ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: Validate Structure
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@v7

      - name: Check shell script syntax
        run: |
          errors=0
          for f in scripts/*.sh; do
            if [ -f "$f" ]; then
              bash -n "$f" || { echo "FAIL: $f"; errors=$((errors + 1)); }
            fi
          done
          echo "Checked $(ls scripts/*.sh 2>/dev/null | wc -l) scripts, $errors failed"
          exit $errors

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          scandir: './scripts'
          severity: warning

      - name: Validate JSON configs
        run: |
          errors=0
          for f in .claude/pipeline.config.json package.json; do
            if [ -f "$f" ]; then
              python3 -m json.tool "$f" > /dev/null || { echo "FAIL: $f"; errors=$((errors + 1)); }
            fi
          done
          for f in templates/**/*.json; do
            if [ -f "$f" ]; then
              python3 -m json.tool "$f" > /dev/null || { echo "FAIL: $f"; errors=$((errors + 1)); }
            fi
          done
          echo "$errors JSON validation failures"
          exit $errors

      - name: Validate pipeline.config.json structure
        run: |
          required_keys='["tdd","database","auth","testing","qualityGate","deployment","security","api"]'
          python3 -c "
          import json, sys
          with open('.claude/pipeline.config.json') as f:
              config = json.load(f)
          required = json.loads('$required_keys')
          missing = [k for k in required if k not in config]
          if missing:
              print(f'Missing required keys: {missing}')
              sys.exit(1)
          print(f'All {len(required)} required keys present')
          "

      - name: Check required files exist
        run: |
          exit_code=0
          required_files=(
            "CLAUDE.md"
            "package.json"
            "CONTRIBUTING.md"
            "CODE_OF_CONDUCT.md"
            "SECURITY.md"
            "LICENSE"
            ".claude/pipeline.config.json"
            "scripts/setup-project.sh"
            "scripts/run-tests.sh"
            "scripts/check-types.sh"
            "scripts/security-scan.sh"
            "scripts/generate-migration.sh"
          )
          for f in "${required_files[@]}"; do
            if [ -f "$f" ]; then
              echo "  $f: OK"
            else
              echo "  $f: MISSING"
              exit_code=1
            fi
          done
          exit $exit_code

      - name: Validate agent frontmatter
        run: |
          errors=0
          count=0
          for f in .claude/agents/*.md; do
            [ -f "$f" ] || continue
            count=$((count + 1))

            frontmatter=$(sed -n '/^---$/,/^---$/p' "$f" | sed '1d;$d')

            if [ -z "$frontmatter" ]; then
              echo "FAIL: $f — no YAML frontmatter found"
              errors=$((errors + 1))
              continue
            fi

            for field in name description; do
              if ! echo "$frontmatter" | grep -qE "^${field}:"; then
                echo "FAIL: $f — missing required field: $field"
                errors=$((errors + 1))
              fi
            done
          done
          echo "Checked $count agents, $errors failures"
          exit $errors

      - name: Validate skill structure
        run: |
          errors=0
          count=0
          for dir in .claude/skills/*/; do
            [ -d "$dir" ] || continue
            count=$((count + 1))

            skill_file="${dir}SKILL.md"

            if [ ! -f "$skill_file" ]; then
              echo "FAIL: $dir — missing SKILL.md"
              errors=$((errors + 1))
              continue
            fi

            frontmatter=$(sed -n '/^---$/,/^---$/p' "$skill_file" | sed '1d;$d')

            if [ -z "$frontmatter" ]; then
              echo "FAIL: $skill_file — no frontmatter found"
              errors=$((errors + 1))
              continue
            fi

            for field in name description; do
              if ! echo "$frontmatter" | grep -qE "^${field}:"; then
                echo "FAIL: $skill_file — missing required field: $field"
                errors=$((errors + 1))
              fi
            done
          done
          echo "Checked $count skills, $errors failures"
          exit $errors

      - name: Validate templates
        run: |
          errors=0

          for f in templates/**/*.json; do
            if [ -f "$f" ]; then
              python3 -m json.tool "$f" > /dev/null 2>&1 || {
                echo "FAIL: $f — invalid JSON"
                errors=$((errors + 1))
              }
            fi
          done

          for dir in templates/shared templates/cloudflare-workers templates/node-server templates/docker templates/aws-lambda templates/railway templates/fly templates/multi-tenant; do
            if [ -d "$dir" ]; then
              echo "  $dir: OK"
            else
              echo "  $dir: MISSING"
              errors=$((errors + 1))
            fi
          done

          echo "$errors template validation failures"
          exit $errors

  node-compat:
    name: Node.js ${{ matrix.node-version }} Compatibility
    runs-on: ubuntu-latest
    timeout-minutes: 5
    strategy:
      matrix:
        node-version: [20, 22]
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node-version }}

      - run: corepack enable
      - run: pnpm install

      - name: Verify installation
        run: |
          echo "Node.js version: $(node --version)"
          echo "pnpm version: $(pnpm --version)"
          pnpm ls --depth 0

  typecheck-templates:
    name: Type-check Embedded Templates
    runs-on: ubuntu-latest
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: 22

      - run: corepack enable

      - name: Install typecheck dependencies
        run: pnpm install --frozen-lockfile
        working-directory: templates/snippets

      - name: Type-check Cloudflare snippets
        run: pnpm exec tsc --noEmit -p tsconfig.cloudflare.json
        working-directory: templates/snippets

      - name: Type-check Node snippets
        run: pnpm exec tsc --noEmit -p tsconfig.node.json
        working-directory: templates/snippets

      - name: Type-check AWS Lambda snippets
        run: pnpm exec tsc --noEmit -p tsconfig.lambda.json
        working-directory: templates/snippets

  # Generates a real project per target with setup-project.sh and type-checks
  # it. Unlike typecheck-templates this has no lockfile on purpose: it installs
  # whatever `pnpm add` resolves today, so a dependency release that breaks
  # freshly generated projects (e.g. the TypeScript 6 @types auto-include
  # removal, #119) fails here instead of only on user machines.
  generated-projects:
    name: Generate & Type-check (${{ matrix.label }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - { platform: cloudflare, label: cloudflare }
          - { platform: node, label: node }
          - { platform: lambda, label: lambda }
          - { platform: railway, label: railway }
          - { platform: fly, label: fly }
          # Multi-tenant variant: also runs the tenant-isolation tests, since
          # the tenancy scaffolding ships its own test suite.
          - { platform: node, label: node-multi-tenant, flags: --multi-tenant }
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: 22

      - run: corepack enable

      - name: Generate project
        run: ./scripts/setup-project.sh demo-${{ matrix.label }} --${{ matrix.platform }} ${{ matrix.flags }}

      - name: Type-check generated project
        run: pnpm typecheck
        working-directory: demo-${{ matrix.label }}/api

      - name: Run tenant-isolation tests
        if: matrix.flags == '--multi-tenant'
        run: pnpm test
        working-directory: demo-${{ matrix.label }}/api

  check-links:
    name: Check Markdown Links
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7

      - name: Check markdown links
        uses: lycheeverse/lychee-action@v2
        with:
          args: >-
            --verbose
            --no-progress
            --config .lychee.toml
            '*.md'
            'docs/**/*.md'
          fail: true