superset2/.github/workflows/superset-frontend.yml

name: "Frontend Build CI (unit tests, linting & sanity checks)"

on:
  push:
    branches:
      - "master"
      - "[0-9].[0-9]*"
  pull_request:
    types: [synchronize, opened, reopened, ready_for_review]

# cancel previous workflow jobs for PRs
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

env:
  TAG: apache/superset:GHA-${{ github.run_id }}

permissions:
  contents: read

jobs:
  frontend-build:
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    # The change detector reads the PR's file list, which needs
    # `pull-requests: read`. Public repos serve that endpoint without it;
    # private forks return 403.
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should-run: ${{ steps.check.outputs.frontend }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}

      - name: Check for File Changes
        id: check
        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Docker Image
        if: steps.check.outputs.frontend
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "git rev-parse --short HEAD"
          git rev-parse --short HEAD
          echo "git show -s --format=raw HEAD"
          git show -s --format=raw HEAD
          docker buildx build \
            -t $TAG \
            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
            --target superset-node-ci \
            .

      - name: Save Docker Image as Artifact
        if: steps.check.outputs.frontend
        run: |
          docker save $TAG | zstd -3 --threads=0 > docker-image.tar.zst

      - name: Upload Docker Image Artifact
        if: steps.check.outputs.frontend
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: docker-image
          path: docker-image.tar.zst

  sharded-jest-tests:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
    strategy:
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8]
      fail-fast: false
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    steps:
      - name: Download Docker Image Artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: docker-image

      - name: Load Docker Image
        run: |
          zstd -d < docker-image.tar.zst | docker load

      - name: npm run test with coverage
        run: |
          mkdir -p ${{ github.workspace }}/superset-frontend/coverage
          docker run \
          -v ${{ github.workspace }}/superset-frontend/coverage:/app/superset-frontend/coverage \
          --rm $TAG \
          bash -c \
          "npm run test -- --coverage --shard=${{ matrix.shard }}/8 --coverageReporters=json"

      - name: Upload Coverage Artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: coverage-artifacts-${{ matrix.shard }}
          path: superset-frontend/coverage

  report-coverage:
    needs: [sharded-jest-tests]
    if: needs.frontend-build.outputs.should-run == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 15
    permissions:
      id-token: write
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}

      - name: Download Coverage Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: coverage-artifacts-*
          path: coverage/

      - name: Upload Code Coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          flags: javascript
          use_oidc: true
          verbose: true
          directory: coverage
          slug: apache/superset

  lint-frontend:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    steps:
      - name: Download Docker Image Artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: docker-image

      - name: Load Docker Image
        run: |
          zstd -d < docker-image.tar.zst | docker load

      - name: lint
        run: |
          docker run --rm $TAG bash -c \
          "npm i && npm run lint"

      - name: tsc
        run: |
          docker run --rm $TAG bash -c \
          "npm i && npm run plugins:build && npm run type"

  validate-frontend:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    steps:
      - name: Download Docker Image Artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: docker-image

      - name: Load Docker Image
        run: |
          zstd -d < docker-image.tar.zst | docker load

      - name: Validate dependency tree
        run: |
          docker run --rm $TAG bash -c \
          "npm ls --all --package-lock-only --depth=0 --json > /dev/null"

  test-storybook:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 25
    steps:
      - name: Download Docker Image Artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: docker-image

      - name: Load Docker Image
        run: |
          zstd -d < docker-image.tar.zst | docker load

      - name: Build Storybook and Run Tests
        run: |
          docker run --rm $TAG bash -c \
          "npm run build-storybook && npx playwright install-deps && npx playwright install chromium && npm run test-storybook:ci"

  actions-timeline:
    needs: [report-coverage, lint-frontend, validate-frontend, test-storybook]
    if: always()
    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true

  # Compares a PR's own bundle size against the last nightly-recorded
  # baseline (see frontend-bundle-size-nightly.yml, which owns actually
  # persisting new baselines). PR-only: a push to master doesn't need this
  # check re-run against itself, and re-persisting the baseline on every
  # push to master -- which happens many times a day -- would burn a full
  # production build for no benefit nightly refresh doesn't already cover.
  bundle-size:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true' && github.event_name == 'pull_request'
    runs-on: ubuntu-26.04
    timeout-minutes: 15
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}

      - name: Download Docker Image Artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: docker-image

      - name: Load Docker Image
        run: |
          zstd -d < docker-image.tar.zst | docker load

      # webpack's persistent filesystem cache (superset-frontend/webpack.config.js)
      # turns a warm production build into ~20s instead of several minutes,
      # but GH-hosted runners are fresh VMs with nothing carried over between
      # jobs -- without restoring it explicitly, every single PR would pay
      # the full cold-build cost. Keyed on the same files webpack's own
      # `buildDependencies` invalidates on, so a stale cache is never used.
      - name: Restore webpack build cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: superset-frontend/.temp_cache
          key: >-
            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
            'superset-frontend/webpack.config.js') }}

      # Only ever pull the last recorded data point off the cache, keyed by
      # run ID -- `restore-keys` prefix-matches the most recently created
      # entry, which is always the latest nightly run. Absent before the
      # first nightly run ever happens; benchmark-action starts a fresh
      # history in that case.
      - name: Restore bundle size history
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: bundle-size-history.json
          key: bundle-size-history-${{ github.run_id }}
          restore-keys: |
            bundle-size-history-

      - name: Build production bundle with stats
        run: |
          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
          docker run \
          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
          --rm $TAG \
          bash -c \
          "npm i && BUNDLE_SIZE_STATS=true npm run build -- --json=bundle-stats/stats.json"

      - name: Summarize bundle size
        run: |
          node superset-frontend/scripts/bundle-size-summary.js \
            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
          rm -rf superset-frontend/bundle-stats

      # Comparison + alert only -- this job never persists. See
      # frontend-bundle-size-nightly.yml for why.
      #
      # comment-on-alert is gated to same-repo PRs: on a fork PR,
      # GITHUB_TOKEN is forced read-only regardless of the `permissions`
      # block above, so once the alert threshold is crossed the action's
      # `pulls.createReview` call 403s. That error isn't gated by
      # fail-on-alert (which only governs the deliberate alert-threshold
      # failure) -- it propagates and fails the job outright. Fork PRs
      # still get the comparison via the job summary (summary-always).
      - name: Compare bundle size against nightly baseline
        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
        with:
          tool: customSmallerIsBetter
          output-file-path: bundle-size-summary.json
          external-data-json-path: bundle-size-history.json
          github-token: ${{ secrets.GITHUB_TOKEN }}
          comment-on-alert: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
          alert-threshold: "110%"
          fail-on-alert: false
          summary-always: true