backstage/.github/workflows/deploy_packages.yml

name: Deploy Packages
on:
  push:
    branches: [master, patch/*]

jobs:
  build:
    runs-on: ubuntu-latest

    outputs:
      needs_release: ${{ steps.release_check.outputs.needs_release }}

    strategy:
      fail-fast: false
      matrix:
        node-version: [22.x, 24.x]

    services:
      postgres18:
        image: postgres:18
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432/tcp
      postgres14:
        image: postgres:14
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432/tcp
      mysql8:
        image: mysql:8
        env:
          MYSQL_ROOT_PASSWORD: root
        options: >-
          --health-cmd "mysqladmin ping -h localhost"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 3306/tcp
      redis:
        image: redis:7
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379/tcp

    env:
      CI: true
      NODE_OPTIONS: --max-old-space-size=8192 --no-node-snapshot --experimental-vm-modules
      INTEGRATION_TEST_GITHUB_TOKEN: ${{ secrets.INTEGRATION_TEST_GITHUB_TOKEN }}
      INTEGRATION_TEST_GITLAB_TOKEN: ${{ secrets.INTEGRATION_TEST_GITLAB_TOKEN }}
      INTEGRATION_TEST_BITBUCKET_TOKEN: ${{ secrets.INTEGRATION_TEST_BITBUCKET_TOKEN }}
      INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: use node.js ${{ matrix.node-version }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node-version }}
          registry-url: https://registry.npmjs.org/ # Needed for auth
          corepack: true
      - name: yarn install
        uses: backstage/actions/yarn-install@2cd6978b476cbdc39fec48346f8b6ca13199dd6a # v0.7.8
        with:
          cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}

      - name: Fetch previous commit for release check
        run: git fetch origin '${{ github.event.before }}'

      - name: Check if release
        if: inputs.force_release != true
        id: release_check
        run: node scripts/check-if-release.js
        env:
          COMMIT_SHA_BEFORE: '${{ github.event.before }}'

      - name: validate config
        run: yarn backstage-cli config:check --lax

      - name: backstage-cli cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: .cache/backstage-cli
          key: ${{ runner.os }}-v${{ matrix.node-version }}-backstage-cli-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-v${{ matrix.node-version }}-backstage-cli-

      - name: lint
        run: yarn backstage-cli repo lint --success-cache --success-cache-dir .cache/backstage-cli

      - name: type checking and declarations
        run: yarn tsc:full

      - name: build
        run: yarn backstage-cli repo build --all

      - name: verify type dependencies
        run: yarn lint:type-deps

      - name: test (and upload coverage)
        run: |
          yarn backstage-cli repo test --maxWorkers=3 --workerIdleMemoryLimit=1300M --coverage --success-cache --success-cache-dir .cache/backstage-cli
        env:
          BACKSTAGE_TEST_DISABLE_DOCKER: 1
          BACKSTAGE_TEST_DATABASE_POSTGRES18_CONNECTION_STRING: postgresql://postgres:postgres@localhost:${{ job.services.postgres18.ports[5432] }}
          BACKSTAGE_TEST_DATABASE_POSTGRES14_CONNECTION_STRING: postgresql://postgres:postgres@localhost:${{ job.services.postgres14.ports[5432] }}
          BACKSTAGE_TEST_DATABASE_MYSQL8_CONNECTION_STRING: mysql://root:root@localhost:${{ job.services.mysql8.ports[3306] }}/ignored
          BACKSTAGE_TEST_CACHE_REDIS7_CONNECTION_STRING: redis://localhost:${{ job.services.redis.ports[6379] }}

      - name: Discord notification
        if: ${{ failure() }}
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        with:
          script: |
            const webhook = process.env.DISCORD_WEBHOOK;
            if (!webhook) {
              throw new Error('DISCORD_WEBHOOK secret is not set');
            }
            const repo = context.repo.owner + '/' + context.repo.repo;
            const runId = context.runId;
            const message = `Master build failed https://github.com/${repo}/actions/runs/${runId}`;
            const response = await fetch(webhook, {
              method: 'POST',
              headers: { 'Content-Type': 'application/json' },
              body: JSON.stringify({ content: message }),
            });
            if (!response.ok) {
              throw new Error(`Discord webhook request failed: ${response.status} ${response.statusText}`);
            }

  # A separate release build that is only run for commits that are the result of merging the "Version Packages" PR
  # We can't re-use the output from the above step, but we'll have a guaranteed node_modules cache and
  # only run the build steps that are necessary for publishing
  release:
    needs: build

    if: needs.build.outputs.needs_release == 'true'

    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [22.x]

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit

      # Notify maintainers that a new release is ready to be published
      - name: Discord notification
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_MAINTAINERS_WEBHOOK }}
        with:
          script: |
            const webhook = process.env.DISCORD_WEBHOOK;
            if (!webhook) {
              throw new Error('DISCORD_MAINTAINERS_WEBHOOK secret is not set');
            }
            const sha = context.sha;
            const message = `A new release is ready to be [published](https://github.com/backstage/publishing/actions/workflows/publish-main.yml) from ${sha}`;
            const response = await fetch(webhook, {
              method: 'POST',
              headers: { 'Content-Type': 'application/json' },
              body: JSON.stringify({ content: message }),
            });
            if (!response.ok) {
              throw new Error(`Discord webhook request failed: ${response.status} ${response.statusText}`);
            }