test.yaml

name: Test and publish

on:
  push:
    branches:
      - "main"
    paths-ignore:
      - "**/*.md"
  pull_request:
    branches: 
      - "**"
  release:
    types:
      - published

# Least privilege by default. No job writes to the repo through GITHUB_TOKEN;
# the publish job authenticates to npm with NODE_AUTH_TOKEN.
permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    name: Build
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Setup node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '24'
          cache: 'npm'
      - name: Install deps
        run: npm ci
      - name: Build
        id: pack-dir
        run: ./build.sh
      - name: 'Upload Artifact'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: reactfire-${{ github.run_id }}
          path: |
            reactfire.tgz
            publish.sh
            unpack.sh
          retention-days: 1
  verify-package:
    runs-on: ubuntu-latest
    needs: build
    name: Verify package
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Setup node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '24'
          cache: 'npm'
      - name: Install deps
        run: npm ci
      - name: 'Download Artifacts'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      # Unpacking makes the repo root the shipped package, which is what the
      # next two steps need: publint takes a directory, and size-limit reads
      # dist/, which is gitignored and so absent from a fresh checkout.
      - name: Expand Artifact
        run: |
          chmod +x reactfire-${{ github.run_id }}/unpack.sh
          ./reactfire-${{ github.run_id }}/unpack.sh
      # --strict because publint exits 0 on warnings, and the manifest problems
      # worth gating on (a missing types condition, for one) are warnings.
      - name: Lint package
        run: npm run lint:package
      # Points at the tarball rather than re-packing, so it checks the exact
      # bytes that ship. No ignore rules: all four resolution modes pass on
      # their own since #770 gave the emitted .d.ts explicit .js extensions.
      - name: Lint types
        run: npm run lint:types -- reactfire-${{ github.run_id }}/reactfire.tgz
      - name: Bundle size
        run: npm run size
  test:
    runs-on: ubuntu-latest
    needs: build
    strategy:
      matrix:
        node: ["22", "24"]
        react: ["18", "19"]
      fail-fast: false
    # The React 18 legs keep the original job names on purpose: `main`'s required
    # status checks reference them, so renaming would block every PR there until
    # an admin updated the contexts. Only the non-18 legs get a suffix, which
    # also means a React 19 failure does not gate a merge while 19 support is
    # still being built. Add the contexts when we want it to.
    name: Test Node.js ${{ matrix.node }}${{ matrix.react != '18' && format(' / React {0}', matrix.react) || '' }} (Ubuntu)
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Setup node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: ${{ matrix.node }}
          check-latest: true
          cache: 'npm'
      - name: Install deps
        run: npm ci
      - name: Lint
        run: npm run lint
      # Only the 19 leg swaps the runtime; the 18 leg runs the lockfile's React
      # as-is. --no-save keeps the lockfile out of the diff. Note this differs
      # from the type-check job, which installs on both legs and also installs
      # the types, so the 18 legs of the two jobs cover different React 18
      # patch versions.
      - name: Install React ${{ matrix.react }}
        if: matrix.react == '19'
        run: npm install --no-save react@${{ matrix.react }} react-dom@${{ matrix.react }}
      - name: Setup Java
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Install deps for functions
        run: npm install
        working-directory: ./functions
      - name: Firebase emulator cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ~/.cache/firebase/emulators
          key: firebase_emulators
      - name: 'Download Artifacts'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      - name: Expand Artifact
        run: |
          chmod +x reactfire-${{ github.run_id }}/unpack.sh
          ./reactfire-${{ github.run_id }}/unpack.sh
      # Without this the matrix is decorative: the only behavioural difference
      # between the legs is one skipped test, so a 19 leg silently running 18
      # would pass. Runs after the artifact overlay so it covers everything
      # that could disturb the install.
      - name: Confirm React ${{ matrix.react }} is what will run
        env:
          WANT_REACT: ${{ matrix.react }}
        run: |
          node -e '
            const want = process.env.WANT_REACT;
            const got = require("react/package.json").version;
            if (!got.startsWith(want + ".")) {
              console.error(`expected React ${want}, got ${got}`);
              process.exit(1);
            }
            console.log(`React ${got} confirmed for matrix leg ${want}`);
          '
      - name: Run tests
        run: npm run test
  type-check:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        react: ["18", "19"]
      fail-fast: false
    name: Type check (React ${{ matrix.react }})
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Setup node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '24'
          cache: 'npm'
      - name: Install deps
        run: npm ci
      - name: Install React ${{ matrix.react }} types
        run: npm install --no-save react@${{ matrix.react }} react-dom@${{ matrix.react }} @types/react@${{ matrix.react }} @types/react-dom@${{ matrix.react }}
      - name: Type check
        run: npx tsc --noEmit
      - name: Type check tests
        run: npx tsc --noEmit -p tsconfig.test.json
  publish:
    runs-on: ubuntu-latest
    name: Publish (NPM)
    needs: [test, verify-package]
    if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'release' }}
    steps:
      - name: Setup node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '24'
          registry-url: 'https://wombat-dressing-room.appspot.com'
      - name: 'Download Artifacts'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      - name: Publish
        run: |
          cd ./reactfire-${{ github.run_id }}/
          chmod +x publish.sh
          ./publish.sh
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}