sdk/.github/workflows/validate-sdk-compliance-javascript.yml at main · supabase/sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: SDK Compliance — JavaScript (reusable)

on:
  workflow_call:
    inputs:
      compliance-file:
        description: Path to sdk-compliance.yaml in the calling repo
        type: string
        default: sdk-compliance.yaml
      sdk-ref:
        description: Ref to checkout from supabase/sdk for tooling and spec (defaults to the commit this workflow was called at; override only during pre-merge testing)
        type: string
        default: ""
      build-command:
        description: Shell command run in each checked-out SDK root to emit TypeDoc spec.json files (the SDK owns how it builds)
        type: string
        required: true
      spec-glob:
        description: Glob (relative to the SDK root) matching the spec.json files produced by build-command
        type: string
        required: true

# Tooling, composite actions, and capability spec all resolve from the single
# supabase/sdk commit the caller pinned this workflow at (job.workflow_sha),
# so action code and spec layout can never drift apart. See
# validate-sdk-compliance-go.yml for the full rationale.
jobs:
  validate:
    name: Validate compliance file
    runs-on: ubuntu-latest
    steps:
      - name: Checkout SDK repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Checkout compliance tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: supabase/sdk
          ref: ${{ inputs.sdk-ref || job.workflow_sha }}
          path: _sdk-spec
          persist-credentials: false

      - uses: ./_sdk-spec/packages/capability-matrix/actions/sdk-compliance-validate
        with:
          compliance-file: ${{ inputs.compliance-file }}

  check:
    name: Check public API against capability matrix
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout compliance tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: supabase/sdk
          ref: ${{ inputs.sdk-ref || job.workflow_sha }}
          path: _sdk-spec
          persist-credentials: false

      - id: api_check_setup
        uses: ./_sdk-spec/packages/capability-matrix/actions/sdk-compliance-check-setup
        with:
          compliance-file: ${{ inputs.compliance-file }}

      # This workflow is build-agnostic: the SDK declares how to produce its
      # TypeDoc spec.json files via `build-command`, and where they land via
      # `spec-glob`. We run the command in each branch's checkout, collect the
      # emitted spec.json files, then normalize + merge them into one
      # ParseResult. TypeDoc emits repo-root-relative paths, so the merged
      # output stays unambiguous without any prefixing.
      - name: Generate and normalize TypeScript symbols
        if: steps.api_check_setup.outputs.should-run == 'true'
        env:
          BUILD_COMMAND: ${{ inputs.build-command }}
          COVERAGE_MODE: ${{ steps.api_check_setup.outputs.coverage-mode }}
          SPEC_GLOB: ${{ inputs.spec-glob }}
        run: |
          set -euo pipefail
          [ -n "${BUILD_COMMAND:-}" ] || { echo "::error::build-command is required"; exit 1; }
          [ -n "${SPEC_GLOB:-}" ]     || { echo "::error::spec-glob is required"; exit 1; }
          BRANCHES=(pr)
          if [ "$COVERAGE_MODE" = "additions" ]; then BRANCHES+=(base); fi
          for b in "${BRANCHES[@]}"; do
            ROOT="$GITHUB_WORKSPACE/_sdk-$b"
            # The SDK owns how it builds; we just run it and collect what it emits.
            ( cd "$ROOT" && eval "$BUILD_COMMAND" )
            INPUTS=()
            for f in "$ROOT"/$SPEC_GLOB; do
              [ -e "$f" ] || continue
              INPUTS+=("$f")
            done
            [ ${#INPUTS[@]} -gt 0 ] || { echo "::error::spec-glob '$SPEC_GLOB' matched no files under $ROOT"; exit 1; }
            ( cd "$GITHUB_WORKSPACE/_sdk-spec/packages/capability-matrix" \
              && bun run --silent normalize-typedoc -- \
                   --out "$GITHUB_WORKSPACE/$b-symbols.json" "${INPUTS[@]}" )
          done

      - uses: ./_sdk-spec/packages/capability-matrix/actions/sdk-compliance-check-symbols
        if: steps.api_check_setup.outputs.should-run == 'true'
        with:
          compliance-file: ${{ inputs.compliance-file }}

      - uses: ./_sdk-spec/packages/capability-matrix/actions/sdk-compliance-check-drift
        if: steps.api_check_setup.outputs.should-run == 'true' && github.event_name == 'pull_request'
        with:
          compliance-file: ${{ inputs.compliance-file }}