deploy.yml

name: Build, test and deploy webR

on:
  push:
    branches:
      - "main"
    tags:
      - "v*.*"
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  build:
    name: Build webR
    runs-on: ubuntu-latest
    environment: deploy
    container: ghcr.io/r-wasm/flang-wasm:main
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
      - name: Update npm to latest for OIDC support
        run: npm install -g npm@latest
      - name: Set npm dist-tag to "next" if pre-release version
        if: contains(github.ref_name, '-dev') || contains(github.ref_name, '-rc')
        run: echo "DIST_TAG=next" >> $GITHUB_ENV
      - name: Install required system packages
        run: apt-get update && apt-get install -y gh jq sudo libuv1-dev
      - uses: r-lib/actions/setup-r@v2
        with:
          use-public-rspm: true
      - uses: quarto-dev/quarto-actions/setup@v2
      - name: Install required R packages for building documentation
        run: Rscript -e 'install.packages(c("rmarkdown", "rvest"))'
      - name: Configure webR for flang
        env:
          EMFC: /opt/flang/host/bin/flang
        run: ./configure
      - name: Setup Emscripten PATH
        run: echo "/opt/emsdk:/opt/emsdk/upstream/emscripten" >> $GITHUB_PATH
      - name: Set Emscripten EM_NODE_JS
        run: echo "EM_NODE_JS=$(which node)" >> $GITHUB_ENV
      - name: Set the webR CDN URL as the BASE_URL
        run: echo "BASE_URL=https://webr.r-wasm.org/${{ github.ref_name }}/" > "$HOME/.webr-config.mk"
        shell: bash
      - name: Set versioning for main
        if: "contains(github.ref_name, 'main')"
        run: |
          SHA="${{github.event.pull_request.head.sha}}${{ github.sha }}"
          SHORT_SHA=${SHA:0:7}
          VER=$(node -p "require('./src/package.json').version")
          echo "version: ${VER}+${SHORT_SHA}"
          echo "WEBR_VERSION=${VER}+${SHORT_SHA}" >> "$HOME/.webr-config.mk"
          echo "WEBR_VERSION_TAG=latest" >> "$HOME/.webr-config.mk"
        shell: bash
      - name: Set versioning for tag
        if: "!contains(github.ref_name, 'main')"
        run: |
          VER=$(node -p "require('./src/package.json').version")
          echo "version: ${VER}"
          echo "WEBR_VERSION=${VER}" >> "$HOME/.webr-config.mk"
          echo "WEBR_VERSION_TAG=${{ github.ref_name }}" >> "$HOME/.webr-config.mk"
        shell: bash
      - name: Build all optional wasm libs
        env:
          EMSDK: /opt/emsdk
        # Retry: upstream source fetches occasionally fail transiently.
        run: |
          cd libs
          for i in 1 2 3 4 5; do
            make all && exit 0
            rm -rf download
            sleep 300
          done
          exit 1
      - name: Build webR
        env:
          EMSDK: /opt/emsdk
        run: make && make check-pr
        shell: bash
      - name: Build webR documentation
        run: cd src/docs && make
        shell: bash
      - name: Publish to npm
        if: "!contains(github.ref_name, 'main')"
        run: cd src && make publish
      - name: Workaround for codecov/feedback#263
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: Report code coverage
        uses: codecov/codecov-action@v4
        with:
          files: src/coverage/lcov.info
          flags: unittests
          name: codecov-webr
          fail_ci_if_error: true
          verbose: true
          token: ${{ secrets.CC_TOKEN }}
      - name: Archive webR build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: webr-dist
          path: |
            dist
      - name: Archive webR documentation artifacts
        uses: actions/upload-artifact@v4
        with:
          name: webr-docs
          path: |
            src/docs/_site
  deploy:
    name: Deploy webR to S3
    needs: build
    runs-on: ubuntu-latest
    environment: deploy
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Download build archive
        uses: actions/download-artifact@v4
        with:
          name: webr-dist
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE }}
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Upload files to S3 bucket
        run: |
          aws s3 sync . s3://${{ secrets.AWS_S3_BUCKET }}/_webr/${{ github.ref_name }}/
          gzip -k R.wasm
          aws s3 cp --content-encoding="gzip" --content-type="application/wasm" \
            --metadata-directive="REPLACE" R.wasm.gz \
            s3://${{ secrets.AWS_S3_BUCKET }}/_webr/${{ github.ref_name }}/R.wasm
          aws s3 cp --exclude "*" --include "*.js.metadata" --recursive \
            --content-type="text/javascript" --metadata-directive="REPLACE" \
            s3://${{ secrets.AWS_S3_BUCKET }}/_webr/${{ github.ref_name }}/ \
            s3://${{ secrets.AWS_S3_BUCKET }}/_webr/${{ github.ref_name }}/
          aws s3 cp --exclude "*" --include "*.data" --include "*.so" --recursive \
            --content-type="application/wasm" --metadata-directive="REPLACE" \
            s3://${{ secrets.AWS_S3_BUCKET }}/_webr/${{ github.ref_name }}/ \
            s3://${{ secrets.AWS_S3_BUCKET }}/_webr/${{ github.ref_name }}/
          aws cloudfront create-invalidation --distribution-id \
            ${{ secrets.AWS_CLOUDFRONT_DISTRIBUTION_ID }} --paths "/latest/*" \
            "/${{ github.ref_name }}/*"
  deploy_docs:
    name: Deploy webR documentation to S3
    needs: build
    runs-on: ubuntu-latest
    environment: deploy
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Download docs archive
        uses: actions/download-artifact@v4
        with:
          name: webr-docs
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE }}
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Upload files to S3 bucket
        run: |
          aws s3 sync . s3://${{ secrets.AWS_S3_BUCKET }}/_docs/webr/${{ github.ref_name }}/
  build_docker:
    name: Build Docker image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Log in to the GitHub Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
      - name: Build and publish Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          build-args: |
            WEBRCI_SHA=${{ github.sha }}
            MAKE_LIBS_TARGET=all
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-nix:
    name: Build Nix flake
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: nixbuild/nix-quick-install-action@v30
        with:
          nix_conf: "sandbox = false"
      - uses: nix-community/cache-nix-action@v6
        with:
          primary-key: nix-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
          restore-prefixes-first-match: nix-${{ runner.os }}-${{ runner.arch }}
      - name: Build Nix package
        run: nix build --print-build-logs