steps.strategy.outputs.should-push == 'false' }}
          tags: ${{ steps.meta-full.outputs.tags }}
          labels: ${{ steps.meta-full.outputs.labels }}
          cache-from: type=registry,ref=${{ steps.strategy.outputs.image-full-name }}:cache-main
          cache-to: ${{ steps.strategy.outputs.should-push == 'true' && format('type=registry,ref={0}:cache-{1},mode=max', steps.strategy.outputs.image-full-name, github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'main') || '' }}

      - name: Save full image as artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        run: |
          IMAGE_TAG=$(echo "${{ steps.meta-full.outputs.tags }}" | head -n1)
          echo "Saving image: $IMAGE_TAG"
          docker save "$IMAGE_TAG" | gzip > docker-image-production.tar.gz
          echo "Image saved as docker-image-production.tar.gz"
          ls -lh docker-image-production.tar.gz

      - name: Upload image artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: docker-image-production
          path: docker-image-production.tar.gz
          retention-days: 1

      - name: Inspect image size and layers
        if: steps.strategy.outputs.use-artifact == 'true'
        shell: bash
        run: |
          IMAGE_TAG=$(echo "${{ steps.meta-full.outputs.tags }}" | head -n1)
          echo "Analyzing Docker image: $IMAGE_TAG"

          # Get the image size in bytes
          IMAGE_SIZE_BYTES=$(docker inspect "$IMAGE_TAG" --format='{{.Size}}')

          # Convert to human readable format
          IMAGE_SIZE_MB=$(( IMAGE_SIZE_BYTES / 1024 / 1024 ))
          IMAGE_SIZE_GB=$(echo "scale=2; $IMAGE_SIZE_BYTES / 1024 / 1024 / 1024" | bc)

          # Format size display based on magnitude
          if [ $IMAGE_SIZE_MB -ge 1024 ]; then
            IMAGE_SIZE_DISPLAY="${IMAGE_SIZE_GB} GB"
          else
            IMAGE_SIZE_DISPLAY="${IMAGE_SIZE_MB} MB"
          fi

          echo "Image size: ${IMAGE_SIZE_DISPLAY}"

          # Write to GitHub Step Summary
          {
            echo "# Docker Image Analysis"
            echo ""
            echo "**Image:** \`$IMAGE_TAG\`"
            echo ""
            echo "**Total Size:** ${IMAGE_SIZE_DISPLAY}"
            echo ""
            echo "## Image Layers"
            echo ""
            echo "| Size | Layer |"
            echo "|------|-------|"

            # Get all layers (including 0B ones)
            docker history "$IMAGE_TAG" --format "{{.Size}}@@@{{.CreatedBy}}" --no-trunc | \
            while IFS='@@@' read -r size cmd; do
              # Clean up the command for display
              cmd_clean=$(echo "$cmd" | sed 's/^\/bin\/sh -c //' | sed 's/^#(nop) //' | sed 's/^@@//' | sed 's/|/\\|/g' | cut -c1-80)
              if [ ${#cmd} -gt 80 ]; then
                cmd_clean="${cmd_clean}..."
              fi
              echo "| $size | \`${cmd_clean}\` |"
            done

          } >> $GITHUB_STEP_SUMMARY

    outputs:
      image-tags: ${{ steps.meta-full.outputs.tags }}
      use-artifact: ${{ steps.strategy.outputs.use-artifact }}
      admin-artifact-id: ${{ steps.upload-admin.outputs.artifact-id }}
      image-e2e-name: ${{ steps.strategy.outputs.image-e2e-name }}

  job_build_e2e_public_apps:
    name: Build E2E Public App Assets
    needs: [job_setup]
    # Root of the build + browser-E2E lane (see run_e2e in job_setup).
    if: needs.job_setup.outputs.run_e2e == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build public apps for E2E
        run: pnpm --filter @tryghost/e2e build:apps

      - name: Pack public app artifacts
        run: |
          tar -czf e2e-public-apps.tar.gz \
            apps/portal/umd \
            apps/comments-ui/umd \
            apps/sodo-search/umd \
            apps/signup-form/umd \
            apps/announcement-bar/umd \
            apps/admin-toolbar/umd
          ls -lh e2e-public-apps.tar.gz

      - name: Upload public app artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: e2e-public-apps
          path: e2e-public-apps.tar.gz
          retention-days: 1

  job_build_e2e_image:
    name: Build E2E Docker Image
    needs: [job_setup, job_build_e2e_public_apps, job_build_artifacts]
    # Inherits the run_e2e gate transitively — runs only when both upstream
    # builds ran and succeeded (they are skipped when run_e2e is false).
    if: needs.job_build_artifacts.result == 'success' && needs.job_build_e2e_public_apps.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Download public app artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: e2e-public-apps

      - name: Extract public app artifacts
        run: tar -xzf e2e-public-apps.tar.gz

      - name: Setup Docker Registry Mirrors
        uses: ./.github/actions/setup-docker-registry-mirrors

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
        with:
          # Fork/cross-repo PRs use artifact transfer (no GHCR push). The default
          # docker-container driver runs in an isolated BuildKit container that
          # cannot see locally loaded images, so we fall back to the docker driver
          # which shares the host daemon's image store.
          driver: ${{ needs.job_build_artifacts.outputs.use-artifact == 'true' && 'docker' || '' }}

      - name: Load base Ghost image
        uses: ./.github/actions/load-docker-image
        id: load-base
        with:
          use-artifact: ${{ needs.job_build_artifacts.outputs.use-artifact }}
          image-tags: ${{ needs.job_build_artifacts.outputs.image-tags }}
          artifact-name: docker-image-production

      - name: Determine E2E image distribution strategy
        id: strategy
        run: |
          USE_ARTIFACT="${{ needs.job_build_artifacts.outputs.use-artifact }}"
          SHOULD_PUSH="true"
          if [ "$USE_ARTIFACT" = "true" ]; then
            SHOULD_PUSH="false"
          fi

          echo "use-artifact=$USE_ARTIFACT" >> $GITHUB_OUTPUT
          echo "should-push=$SHOULD_PUSH" >> $GITHUB_OUTPUT

      - name: Log in to GitHub Container Registry
        if: steps.strategy.outputs.should-push == 'true'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta (e2e)
        id: meta-e2e
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ needs.job_build_artifacts.outputs.image-e2e-name }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.title=Ghost E2E
            org.opencontainers.image.description=Ghost production build with public E2E app bundles
            org.opencontainers.image.vendor=TryGhost

      - name: Build & push E2E image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: e2e/Dockerfile.e2e
          build-args: |
            GHOST_IMAGE=${{ steps.load-base.outputs.image-tag }}
          push: ${{ steps.strategy.outputs.should-push }}
          load: ${{ steps.strategy.outputs.use-artifact == 'true' }}
          tags: ${{ steps.meta-e2e.outputs.tags }}
          labels: ${{ steps.meta-e2e.outputs.labels }}
          cache-from: ${{ steps.strategy.outputs.should-push == 'true' && format('type=registry,ref={0}:cache-main', needs.job_build_artifacts.outputs.image-e2e-name) || '' }}
          cache-to: ${{ steps.strategy.outputs.should-push == 'true' && format('type=registry,ref={0}:cache-{1},mode=max', needs.job_build_artifacts.outputs.image-e2e-name, github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'main') || '' }}

      - name: Save E2E image as artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        run: |
          IMAGE_TAG=$(echo "${{ steps.meta-e2e.outputs.tags }}" | head -n1)
          echo "Saving image: $IMAGE_TAG"
          docker save "$IMAGE_TAG" | gzip > docker-image-e2e.tar.gz
          echo "Image saved as docker-image-e2e.tar.gz"
          ls -lh docker-image-e2e.tar.gz

      - name: Upload E2E image artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: docker-image-e2e
          path: docker-image-e2e.tar.gz
          retention-days: 1

    outputs:
      image-tags: ${{ steps.meta-e2e.outputs.tags }}
      use-artifact: ${{ steps.strategy.outputs.use-artifact }}

  job_e2e_tests:
    name: E2E Tests (${{ matrix.projectName }} ${{ matrix.shardIndex }}/${{ matrix.shardTotal }})
    runs-on: ubuntu-latest
    needs: [job_build_e2e_image, job_setup]
    # Inherits the run_e2e gate transitively via job_build_e2e_image.
    if: needs.job_build_e2e_image.result == 'success'
    strategy:
      fail-fast: true
      matrix:
        include:
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 1
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 2
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 3
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 4
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 5
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 6
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 7
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 8
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 9
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 10
            shardTotal: 10
          - projectName: Analytics
            projects: analytics
            analytics: 'true'
            shardIndex: 1
            shardTotal: 2
          - projectName: Analytics
            projects: analytics
            analytics: 'true'
            shardIndex: 2
            shardTotal: 2
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Docker Registry Mirrors
        uses: ./.github/actions/setup-docker-registry-mirrors

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Pull or build Tinybird CLI Image
        if: matrix.analytics == 'true'
        run: |
          COMPOSE_IMAGE="${COMPOSE_PROJECT_NAME:-ghost-dev}-tb-cli"
          # Try pulling pre-built image from GHCR first (fast path)
          if docker pull ghcr.io/tryghost/tb-cli:latest 2>/dev/null; then
            echo "Pulled tb-cli from GHCR"
            docker tag ghcr.io/tryghost/tb-cli:latest "$COMPOSE_IMAGE"
          else
            echo "GHCR image not available, building from source"
            docker buildx build --load -t "$COMPOSE_IMAGE" -f docker/tb-cli/Dockerfile .
          fi

      - name: Load Image
        uses: ./.github/actions/load-docker-image
        id: load
        with:
          use-artifact: ${{ needs.job_build_e2e_image.outputs.use-artifact }}
          image-tags: ${{ needs.job_build_e2e_image.outputs.image-tags }}
          artifact-name: docker-image-e2e

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Prepare E2E CI job
        env:
          GHOST_E2E_IMAGE: ${{ steps.load.outputs.image-tag }}
          GHOST_E2E_SKIP_IMAGE_BUILD: 'true'
          GHOST_E2E_ANALYTICS: ${{ matrix.analytics }}
        run: bash ./e2e/scripts/prepare-ci-e2e-job.sh

      - name: Run e2e tests in Playwright container
        env:
          TEST_WORKERS_COUNT: 1
          GHOST_E2E_MODE: build
          GHOST_E2E_IMAGE: ${{ steps.load.outputs.image-tag }}
          GHOST_E2E_ANALYTICS: ${{ matrix.analytics }}
          E2E_PLAYWRIGHT_PROJECTS: ${{ matrix.projects }}
          E2E_SHARD_INDEX: ${{ matrix.shardIndex }}
          E2E_SHARD_TOTAL: ${{ matrix.shardTotal }}
          E2E_RETRIES: 2
        run: bash ./e2e/scripts/run-playwright-container.sh

      - name: Dump E2E docker logs
        if: failure()
        run: bash ./e2e/scripts/dump-e2e-docker-logs.sh

      - name: Stop E2E infra
        if: always()
        run: pnpm --filter @tryghost/e2e infra:down

      - name: Upload blob report to GitHub Actions Artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: blob-report-${{ matrix.projectName }}-${{ matrix.shardIndex }}
          path: e2e/blob-report
          retention-days: 1

      - name: Upload test results artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-${{ matrix.projectName }}-${{ matrix.shardIndex }}
          path: e2e/test-results
          retention-days: 7

      - uses: tryghost/actions/actions/slack-build@128d496a57fb11e44e97d690f0d5381c58e52489 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_merge_e2e_reports:
    name: Merge Reports
    if: always() && needs.job_e2e_tests.result == 'failure'
    needs: [job_e2e_tests, job_setup]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Download blob reports from GitHub Actions Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        continue-on-error: true
        with:
          path: e2e/all-blob-reports
          pattern: blob-report-*
          merge-multiple: true

      - name: Check for blob reports
        id: check
        run: |
          if [ -d "e2e/all-blob-reports" ] && [ -n "$(ls -A e2e/all-blob-reports 2>/dev/null)" ]; then
            echo "has_reports=true" >> $GITHUB_OUTPUT
          else
            echo "has_reports=false" >> $GITHUB_OUTPUT
          fi

      - name: Download test results from GitHub Actions Artifacts
        if: steps.check.outputs.has_reports == 'true'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: e2e/all-test-results
          pattern: test-results-*
          merge-multiple: true

      - name: Merge into HTML Report
        if: steps.check.outputs.has_reports == 'true'
        run: npx playwright merge-reports --reporter html ./all-blob-reports
        working-directory: e2e

      - name: Upload HTML report
        if: steps.check.outputs.has_reports == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: playwright-report
          path: e2e/playwright-report
          retention-days: 14

      - name: Upload merged test results
        if: steps.check.outputs.has_reports == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results
          path: e2e/all-test-results
          retention-days: 7

      - name: View Test Report command
        if: steps.check.outputs.has_reports == 'true'
        run: |
          echo -e "::notice::To view the Playwright report locally, run:\n\nREPORT_DIR=\$(mktemp -d) && gh run download ${{ github.run_id }} -n playwright-report -D \"\$REPORT_DIR\" && npx playwright show-report \"\$REPORT_DIR\""

      - name: Comment on PR with test report command
        if: github.event_name == 'pull_request' && steps.check.outputs.has_reports == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh pr comment ${{ github.event.pull_request.number }} --body "## E2E Tests Failed

          To view the Playwright test report locally, run:

          \`\`\`bash
          REPORT_DIR=\$(mktemp -d) && gh run download ${{ github.run_id }} -n playwright-report -D \"\$REPORT_DIR\" && npx playwright show-report \"\$REPORT_DIR\"
          \`\`\`"

  job_coverage:
    name: Coverage
    needs: [
      job_admin-tests,
      job_acceptance-tests,
      job_unit-tests
    ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Restore Admin coverage
        if: contains(needs.job_admin-tests.result, 'success')
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: admin-coverage

      - name: Move coverage
        if: contains(needs.job_admin-tests.result, 'success')
        run: |
          rsync -av --remove-source-files admin/* ghost/admin

      - name: Upload Admin test coverage
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
        with:
          flags: admin-tests

      - name: Restore E2E coverage
        if: contains(needs.job_acceptance-tests.result, 'success')
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: e2e-coverage

      - name: Move coverage
        if: contains(needs.job_acceptance-tests.result, 'success')
        run: |
          rsync -av --remove-source-files core/* ghost/core

      - name: Upload E2E test coverage
        if: contains(needs.job_acceptance-tests.result, 'success')
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
        with:
          flags: e2e-tests

  job_required_tests:
    name: All required tests passed or skipped
    needs:
      [
        job_setup,
        job_app_version_bump_check,
        job_migration_integrity_check,
        job_lint,
        job_i18n,
        job_build_artifacts,
        job_ghost-cli,
        job_admin-tests,
        job_unit-tests,
        job_acceptance-tests,
        job_legacy-tests,
        job_apps_acceptance-tests,
        job_tinybird-tests,
        job_build_e2e_public_apps,
        job_build_e2e_image,
        job_e2e_tests,
        build_packages,
        publish_packages
      ]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Output needs
        run: echo "${{ toJson(needs) }}"

      - name: Check if any required jobs failed or been cancelled
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "One of the dependent jobs have failed or been cancelled. You may need to re-run it." && exit 1

  # Build verification for @tryghost/* public apps.
  # Runs on PRs and pushes. Intentionally has no `id-token: write` — PR-controlled
  # code (nx build) must never execute in a job that can mint an npm OIDC token.
  # The privileged publish flow lives in publish_packages below, gated to main pushes.
  build_packages:
    needs: [
      job_setup,
      job_lint,
      job_unit-tests
    ]
    name: Build ${{ matrix.package_name }}
    runs-on: ubuntu-latest
    if: always() && github.repository == 'TryGhost/Ghost' && needs.job_setup.result == 'success' && needs.job_lint.result == 'success' && needs.job_unit-tests.result == 'success' && needs.job_setup.outputs.run_e2e == 'true'
    permissions:
      contents: read
    strategy:
      matrix:
        include:
          - package_name: '@tryghost/activitypub'
            package_path: 'apps/activitypub'
          - package_name: '@tryghost/portal'
            package_path: 'apps/portal'
          - package_name: '@tryghost/sodo-search'
            package_path: 'apps/sodo-search'
          - package_name: '@tryghost/comments-ui'
            package_path: 'apps/comments-ui'
          - package_name: '@tryghost/signup-form'
            package_path: 'apps/signup-form'
          - package_name: '@tryghost/announcement-bar'
            package_path: 'apps/announcement-bar'
          - package_name: '@tryghost/admin-toolbar'
            package_path: 'apps/admin-toolbar'
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build the package
        run: pnpm nx build ${{ matrix.package_name }}

  # Publishes @tryghost/* public apps to npm via OIDC trusted publishing.
  # Runs only on push-to-main — never on pull_request — so the `id-token: write`
  # permission is never exposed to PR-controlled code (ref: ONC-1677).
  publish_packages:
    needs: [
      job_setup,
      job_lint,
      job_unit-tests,
      build_packages
    ]
    name: Publish ${{ matrix.package_name }}
    runs-on: ubuntu-latest
    if: |
      github.event_name != 'pull_request'
      && github.repository == 'TryGhost/Ghost'
      && needs.job_setup.outputs.is_main == 'true'
      && needs.job_setup.result == 'success'
      && needs.job_lint.result == 'success'
      && needs.job_unit-tests.result == 'success'
      && needs.build_packages.result == 'success'
    permissions:
      id-token: write
    strategy:
      matrix:
        include:
          - package_name: '@tryghost/activitypub'
            package_path: 'apps/activitypub'
            cdn_paths: 'https://cdn.jsdelivr.net/ghost/activitypub@CURRENT_MAJOR/dist/activitypub.js'
          - package_name: '@tryghost/portal'
            package_path: 'apps/portal'
            cdn_paths: 'https://cdn.jsdelivr.net/ghost/portal@~CURRENT_MINOR/umd/portal.min.js'
          - package_name: '@tryghost/sodo-search'
            package_path: 'apps/sodo-search'
            cdn_paths: |
              https://cdn.jsdelivr.net/ghost/sodo-search@~CURRENT_MINOR/umd/sodo-search.min.js
              https://cdn.jsdelivr.net/ghost/sodo-search@~CURRENT_MINOR/umd/main.css
          - package_name: '@tryghost/comments-ui'
            package_path: 'apps/comments-ui'
            cdn_paths: 'https://cdn.jsdelivr.net/ghost/comments-ui@~CURRENT_MINOR/umd/comments-ui.min.js'
          - package_name: '@tryghost/signup-form'
            package_path: 'apps/signup-form'
            cdn_paths: 'https://cdn.jsdelivr.net/ghost/signup-form@~CURRENT_MINOR/umd/signup-form.min.js'
          - package_name: '@tryghost/announcement-bar'
            package_path: 'apps/announcement-bar'
            cdn_paths: 'https://cdn.jsdelivr.net/ghost/announcement-bar@~CURRENT_MINOR/umd/announcement-bar.min.js'
          - package_name: '@tryghost/admin-toolbar'
            package_path: 'apps/admin-toolbar'
            cdn_paths: 'https://cdn.jsdelivr.net/ghost/admin-toolbar@~CURRENT_MINOR/umd/admin-toolbar.min.js'
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check if version changed
        id: version_check
        working-directory: ${{ matrix.package_path }}
        run: |
          CURRENT_VERSION=$(cat package.json | jq -r .version)
          echo "Current version: $CURRENT_VERSION"

          CURRENT_MINOR=$(cat package.json | jq -r .version | awk -F. '{print $1"."$2}')
          echo "current_minor=$CURRENT_MINOR" >> $GITHUB_OUTPUT

          CURRENT_MAJOR=$(cat package.json | jq -r .version | awk -F. '{print $1}')
          echo "current_major=$CURRENT_MAJOR" >> $GITHUB_OUTPUT

          PUBLISHED_VERSION=$(npm show ${{ matrix.package_name }} version || echo "0.0.0")
          echo "Published version (latest): $PUBLISHED_VERSION"

          if [ "$CURRENT_VERSION" = "$PUBLISHED_VERSION" ]; then
            echo "Version is unchanged."
            echo "version_changed=false" >> $GITHUB_OUTPUT
          else
            echo "Version has changed."
            echo "version_changed=true" >> $GITHUB_OUTPUT
          fi

      - name: Build the package
        if: steps.version_check.outputs.version_changed == 'true'
        run: pnpm nx build ${{ matrix.package_name }}

      - name: Configure .npmrc
        if: steps.version_check.outputs.version_changed == 'true'
        run: |
          echo "@tryghost:registry=https://registry.npmjs.org/" >> ~/.npmrc

      # TODO: Check we can remove this once we update Node to v24
      - name: Install v11 of NPM # We need this to install packages via OIDC.
        if: steps.version_check.outputs.version_changed == 'true'
        run: npm install -g npm@11

      - name: Publish to npm
        if: steps.version_check.outputs.version_changed == 'true'
        working-directory: ${{ matrix.package_path }}
        run: |
          pnpm publish --access public --no-git-checks

      - name: Replace version placeholders in cdn-paths
        id: cdn_paths
        if: steps.version_check.outputs.version_changed == 'true'
        run: |
          cdn_paths="${{ matrix.cdn_paths }}"
          echo "cdn_paths<<EOF" >> $GITHUB_OUTPUT
          echo "$cdn_paths" | sed -e 's/CURRENT_MINOR/${{ steps.version_check.outputs.current_minor }}/g' -e 's/CURRENT_MAJOR/${{ steps.version_check.outputs.current_major }}/g' >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Print cdn_paths
        if: steps.version_check.outputs.version_changed == 'true'
        run: echo "${{ steps.cdn_paths.outputs.cdn_paths }}"

      - name: Wait before purging jsDelivr cache
        if: steps.version_check.outputs.version_changed == 'true' && matrix.package_name == '@tryghost/activitypub'
        run: |
          echo "Purging jsDelivr cache immediately after publishing a new version on NPM is unreliable. Waiting 1 minute before purging cache..."
          sleep 60

      - name: Purge jsDelivr cache
        if: steps.version_check.outputs.version_changed == 'true'
        uses: gacts/purge-jsdelivr-cache@8d92aea944f1a3e8ad70505379e1a8ac72d56b73 # v1
        with:
          url: ${{ steps.cdn_paths.outputs.cdn_paths }}

  deploy_tinybird:
    name: Deploy Tinybird
    runs-on: ubuntu-latest
    needs: [
      job_setup,
      job_tinybird-tests
    ]
    if: always() && github.repository == 'TryGhost/Ghost' && github.event_name == 'push' && needs.job_setup.outputs.changed_tinybird_datafiles == 'true' && needs.job_setup.result == 'success' && needs.job_tinybird-tests.result == 'success' && needs.job_setup.outputs.is_main == 'true'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Trigger and watch traffic analytics infra Tinybird workflow
        if: github.repository == 'TryGhost/Ghost'
        env:
          GH_TOKEN: ${{ secrets.TRAFFIC_ANALYTICS_GITHUB_TOKEN }}
        uses: ./.github/actions/dispatch-workflow
        with:
          repo: TryGhost/traffic-analytics-infra
          workflow: tinybird.yml
          branch: main
          dispatch-inputs: >-
            {
              "ghost_ref": "${{ github.sha }}",
              "caller_run_id": "${{ github.run_id }}",
              "run_local_tests": false,
              "deploy_staging": true,
              "deploy_production": true
            }

  # --------------------------------------------------------------------------- #
  # Trigger Pro CD — dispatch to Ghost-Moya cd.yml (runs on main + PRs)
  # --------------------------------------------------------------------------- #
  trigger_cd:
    needs: [job_setup, job_build_artifacts]
    name: Trigger Pro CD
    runs-on: ubuntu-latest
    if: |
      always()
      && github.repository == 'TryGhost/Ghost'
      && needs.job_setup.result == 'success'
      && needs.job_build_artifacts.result == 'success'
      && needs.job_build_artifacts.outputs.use-artifact != 'true'
    steps:
      - name: Determine dispatch parameters
        id: params
        run: |
          if [ "${{ needs.job_setup.outputs.is_main }}" = "true" ]; then
            echo "pr_number=" >> $GITHUB_OUTPUT
            echo "deploy=" >> $GITHUB_OUTPUT
          elif [ "${{ needs.job_setup.outputs.is_tag }}" = "true" ]; then
            echo "pr_number=" >> $GITHUB_OUTPUT
            echo "deploy=" >> $GITHUB_OUTPUT
          elif [ "${{ github.event_name }}" = "pull_request" ]; then
            echo "pr_number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT

            # DISABLED: deploy-to-staging label detection is disabled.
            # The label workflow has fundamental problems — admin deploys are global
            # (not per-site) and main merges overwrite the deployment immediately.
            # See deploy-to-staging.yml for details.
            echo "deploy=" >> $GITHUB_OUTPUT
          else
            echo "skip=true" >> $GITHUB_OUTPUT
            exit 0
          fi
          echo "skip=false" >> $GITHUB_OUTPUT

      - name: Dispatch to Ghost-Moya cd.yml
        if: steps.params.outputs.skip != 'true'
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
        with:
          token: ${{ secrets.CANARY_DOCKER_BUILD }}
          repository: TryGhost/Ghost-Moya
          event-type: ghost-artifacts-ready
          client-payload: >-
            {
              "ref": "${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || github.sha }}",
              "source_repo": "${{ github.repository }}",
              "pr_number": "${{ steps.params.outputs.pr_number }}",
              "deploy": "${{ steps.params.outputs.deploy }}",
              "admin_artifact_id": "${{ needs.job_build_artifacts.outputs.admin-artifact-id }}",
              "admin_artifact_run_id": "${{ github.run_id }}"
            }

  # --------------------------------------------------------------------------- #
  # Publish Ghost npm package — runs on version tags only (OIDC, no stored token)
  # --------------------------------------------------------------------------- #
  publish_ghost:
    needs: [job_ghost-cli]
    name: Publish Ghost to npm
    runs-on: ubuntu-latest
    if: |
      startsWith(github.ref, 'refs/tags/v')
      && github.repository == 'TryGhost/Ghost'
    environment: npm-release
    permissions:
      id-token: write
    steps:
      - name: Download npm tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ghost-npm-tarball

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          package-manager-cache: false

      # TODO: Remove once Node v24 ships with npm >= 11
      - name: Install npm v11 (required for OIDC publishing)
        run: npm install -g npm@11

      - name: Verify tarball contents
        run: tar -xOf ghost-*.tgz package/package.json | jq -e '.packageManager' >/dev/null

      - name: Publish to npm
        run: npm publish ghost-*.tgz --access public

  # --------------------------------------------------------------------------- #
  # Create GitHub Release — runs after successful npm publish
  # --------------------------------------------------------------------------- #
  create_github_release:
    needs: [publish_ghost]
    name: Create GitHub Release
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.CANARY_DOCKER_BUILD }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Resolve previous tag
        id: prev_tag
        run: |
          CURRENT_TAG="${GITHUB_REF_NAME}"
          # Find the tag immediately before this one (excluding pre-releases)
          PREV_TAG=$(git tag --list 'v[0-9]*' --sort=-version:refname | grep -v '-' | grep -v "^${CURRENT_TAG}$" | head -n 1)
          if [ -z "$PREV_TAG" ]; then
            echo "::warning::No previous stable tag found — release notes will use fallback message"
          fi
          echo "tag=${PREV_TAG}" >> "$GITHUB_OUTPUT"
          echo "Previous tag: ${PREV_TAG:-<none>}"

      - name: Generate release notes
        id: notes
        run: |
          PREV_TAG="${{ steps.prev_tag.outputs.tag }}"
          if [ -n "$PREV_TAG" ]; then
            node scripts/lib/release-notes.js "$PREV_TAG" "${GITHUB_REF_NAME}" > /tmp/release-notes.md
          else
            echo "This release contains fixes for minor bugs and issues reported by Ghost users." > /tmp/release-notes.md
          fi
          cat /tmp/release-notes.md

      - name: Create GitHub Release
        id: create_release
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            --title "${GITHUB_REF_NAME}" \
            --notes-file /tmp/release-notes.md

      # Gate on create_release, not notes, so a failed release can't announce success
      - name: Notify Slack
        if: success() && steps.create_release.outcome == 'success'
        run: |
          VERSION="${GITHUB_REF_NAME}"
          RELEASE_URL="https://github.com/TryGhost/Ghost/releases/tag/${VERSION}"
          CHANGELOG=$(cat /tmp/release-notes.md | head -c 3000)

          # Build Slack payload — use --rawfile so newlines in release notes are preserved
          PAYLOAD=$(jq -n \
            --arg header ":ghost: Ghost ${VERSION} is loose! - ${RELEASE_URL}" \
            --rawfile notes /tmp/release-notes.md \
            '{text: ($header + "\n\n" + $notes)}')

          curl -sf -X POST \
            -H 'Content-type: application/json' \
            --data "${PAYLOAD}" \
            "${{ secrets.RELEASE_NOTIFICATION_URL }}" || echo "Slack notification failed (non-fatal)"

  # --------------------------------------------------------------------------- #
  # Notify on any release-path failure — fires if the tag was created but the
  # publish run (build, npm publish, or GitHub Release) failed at any point.
  # A single terminal job catches jobs skipped by an upstream failure, which a
  # per-job `if: failure()` step cannot.
  # --------------------------------------------------------------------------- #
  notify_release_failure:
    name: Notify release failure
    needs: [job_setup, job_build_artifacts, job_ghost-cli, publish_ghost, create_github_release]
    if: failure() && startsWith(github.ref, 'refs/tags/v') && github.repository == 'TryGhost/Ghost'
    runs-on: ubuntu-latest
    permissions: {}  # only posts to Slack via curl; needs no GITHUB_TOKEN scopes
    steps:
      - name: Notify Slack
        env:
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          RELEASE_NOTIFICATION_URL: ${{ secrets.RELEASE_NOTIFICATION_URL }}
        run: |
          VALUE=$(printf '<!subteam^S07ATDH3CLB|on-call-product> — check the failed run: <%s|view run>' "$RUN_URL")
          PAYLOAD=$(jq -n --arg value "$VALUE" \
            '{username: "Ghost CI", attachments: [{color: "danger", fields: [{title: "🚨 Ghost release failed", value: $value}]}]}')
          curl -sf -X POST -H 'Content-type: application/json' \
            --data "$PAYLOAD" \
            "$RELEASE_NOTIFICATION_URL" || echo "Slack notification failed (non-fatal)"