posthog/.github/workflows/ci-oauth-proxy.yml at master · PostHog/posthog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: OAuth Proxy CI

on:
    push:
        branches: [master]
    pull_request:

concurrency:
    group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
    cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
    contents: read
    pull-requests: read

jobs:
    changes:
        runs-on: ubuntu-24.04
        timeout-minutes: 5
        name: Determine need to run oauth-proxy checks
        outputs:
            oauth-proxy: ${{ steps.filter.outputs.oauth-proxy || 'true' }}
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  sparse-checkout: .github/actions/paths-filter
                  sparse-checkout-cone-mode: false

            - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
              id: app-token
              if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
              with:
                  client-id: ${{ vars.GH_APP_POSTHOG_PATHS_FILTER_APP_ID }}
                  private-key: ${{ secrets.GH_APP_POSTHOG_PATHS_FILTER_PRIVATE_KEY }}
            - uses: ./.github/actions/paths-filter
              id: filter
              if: github.event_name != 'push'
              with:
                  token: ${{ steps.app-token.outputs.token || github.token }}
                  filters: |
                      oauth-proxy:
                        - 'services/oauth-proxy/**'
                        - '.github/workflows/ci-oauth-proxy.yml'

    build-and-test:
        name: Build & Test
        runs-on: ubuntu-24.04
        timeout-minutes: 10
        needs: changes
        if: needs.changes.outputs.oauth-proxy == 'true'
        steps:
            - name: Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

            - name: Install pnpm dependencies
              uses: ./.github/actions/pnpm-install
              with:
                  install-command: pnpm --filter=@posthog/auth-proxy... install --frozen-lockfile

            - name: Type check (tsgo)
              run: cd services/oauth-proxy && pnpm typecheck

            - name: Run tests
              run: cd services/oauth-proxy && pnpm test

    oauth_proxy_tests:
        needs: [changes, build-and-test]
        name: OAuth Proxy Tests Pass
        runs-on: ubuntu-24.04
        timeout-minutes: 5
        if: ${{ !cancelled() }}
        steps:
            - name: Check all oauth-proxy jobs
              run: |
                  # Fail if change detection failed or was cancelled (outputs are empty on cancel, so the exit below would report green).
                  if [[ "${{ needs.changes.result }}" != "success" && "${{ needs.changes.result }}" != "skipped" ]]; then
                    echo "Change detection did not succeed (result: ${{ needs.changes.result }})."
                    exit 1
                  fi

                  if [[ "${{ needs.changes.outputs.oauth-proxy }}" != "true" ]]; then
                    echo "OAuth proxy checks were skipped (no relevant changes)."
                    exit 0
                  fi

                  if [[ "${{ needs.build-and-test.result }}" != "success" && "${{ needs.build-and-test.result }}" != "skipped" ]]; then
                    echo "OAuth proxy build/test failed."
                    exit 1
                  fi

                  echo "All oauth-proxy checks passed."