on:

workflow_dispatch:

inputs:

target_ref:

description: Optional branch, tag, or full commit SHA to validate instead of the workflow ref

required: false

default: ""

type: string

push:

branches: [main]

paths-ignore:

runs-on: ubuntu-24.04

timeout-minutes: 20

outputs:

checkout_sha: ${{ steps.checkout_ref.outputs.sha }}

docs_only: ${{ steps.manifest.outputs.docs_only }}

docs_changed: ${{ steps.manifest.outputs.docs_changed }}

run_node: ${{ steps.manifest.outputs.run_node }}

- name: Checkout

uses: actions/checkout@v6

with:

ref: ${{ inputs.target_ref || github.sha }}

fetch-depth: 1

fetch-tags: false

persist-credentials: false

submodules: false

- name: Resolve checkout SHA

id: checkout_ref

run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

- name: Ensure preflight base commit

if: github.event_name != 'workflow_dispatch'

uses: ./.github/actions/ensure-base-commit

- name: Checkout

uses: actions/checkout@v6

with:

ref: ${{ inputs.target_ref || github.sha }}

fetch-depth: 1

fetch-tags: false

persist-credentials: false

submodules: false

- name: Ensure security base commit

if: github.event_name != 'workflow_dispatch'

uses: ./.github/actions/ensure-base-commit

with:

base-sha: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }}

- name: Checkout

uses: actions/checkout@v6

with:

ref: ${{ inputs.target_ref || github.sha }}

fetch-depth: 1

fetch-tags: false

persist-credentials: false

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

path: |

dist/

dist-runtime/

key: ${{ runner.os }}-dist-build-${{ github.sha }}

key: ${{ runner.os }}-dist-build-${{ needs.preflight.outputs.checkout_sha }}

- name: Pack built runtime artifacts

run: tar --posix -cf dist-runtime-build.tar.zst --use-compress-program zstdmt dist dist-runtime

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

- name: Checkout

uses: actions/checkout@v6

with:

ref: ${{ needs.preflight.outputs.checkout_sha }}

persist-credentials: false

submodules: false

- name: Checkout

uses: actions/checkout@v6

with:

ref: ${{ needs.preflight.outputs.checkout_sha }}

persist-credentials: false

submodules: false

- name: Checkout

uses: actions/checkout@v6

with:

ref: ${{ needs.preflight.outputs.checkout_sha }}

persist-credentials: false

submodules: false

- name: Checkout

uses: actions/checkout@v6

with:

ref: ${{ needs.preflight.outputs.checkout_sha }}

persist-credentials: false

submodules: false

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail