staging.yml

name: Staging
on:
  pull_request:
    branches: [main]

# One shared staging environment, so serialize across PRs: queue rather than
# clobber another PR's deploy+smoke, and never cancel a run mid-flight.
concurrency:
  group: void-staging
  cancel-in-progress: false

jobs:
  staging:
    runs-on: ubuntu-latest
    # Fork PRs can't read VOID_TOKEN; they still get ci.yml (check + test).
    if: github.event.pull_request.head.repo.full_name == github.repository
    steps:
      # Actions are pinned to a full commit SHA (org policy); kept in sync with ci.yml.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # setup-vp installs vp (version resolved from the pnpm catalog), the
      # Node.js and pnpm pinned in devEngines, and the project dependencies,
      # with lockfile-keyed caching.
      - uses: voidzero-dev/setup-vp@49c3e4e92c52e7f8392712a9267bbe71c5ab30e5 # v1.19.0
        with:
          cache: true

      # Deploy this PR's code to the shared staging project, then smoke-test the
      # REAL Void runtime. This catches platform-only failures the pool-workers
      # unit tests can't (e.g. the Void Cache API ban that 500'd every packument)
      # BEFORE the change reaches main. Make this a required status check so a
      # failing smoke test blocks the merge.
      #
      # This deploy keeps the long-lived VOID_TOKEN secret: the GitHub OIDC
      # exchange that void-deploy.yml uses is rejected for pull_request events
      # by the Void platform (PR runs execute untrusted code, so they may not
      # mint deploy tokens), so OIDC cannot replace the token here.
      - name: Deploy to staging
        run: vp run deploy:staging
        env:
          VOID_TOKEN: ${{ secrets.VOID_TOKEN }}

      # --write runs the admin write lifecycle too (see scripts/smoke-test.mjs
      # header); staging only, and it fails loudly if the token secret is missing.
      - name: Smoke-test staging
        run: node scripts/smoke-test.mjs https://pkg-pr-registry-bridge-staging.void.app --write
        env:
          SMOKE_ADMIN_TOKEN: ${{ secrets.STAGING_ADMIN_TOKEN }}