build-test-measure.yml

name: Build, test & measure

on:
  push:
    branches:
      - develop
      # Include all release branches.
      - '[0-9]+.[0-9]+'
  pull_request:
    # Run workflow whenever a PR is opened, updated (synchronized), or marked ready for review.
    types: [opened, synchronize, ready_for_review]

# Cancel previous workflow run groups that have not completed.
concurrency:
  # Group workflow runs by workflow name, along with the head branch ref of the pull request
  # or otherwise the branch or tag ref.
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}
  cancel-in-progress: true

# Disable permissions for all available scopes.
# Enable permissions for specific scopes as needed on job level.
permissions: {}

jobs:
  pre-run:
    name: 'Pre run'
    runs-on: ubuntu-latest
    outputs:
      changed-file-count: ${{ steps.determine-file-counts.outputs.count }}
      changed-php-count: ${{ steps.determine-file-counts.outputs.php-count }}
      changed-css-count: ${{ steps.determine-file-counts.outputs.css-count }}
      changed-js-count: ${{ steps.determine-file-counts.outputs.js-count }}
      changed-gha-workflow-count: ${{ steps.determine-file-counts.outputs.gha-workflow-count }}
    steps:
      - name: Checkout including last 2 commits
        # Fetch last 2 commits if it's not a PR, so that we can determine the list of modified files.
        if: ${{ github.base_ref == null }}
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
        with:
          fetch-depth: 2

      - name: Checkout
        # Do usual checkout if it's a PR.
        if: ${{ github.base_ref != null }}
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Determine modified files
        id: determine-file-counts
        uses: ./.github/actions/determine-changed-files

#-----------------------------------------------------------------------------------------------------------------------

  lint-css:
    needs: pre-run
    if: needs.pre-run.outputs.changed-css-count > 0 || needs.pre-run.outputs.changed-gha-workflow-count > 0
    name: 'Lint: CSS'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup NodeJS and NPM
        uses: ./.github/actions/setup-node-npm

      - name: Detect coding standard violations (stylelint)
        run: npm run lint:css

#-----------------------------------------------------------------------------------------------------------------------

  lint-js:
    name: 'Lint: JS'
    needs: pre-run
    if: needs.pre-run.outputs.changed-js-count > 0 || needs.pre-run.outputs.changed-gha-workflow-count > 0
    runs-on: ubuntu-latest
    permissions:
      checks: write
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup NodeJS and NPM
        uses: ./.github/actions/setup-node-npm

      - name: Validate package.json
        run: npm run lint:pkg-json

      - name: Detect ESLint coding standard violations
        if: >
          github.event.pull_request.head.repo.fork == true ||
          github.event.pull_request.user.login == 'dependabot[bot]'
        run: npm run lint:js

      - name: Generate ESLint coding standard violations report
        # Prevent generating the ESLint report if PR is from a fork or authored by Dependabot.
        if: >
          ! ( github.event.pull_request.head.repo.fork == true ||
          github.event.pull_request.user.login == 'dependabot[bot]' )
        run: npm run lint:js:report
        continue-on-error: true

      - name: Annotate code linting results
        # The action cannot annotate the PR when run from a PR fork or was authored by Dependabot.
        if: >
          ! ( github.event.pull_request.head.repo.fork == true ||
          github.event.pull_request.user.login == 'dependabot[bot]' )
        uses: ataylorme/eslint-annotate-action@d57a1193d4c59cbfbf3f86c271f42612f9dbd9e9 #3.0.0
        with:
          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
          report-json: 'lint-js-report.json'

#-----------------------------------------------------------------------------------------------------------------------

  lint-php:
    name: 'Lint: PHP'
    needs: pre-run
    if: needs.pre-run.outputs.changed-php-count > 0 || needs.pre-run.outputs.changed-gha-workflow-count > 0
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup PHP and Composer
        uses: ./.github/actions/setup-php-composer
        with:
          tools: 'composer,cs2pr,composer-normalize'
          php-version: '8.1'

      - name: Detect coding standard violations (PHPCS)
        run: vendor/bin/phpcs -q --report=checkstyle --runtime-set ignore_errors_on_exit 1 --runtime-set ignore_warnings_on_exit 1 | cs2pr --graceful-warnings

      - name: Validate composer.json
        run: composer --no-interaction validate --no-check-all

      - name: Normalize composer.json
        run: |
          composer config --no-interaction --no-plugins allow-plugins.ergebnis/composer-normalize true
          composer-normalize --dry-run --diff

#-----------------------------------------------------------------------------------------------------------------------

  static-analysis-php:
    name: 'Static Analysis: PHP'
    runs-on: ubuntu-latest
    needs: pre-run
    if: needs.pre-run.outputs.changed-php-count > 0 || needs.pre-run.outputs.changed-gha-workflow-count > 0
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup PHP and Composer
        uses: ./.github/actions/setup-php-composer
        with:
          tools: 'composer,phpstan'
          php-version: '8.1'

      - name: Static Analysis (PHPStan)
        run: phpstan analyze

#-----------------------------------------------------------------------------------------------------------------------

  unit-test-js:
    name: 'Unit test: JS'
    runs-on: ubuntu-latest
    needs: pre-run
    if: needs.pre-run.outputs.changed-js-count > 0 || needs.pre-run.outputs.changed-gha-workflow-count > 0
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup NodeJS and NPM
        uses: ./.github/actions/setup-node-npm

      - name: Setup Jest cache
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
        with:
          path: ~/.jest-cache
          key: ${{ runner.os }}-jest

      - name: Run unit tests (with coverage)
        run: npm run test:js -- --ci --cacheDirectory="$HOME/.jest-cache" --collectCoverage

      - name: Upload code coverage report
        if: github.actor != 'dependabot[bot]'
        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 #v4.5.0
        with:
          file: build/logs/lcov.info
          flags: javascript
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

#-----------------------------------------------------------------------------------------------------------------------

  e2e-test-js:
    name: 'E2E test: JS'
    needs: pre-run
    if: needs.pre-run.outputs.changed-file-count > 0
    runs-on: ubuntu-latest
    permissions:
      actions: write
    env:
      WP_BASE_URL: 'http://127.0.0.1:8890'
      JEST_PUPPETEER_CONFIG: './tests/e2e/puppeteer.config.js'
    strategy:
      fail-fast: false
      matrix:
          part: [1, 2]
          totalParts: [2]
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup NodeJS and NPM
        uses: ./.github/actions/setup-node-npm

      - name: Setup PHP and Composer
        uses: ./.github/actions/setup-php-composer

      - name: Build plugin
        uses: ./.github/actions/plugin-build

      - name: Setup Jest cache
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
        with:
          path: ~/.jest-cache
          key: ${{ runner.os }}-jest-e2e-${{ matrix.part }}

      - name: Start Docker environment
        run: npm run env:start:ci
        env:
          COMPOSE_INTERACTIVE_NO_CLI: true

        # Avoid adding any logs to stdout/stderr, while getting the list of E2E tests.
      - name: Set NPM log level
        run: export npm_config_loglevel=silent

      - name: Get E2E test files
        run: npx wp-scripts test-e2e --config=tests/e2e/jest-ci.config.js --listTests > $RUNNER_TEMP/.jest-e2e-tests

      - name: Unset NPM log level
        run: unset npm_config_loglevel

      - name: Run E2E tests
        run: npx wp-scripts test-e2e --config=tests/e2e/jest-ci.config.js --cacheDirectory="$HOME/.jest-cache" --runTestsByPath $( awk 'NR % ${{ matrix.totalParts }} == ${{ matrix.part }} - 1' < $RUNNER_TEMP/.jest-e2e-tests )

      - name: Stop Docker environment
        run: npm run env:stop:ci
        if: always()
        env:
          COMPOSE_INTERACTIVE_NO_CLI: true

      - name: Archive debug artifacts (screenshots, HTML snapshots)
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 #v4.3.3
        if: always()
        with:
          name: e2e-failure-artifacts
          path: artifacts
          if-no-files-found: ignore

#-----------------------------------------------------------------------------------------------------------------------

  # Adapted from workflow for running PHP unit tests on google/web-stories-wp.
  # See https://github.com/google/web-stories-wp/blob/cb2ebada48039171e25c279bdb27d3712dd70b22/.github/workflows/continuous-integration-unit-php.yml
  unit-test-php:
    name: "Unit test${{ matrix.coverage && ' (with coverage)' || '' }}: PHP ${{ matrix.php }}, WP ${{ matrix.wp }}"
    runs-on: ubuntu-latest
    needs: pre-run
    env:
      WP_CORE_DIR: /tmp/wordpress
      WP_TESTS_DIR: /tmp/wordpress-tests-lib
      WP_ENVIRONMENT_TYPE: local
    services:
      mysql:
        image: mariadb:latest
        env:
          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
          MARIADB_DATABASE: wordpress_test
          MARIADB_MYSQL_LOCALHOST_USER: 1
          MARIADB_MYSQL_LOCALHOST_GRANTS: USAGE
        ports:
          - 3306
        options: --health-cmd="healthcheck.sh --su-mysql --connect --innodb_initialized" --health-interval=10s --health-timeout=5s --health-retries=3
    continue-on-error: ${{ matrix.experimental == true }}
    strategy:
      fail-fast: false
      matrix:
        php: ['8.0']
        wp: ['latest']
        external-http: [false]
        install-pwa-plugin: [true]
        coverage: [false]
        include:
          - php: '8.3'
            wp: 'trunk'
            phpunit: '9.6'
            experimental: true

          - php: '8.2'
            wp: 'trunk'
            phpunit: '9.6'

          - php: '8.1'
            wp: 'trunk'
            phpunit: '9.6'

          - php: '8.0'
            wp: 'trunk'
            phpunit: '9.3'
            multisite: true

          - php: '8.0'
            wp: 'latest'
            phpunit: '9.3'
            coverage: true

          - php: '8.0'
            wp: 'latest'
            phpunit: '9.3'
            external-http: true

          - php: '7.4'
            wp: 'latest'
            phpunit: '9.3'
            multisite: true

          - php: '7.4'
            wp: 'latest'
            phpunit: '9.3'
            external-http: true

          - php: '7.4'
            wp: '6.3'
            phpunit: '7'

          - php: '7.4'
            wp: '6.3'
            phpunit: '7'
            external-http: true
    steps:
      # Note: The repeated `needs.pre-run.outputs.changed-php-count > 0` checks would be avoided if a step could short-
      # circuit per <https://github.com/actions/runner/issues/662>. The reason why the if statement can't be put on the
      # job as a whole is because the name is variable based on the matrix, and if the condition is not met then the
      # name won't be interpolated in order to match the required jobs set up in branch protection.
      - name: Notice
        if: needs.pre-run.outputs.changed-php-count == 0
        run: echo "No PHP files were changed so no PHP unit tests will run"

      - name: Shutdown default MySQL service
        if: needs.pre-run.outputs.changed-php-count > 0
        run: sudo service mysql stop

      - name: Verify MariaDB connection
        if: needs.pre-run.outputs.changed-php-count > 0
        run: |
          retry_count=0
          max_retries=5

          while [ $retry_count -lt $max_retries ]; do
            if mysqladmin ping -h"127.0.0.1" -P"${{ job.services.mysql.ports[3306] }}" --silent; then
              break
            else
              ((retry_count++))
              sleep 5
            fi
          done

          if [ $retry_count -ge $max_retries ]; then
            echo "::error::Failed to establish a MariaDB connection after $max_retries retries."
            exit 1
          fi

      - name: Checkout
        if: needs.pre-run.outputs.changed-php-count > 0
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup PHP and Composer
        if: needs.pre-run.outputs.changed-php-count > 0
        uses: ./.github/actions/setup-php-composer
        with:
          php-version: ${{ matrix.php }}
          coverage: ${{ matrix.coverage && 'xdebug' || 'none' }}
          tools: 'composer,phpunit:${{ matrix.phpunit }}'

      - name: Setup NodeJS and NPM
        if: needs.pre-run.outputs.changed-php-count > 0
        uses: ./.github/actions/setup-node-npm

      - name: Build plugin
        if: needs.pre-run.outputs.changed-php-count > 0
        uses: ./.github/actions/plugin-build

      # Avoid conflicts with globally installed PHPUnit.
      - name: Remove locally installed PHPUnit
        if: needs.pre-run.outputs.changed-php-count > 0
        run: |
          rm -rf vendor/phpunit
          composer dump-autoload -o

      # Scan the logs for failing tests and surface that information by creating annotations and log file decorations.
      - name: Setup problem matcher to provide annotations for PHPUnit
        if: needs.pre-run.outputs.changed-php-count > 0
        # The JSON file is provided by the `shivammathur/setup-php` action. See https://github.com/shivammathur/setup-php#problem-matchers.
        run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"

      - name: Install WP tests
        if: needs.pre-run.outputs.changed-php-count > 0
        run: bash bin/ci/install-wp-tests.sh wordpress_test root '' 127.0.0.1:${{ job.services.mysql.ports['3306'] }} ${{ matrix.wp }} true

      - name: Post install of WP tests
        if: needs.pre-run.outputs.changed-php-count > 0
        run: bash bin/ci/after-wp-install.sh ${{ matrix.wp }} ${{ matrix.install-pwa-plugin == true }}

      - name: Copy plugin to WP plugins directory
        if: needs.pre-run.outputs.changed-php-count > 0
        run: cp -r "$PWD" "$WP_CORE_DIR/src/wp-content/plugins/amp"

      - name: Override default PHPUnit configuration
        if: ${{ matrix.experimental == true && needs.pre-run.outputs.changed-php-count > 0 }}
        run: |
          cp phpunit.xml.dist phpunit.xml

          # Avoid converting deprecations, errors, notices, and warnings to exceptions in experimental mode.
          sed -i 's/convertDeprecationsToExceptions="true"/convertDeprecationsToExceptions="false"/g' phpunit.xml
          sed -i 's/convertErrorsToExceptions="true"/convertErrorsToExceptions="false"/g' phpunit.xml
          sed -i 's/convertNoticesToExceptions="true"/convertNoticesToExceptions="false"/g' phpunit.xml
          sed -i 's/convertWarningsToExceptions="true"/convertWarningsToExceptions="false"/g' phpunit.xml
        working-directory: ${{ env.WP_CORE_DIR }}/src/wp-content/plugins/amp

      - name: Run Single Site tests
        if: ${{ matrix.multisite == false && needs.pre-run.outputs.changed-php-count > 0 }}
        run: |
            if [[ ${{ matrix.external-http == false }} == true && ${{ matrix.coverage == false }} == true ]]; then
              phpunit --verbose
            elif [[ ${{ matrix.external-http == true }} == true && ${{ matrix.coverage == false }} == true ]]; then
              phpunit --testsuite external-http --verbose
            elif [[ ${{ matrix.external-http == false }} == true && ${{ matrix.coverage == true }} == true ]]; then
              phpunit --verbose --coverage-clover ${{ env.WP_CORE_DIR }}/src/wp-content/plugins/amp/build/logs/clover.xml
            elif [[ ${{ matrix.external-http == true }} == true && ${{ matrix.coverage == true }} == true ]]; then
              phpunit --testsuite external-http --verbose --coverage-clover ${{ env.WP_CORE_DIR }}/src/wp-content/plugins/amp/build/logs/clover.xml
            fi
        working-directory: ${{ env.WP_CORE_DIR }}/src/wp-content/plugins/amp

      - name: Run multisite tests
        if: ${{ matrix.multisite == true && needs.pre-run.outputs.changed-php-count > 0 }}
        run: |
          if [[ ${{ matrix.external-http == false }} == true && ${{ matrix.coverage == false }} == true ]]; then
            phpunit --verbose
          elif [[ ${{ matrix.external-http == true }} == true && ${{ matrix.coverage == false }} == true ]]; then
            phpunit --testsuite external-http --verbose
          elif [[ ${{ matrix.external-http == false }} == true && ${{ matrix.coverage == true }} == true ]]; then
            phpunit --verbose --coverage-clover ${{ env.WP_CORE_DIR }}/src/wp-content/plugins/amp/build/logs/clover.xml
          elif [[ ${{ matrix.external-http == true }} == true && ${{ matrix.coverage == true }} == true ]]; then
            phpunit --testsuite external-http --verbose --coverage-clover ${{ env.WP_CORE_DIR }}/src/wp-content/plugins/amp/build/logs/clover.xml
          fi
        working-directory: ${{ env.WP_CORE_DIR }}/src/wp-content/plugins/amp
        env:
          WP_MULTISITE: 1

      - name: Upload code coverage report
        if: ${{ matrix.coverage == true && needs.pre-run.outputs.changed-php-count > 0 && github.actor != 'dependabot[bot]' }}
        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 #v4.5.0
        with:
          file: ${{ env.WP_CORE_DIR }}/src/wp-content/plugins/amp/build/logs/clover.xml
          flags: php,unit
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}

#-----------------------------------------------------------------------------------------------------------------------

  feature-test-php:
    name: "Feature tests: PHP ${{ matrix.php }}, WP ${{ matrix.wp }}"
    needs: pre-run
    if: needs.pre-run.outputs.changed-php-count > 0
    runs-on: ubuntu-latest
    env:
      # @see <https://github.com/wp-cli/wp-cli-tests?tab=readme-ov-file#wordpress-version>.
      WP_VERSION: ${{ matrix.wp }}
    services:
      mysql:
        image: mariadb:latest
        env:
          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
          MARIADB_DATABASE: wordpress_test
          MARIADB_MYSQL_LOCALHOST_USER: 1
          MARIADB_MYSQL_LOCALHOST_GRANTS: USAGE
        ports:
          - 3306
        options: --health-cmd="healthcheck.sh --su-mysql --connect --innodb_initialized" --health-interval=10s --health-timeout=5s --health-retries=3
    continue-on-error: ${{ matrix.experimental == true }}
    strategy:
      fail-fast: false
      matrix:
        php: ['7.4']
        wp: ['latest']
        include:
          - php: '8.3'
            wp: 'trunk'
            experimental: true

          - php: '8.2'
            wp: 'trunk'
            experimental: true

          - php: '8.1'
            wp: 'trunk'

          - php: '8.0'
            wp: 'latest'

          - php: '7.4'
            wp: '6.3'
    steps:
      - name: Shutdown default MySQL service
        if: needs.pre-run.outputs.changed-php-count > 0
        run: sudo service mysql stop

      - name: Verify MariaDB connection
        if: needs.pre-run.outputs.changed-php-count > 0
        run: |
          retry_count=0
          max_retries=5

          while [ $retry_count -lt $max_retries ]; do
            if mysqladmin ping -h"127.0.0.1" -P"${{ job.services.mysql.ports[3306] }}" --silent; then
              break
            else
              ((retry_count++))
              sleep 5
            fi
          done

          if [ $retry_count -ge $max_retries ]; then
            echo "::error::Failed to establish a MariaDB connection after $max_retries retries."
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup PHP and Composer
        uses: ./.github/actions/setup-php-composer
        with:
          php-version: ${{ matrix.php }}

      - name: Setup NodeJS and NPM
        uses: ./.github/actions/setup-node-npm

      - name: Build plugin
        uses: ./.github/actions/plugin-build

      - name: Configure DB environment
        run: |
          echo "MYSQL_HOST=127.0.0.1" >> $GITHUB_ENV
          echo "MYSQL_TCP_PORT=${{ job.services.mysql.ports['3306'] }}" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBROOTUSER=root" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBROOTPASS=" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBUSER=wp_cli_test" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBPASS=password1" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBHOST=127.0.0.1:${{ job.services.mysql.ports['3306'] }}" >> $GITHUB_ENV

      - name: Prepare test database
        run: composer prepare-tests

      - name: Run tests
        run: ./vendor/bin/behat

#-----------------------------------------------------------------------------------------------------------------------

  build-zip:
    name: 'Build: ${{ matrix.build }} build ZIP'
    needs: pre-run
    # Only run if the PR was not authored by Dependabot and it is not a draft or not from a fork.
    if: >
      needs.pre-run.outputs.changed-file-count > 0 &&
      github.event.pull_request.draft == false &&
      github.event.pull_request.head.repo.fork == false &&
      github.event.pull_request.user.login != 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      actions: write
    outputs:
      branch-name: ${{ steps.retrieve-branch-name.outputs.branch_name }}
      git-sha-8: ${{ steps.retrieve-git-sha-8.outputs.sha8 }}
    strategy:
      matrix:
        build: ['dev', 'prod']
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Setup NodeJS and NPM
        uses: ./.github/actions/setup-node-npm

      - name: Setup PHP and Composer
        uses: ./.github/actions/setup-php-composer
        with:
          php-version: '7.4'

      - name: Create destination directories
        run: mkdir -p builds/${{ matrix.build }}

      - name: Build plugin
        run: |
          npm run package:${{ matrix.build }}
          mv amp.zip builds/${{ matrix.build }}/amp.zip
        env:
          LAST_PR_COMMIT_HASH: ${{ github.event.pull_request.head.sha }}

      - name: Generate checksum file
        working-directory: builds/${{ matrix.build }}
        run: |
          mkdir -p $RUNNER_TEMP/plugin-checksums
          find . -type f -print0 | sort -z | xargs -r0 shasum -a 256 -b | sed 's# \*\./# *#' > $RUNNER_TEMP/plugin-checksums/checksums.txt
          shasum -a 256 -U -c $RUNNER_TEMP/plugin-checksums/checksums.txt
          cat $RUNNER_TEMP/plugin-checksums/checksums.txt | while read sum file; do echo "$sum $file" > ${file#\*}.sha256; done

      - name: Retrieve branch name
        id: retrieve-branch-name
        run: echo "branch_name=$(REF=${GITHUB_HEAD_REF:-$GITHUB_REF} && echo ${REF#refs/heads/} | sed 's/\//-/g')" >> $GITHUB_OUTPUT

      - name: Retrieve git SHA-8 string
        id: retrieve-git-sha-8
        run: echo "sha8=$(echo ${GITHUB_SHA} | cut -c1-8)" >> $GITHUB_OUTPUT

      - name: Upload build as artifact
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 #v4.3.3
        with:
          name: amp-${{ steps.retrieve-branch-name.outputs.branch_name }}-${{ steps.retrieve-git-sha-8.outputs.sha8 }}-${{ matrix.build }}
          path: builds/${{ matrix.build }}

#-----------------------------------------------------------------------------------------------------------------------

  upload-to-gcs:
    name: Upload plugin ZIPs to Google Cloud Storage
    runs-on: ubuntu-latest
    permissions:
      actions: write
    needs:
      - build-zip
    outputs:
      dev-checksum: ${{ steps.output-checksums.outputs.dev-checksum }}
      prod-checksum: ${{ steps.output-checksums.outputs.prod-checksum }}
    steps:
      - name: Download dev build
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e #v4.1.7
        with:
          name: amp-${{ needs.build-zip.outputs.branch-name }}-${{ needs.build-zip.outputs.git-sha-8 }}-dev
          path: builds/dev

      - name: Download prod build
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e #v4.1.7
        with:
          name: amp-${{ needs.build-zip.outputs.branch-name }}-${{ needs.build-zip.outputs.git-sha-8 }}-prod
          path: builds/prod

      - name: Setup Google Cloud SDK
        uses: google-github-actions/setup-gcloud@20c93dacc1d70ddbce76c63ab32c35595345bdd1 #v0
        with:
          project_id: ${{ secrets.GCS_PROJECT_ID }}
          service_account_key: ${{ secrets.GCS_APPLICATION_CREDENTIALS }}

      - name: Output checksums
        id: output-checksums
        run: |
          echo "dev-checksum=$(cat builds/dev/*.sha256)" >> $GITHUB_OUTPUT
          echo "prod-checksum=$(cat builds/prod/*.sha256)" >> $GITHUB_OUTPUT

      - name: Upload dev build to bucket
        run: gsutil cp -r builds/dev/amp.zip gs://ampwp_github_artifacts/${{ github.ref }}/dev/amp.zip

      - name: Upload dev build checksums to bucket
        if: ${{ github.ref == 'refs/heads/develop' }}
        run: gsutil cp -r builds/dev/*.sha256 gs://ampwp_github_artifacts/${{ github.ref }}/dev/

      - name: Upload prod build to bucket
        run: gsutil cp -r builds/prod/amp.zip gs://ampwp_github_artifacts/${{ github.ref }}/prod/amp.zip

      - name: Upload prod build checksums to bucket
        if: ${{ github.ref == 'refs/heads/develop' }}
        run: gsutil cp -r builds/prod/*.sha256 gs://ampwp_github_artifacts/${{ github.ref }}/prod/

#-----------------------------------------------------------------------------------------------------------------------

  comment-on-pr:
    name: Comment on PR with links to plugin ZIPs
    # Only run this job if it's a PR. One way to check for that is if `github.head_ref` is not empty.
    if: ${{ github.head_ref && github.head_ref != null }}
    runs-on: ubuntu-latest
    needs: upload-to-gcs
    permissions:
      pull-requests: write
    steps:
      - name: Check if a comment was already made
        id: find-comment
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea #v7.0.1
        with:
          script: |
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const comment = comments.find((comment) => comment.body.includes('Plugin builds for'));

            return comment ? comment.id : null;

      - name: Get comment body
        id: get-comment-body
        # Setting a multi-line output requires escaping line-feeds. See <https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings>.
        run: |
          body="Plugin builds for ${{ github.event.pull_request.head.sha }} are ready :bellhop_bell:!
          - Download [development build](https://storage.googleapis.com/ampwp_github_artifacts/${{ github.ref }}/dev/amp.zip?${{ github.sha }})
          - Download [production build](https://storage.googleapis.com/ampwp_github_artifacts/${{ github.ref }}/prod/amp.zip?${{ github.sha }})

          <details>
          <summary>Checksums</summary>

          <pre>
          <code># Development build checksums
          ${{ needs.upload-to-gcs.outputs.dev-checksum }}

          # Production build checksums
          ${{ needs.upload-to-gcs.outputs.prod-checksum }}</code>
          </pre>

          </details>

          > [!WARNING]
          > These builds are for testing purposes only and should not be used in production."

          delimiter="${body//$'\n'/'%0A'}"
          echo "body<<${delimiter}" >> $GITHUB_OUTPUT
          echo "$body" >> $GITHUB_OUTPUT
          echo "${delimiter}" >> $GITHUB_OUTPUT

      - name: Create comment on PR with links to plugin builds
        if: ${{ steps.find-comment.outputs.result == 'null' }}
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea #v7.0.1
        with:
          script: |
            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `${{ steps.get-comment-body.outputs.body }}`,
            });

      - name: Update comment on PR with links to plugin builds
        if: ${{ steps.find-comment.outputs.result != 'null' }}
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea #v7.0.1
        with:
          script: |
            github.rest.issues.updateComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: ${{ steps.find-comment.outputs.result }},
              body: `${{ steps.get-comment-body.outputs.body }}`,
            });