cfa-verify.yml

name: CI

on:
  workflow_dispatch:

  pull_request:
    types: [opened, synchronize]
  push:
    branches:
      - main
    paths-ignore:
      - "**/*.md"
      - "website/**"
    tags-ignore:
      - "**"

jobs:
  try-requst-opt:
    name: Show Me the Otp
    runs-on: ubuntu-latest
#   should add back later
#   environment: npm

    permissions:
      id-token: write

    steps:
      - name: Start
        run: echo "xx"

      - uses: actions/setup-node@v4
        with:
          node-version: '20.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Obtain OIDC token
        id: oidc
        run: |
          token=$(curl --fail -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=cfa.rspack.dev" | jq -r '.value')
          echo "::add-mask::${token}"
          echo "token=${token}" >> $GITHUB_OUTPUT
        shell: bash

      - name: Obtain GitHub credentials
        id: github_creds
        run: |
          token=$(curl --fail "https://cfa.rspack.dev/api/request/${{ secrets.CFA_PROJECT_ID }}/github/credentials" \
            -X POST \
            -H "Content-Type: application/json" \
            -H "Authorization: bearer ${{ secrets.CFA_SECRET }}" \
            --data "{\"token\":\"${{ steps.oidc.outputs.token }}\"}" | jq -r '.GITHUB_TOKEN')
          echo "::add-mask::${token}"
          echo "token=${token}" >> $GITHUB_OUTPUT
        shell: bash

      - name: Request Opt
        id: request_opt
        run: node scripts/otp-test.mjs
        shell: bash