name: Pull Request

on:

pull_request:

jobs:

# check which folder changed in the repo

check-changes:

uses: ./.github/workflows/_check.yml

with:

targets: '[

"locksmith",

"packages/contracts",

"packages/hardhat-plugin",

"packages/unlock-js",

"packages/paywall",

"paywall-app",

"smart-contracts",

"subgraph",

"governance",

"provider",

"graph-service",

"unlock-protocol-com",

"wedlocks",

"unlock-app",

"governance-app",

"packages/core",

"docs"

]'

# run all tests if PR contains the 'run-all-tests' tag

bypass: ${{ contains(github.event.pull_request.labels.*.name, 'run-all-tests')}}

# run tests for folders that have changed

run-tests:

needs: check-changes

# name: "Run the tests"

if: ${{ needs.check-changes.outputs.changed != '[]' }}

uses: ./.github/workflows/_tests.yml

with:

changed: ${{ needs.check-changes.outputs.changed }}

export_cache: ${{ github.event.pull_request.head.repo.full_name == github.repository }}

smart-contracts-coverage:

needs: check-changes

if: ${{ needs.check-changes.outputs.changed != '[]' && contains(fromJson(needs.check-changes.outputs.changed), 'smart-contracts') }}

uses: ./.github/workflows/_coverage.yml

with:

service: smart-contracts

# the check for changes in network files is included within the workflow itself

networks-changed:

uses: ./.github/workflows/_networks.yml

cloudflare-deploy-credentials:

needs: check-changes

if: ${{ github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJson(needs.check-changes.outputs.changed), 'wedlocks') || contains(fromJson(needs.check-changes.outputs.changed), 'provider') || contains(fromJson(needs.check-changes.outputs.changed), 'graph-service')) }}

runs-on: ubuntu-24.04

steps:

- name: Verify Cloudflare API token

env:

CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

run: |

if [ -z "$CLOUDFLARE_API_TOKEN" ]; then

echo '::error::CLOUDFLARE_API_TOKEN is required to deploy Cloudflare Workers.'

exit 1

fi

response=$(curl -sS -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \

"https://api.cloudflare.com/client/v4/accounts/30fa248ff7b03cfcac765dae9509bba0")

success=$(printf '%s' "$response" | jq -r '.success')

if [ "$success" != "true" ]; then

echo '::error::CLOUDFLARE_API_TOKEN cannot access Cloudflare account 30fa248ff7b03cfcac765dae9509bba0.'

printf '%s' "$response" | jq -r '.errors[]?.message'

exit 1

fi

# Vercel Deployments

deploy-unlock-protocol-com:

needs:

- check-changes

- run-tests

if: ${{ github.event.pull_request.head.repo.full_name == github.repository && contains(fromJson(needs.check-changes.outputs.changed), 'unlock-protocol-com') }}

runs-on: ubuntu-24.04

steps:

- uses: actions/checkout@v4

with:

fetch-depth: 0

- name: Load secrets from 1Password

uses: 1Password/load-secrets-action@v2.0.0

with:

export-env: true

env:

OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

UNLOCK_PROTOCOL_COM_VERCEL_STAGING_VERCEL_PROJECT_ID: op://secrets/vercel/project-id-unlock-protocol-com-prod

UNLOCK_PROTOCOL_COM_VERCEL_STAGING_VERCEL_ORG_ID: op://secrets/vercel/org-id

UNLOCK_PROTOCOL_COM_VERCEL_STAGING_VERCEL_TOKEN: op://secrets/vercel/deployment-token

- uses: ./.github/actions/vercel

with:

service: unlock-protocol-com

target-env: staging

deploy-paywall-app:

needs:

- check-changes

- run-tests

if: ${{ github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJson(needs.check-changes.outputs.changed), 'paywall-app') || contains(fromJson(needs.check-changes.outputs.changed), 'packages/paywall')) }}

runs-on: ubuntu-24.04

steps:

- uses: actions/checkout@v4

with:

fetch-depth: 0

- name: Load secrets from 1Password

uses: 1Password/load-secrets-action@v2.0.0

with:

export-env: true

env:

OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

PAYWALL_APP_VERCEL_STAGING_VERCEL_PROJECT_ID: op://secrets/vercel/project-id-paywall-app-staging

PAYWALL_APP_VERCEL_STAGING_VERCEL_ORG_ID: op://secrets/vercel/org-id

PAYWALL_APP_VERCEL_STAGING_VERCEL_TOKEN: op://secrets/vercel/deployment-token

- uses: ./.github/actions/vercel

with:

service: paywall-app

target-env: staging

deploy-unlock-app-vercel:

needs:

- check-changes

- run-tests

if: ${{ github.event.pull_request.head.repo.full_name == github.repository && needs.check-changes.outputs.changed != '[]' && contains(fromJson(needs.check-changes.outputs.changed), 'unlock-app') }}

runs-on: ubuntu-24.04

steps:

- uses: actions/checkout@v4

with:

fetch-depth: 0

- name: Load secrets from 1Password

uses: 1Password/load-secrets-action@v2.0.0

with:

export-env: true

env:

OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

UNLOCK_APP_VERCEL_STAGING_VERCEL_PROJECT_ID: op://secrets/vercel/project-id-unlock-app-staging

UNLOCK_APP_VERCEL_STAGING_VERCEL_ORG_ID: op://secrets/vercel/org-id

UNLOCK_APP_VERCEL_STAGING_VERCEL_TOKEN: op://secrets/vercel/deployment-token

UNLOCK_APP_VERCEL_STAGING_GOOGLE_CLIENT_SECRET: op://secrets/google/staging-secret

UNLOCK_APP_VERCEL_STAGING_NEXTAUTH_SECRET: op://secrets/nextauth/staging-secret

- uses: ./.github/actions/vercel

with:

service: unlock-app

target-env: staging

env:

UNLOCK_APP_VERCEL_STAGING_NEXTAUTH_URL: 'https://staging-app.unlock-protocol.com'

deploy-docs:

needs:

- check-changes

- run-tests

if: ${{ github.event.pull_request.head.repo.full_name == github.repository && needs.check-changes.outputs.changed != '[]' && contains(fromJson(needs.check-changes.outputs.changed), 'docs') }}

runs-on: ubuntu-24.04

steps:

- uses: actions/checkout@v4

with:

fetch-depth: 0

- name: Load secrets from 1Password

uses: 1Password/load-secrets-action@v2.0.0

with:

export-env: true

env:

OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

# Using the prod project ID but will create preview deployment

DOCS_VERCEL_STAGING_VERCEL_PROJECT_ID: op://secrets/vercel/project-id-docs-prod

DOCS_VERCEL_STAGING_VERCEL_ORG_ID: op://secrets/vercel/org-id

DOCS_VERCEL_STAGING_VERCEL_TOKEN: op://secrets/vercel/deployment-token

- uses: ./.github/actions/vercel

with:

service: docs

target-env: staging