ci.yml

name: 🚀 CI

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

on:
  push:
    branches: [main]
    tags: ['*']
    paths:
      - 'packages/cli/**'
      - 'pnpm-lock.yaml'
      - 'package.json'
      - '.github/workflows/ci.yml'
  pull_request:
    branches: [main]
    paths:
      - 'packages/cli/**'
      - 'pnpm-lock.yaml'
      - 'package.json'
      - '.github/workflows/ci.yml'
  workflow_dispatch:
    inputs:
      force:
        description: 'Force rebuild (ignore cache)'
        type: boolean
        default: false
      node-versions:
        description: 'Node.js versions to test (JSON array)'
        required: false
        type: string
        # Default should match .node-version file.
        default: '["25"]'

permissions: {}


jobs:
  versions:
    name: Load Tool Versions
    runs-on: ubuntu-latest
    permissions:
      contents: read # Read .node-version file from repository.
    outputs:
      node: ${{ steps.versions.outputs.node }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Load Node.js version from .node-version
        id: versions
        shell: bash
        run: |
          NODE_VERSION=$(cat .node-version)
          echo "node=[\"$NODE_VERSION\"]" >> $GITHUB_OUTPUT
          echo "Loaded Node.js: $NODE_VERSION"

  # Lint and type check jobs (run in parallel).
  lint:
    name: 🧹 Lint Check
    needs: versions
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
        with:
          node-version-file: .node-version
          cache: 'pnpm'
          cache-dependency-path: 'pnpm-lock.yaml'

      - name: Create stub packages
        run: |
          mkdir -p packages/package-builder/build/dev/out/socketaddon-iocraft
          echo '{"name":"@socketaddon/iocraft","version":"0.0.0","type":"module","main":"./index.mjs","types":"./index.d.ts"}' > packages/package-builder/build/dev/out/socketaddon-iocraft/package.json
          cat > packages/package-builder/build/dev/out/socketaddon-iocraft/index.d.ts << 'TYPES'
          export interface ComponentNode { type: string; children?: ComponentNode[]; content?: string; [key: string]: any }
          export function text(content: string): ComponentNode
          export function view(children: ComponentNode[]): ComponentNode
          export function renderToString(tree: ComponentNode): string
          export function renderToStringWithWidth(tree: ComponentNode, maxWidth: number): string
          export function printComponent(tree: ComponentNode): void
          export function eprintComponent(tree: ComponentNode): void
          export function getTerminalSize(): [number, number]
          export class TuiRenderer { constructor(); setTree(tree: ComponentNode): Promise<void>; isRunning(): boolean; getSize(): [number, number]; renderOnce(): Promise<string>; renderWithWidth(maxWidth: number): Promise<string>; print(): Promise<void>; eprint(): Promise<void> }
          export function init(): void
          declare const iocraft: { text: typeof text; view: typeof view; renderToString: typeof renderToString; renderToStringWithWidth: typeof renderToStringWithWidth; printComponent: typeof printComponent; eprintComponent: typeof eprintComponent; getTerminalSize: typeof getTerminalSize; TuiRenderer: typeof TuiRenderer; init: typeof init }
          export default iocraft
          TYPES
          cat > packages/package-builder/build/dev/out/socketaddon-iocraft/index.mjs << 'CODE'
          export const text = (content) => ({ type: 'Text', content })
          export const view = (children) => ({ type: 'View', children })
          const extractText = (node) => {
            if (!node) return ''
            if (node.type === 'Text') return node.content || ''
            if (node.children) return node.children.map(extractText).join('')
            return ''
          }
          export const renderToString = (tree) => extractText(tree)
          export const renderToStringWithWidth = (tree, width) => extractText(tree)
          export const printComponent = (tree) => console.log(renderToString(tree))
          export const eprintComponent = (tree) => console.error(renderToString(tree))
          export const getTerminalSize = () => [80, 24]
          export class TuiRenderer { setTree(t) { return Promise.resolve() } isRunning() { return false } getSize() { return [80, 24] } renderOnce() { return Promise.resolve('') } renderWithWidth(w) { return Promise.resolve('') } print() { return Promise.resolve() } eprint() { return Promise.resolve() } }
          export const init = () => {}
          export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
          CODE

      - uses: SocketDev/socket-registry/.github/actions/install@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main

      - name: Run lint
        shell: bash
        run: |
          pnpm --filter @socketsecurity/cli run check

  type-check:
    name: 🔍 Type Check
    needs: versions
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
        with:
          node-version-file: .node-version
          cache: 'pnpm'
          cache-dependency-path: 'pnpm-lock.yaml'

      - name: Create stub packages
        run: |
          mkdir -p packages/package-builder/build/dev/out/socketaddon-iocraft
          echo '{"name":"@socketaddon/iocraft","version":"0.0.0","type":"module","main":"./index.mjs","types":"./index.d.ts"}' > packages/package-builder/build/dev/out/socketaddon-iocraft/package.json
          cat > packages/package-builder/build/dev/out/socketaddon-iocraft/index.d.ts << 'TYPES'
          export interface ComponentNode { type: string; children?: ComponentNode[]; content?: string; [key: string]: any }
          export function text(content: string): ComponentNode
          export function view(children: ComponentNode[]): ComponentNode
          export function renderToString(tree: ComponentNode): string
          export function renderToStringWithWidth(tree: ComponentNode, maxWidth: number): string
          export function printComponent(tree: ComponentNode): void
          export function eprintComponent(tree: ComponentNode): void
          export function getTerminalSize(): [number, number]
          export class TuiRenderer { constructor(); setTree(tree: ComponentNode): Promise<void>; isRunning(): boolean; getSize(): [number, number]; renderOnce(): Promise<string>; renderWithWidth(maxWidth: number): Promise<string>; print(): Promise<void>; eprint(): Promise<void> }
          export function init(): void
          declare const iocraft: { text: typeof text; view: typeof view; renderToString: typeof renderToString; renderToStringWithWidth: typeof renderToStringWithWidth; printComponent: typeof printComponent; eprintComponent: typeof eprintComponent; getTerminalSize: typeof getTerminalSize; TuiRenderer: typeof TuiRenderer; init: typeof init }
          export default iocraft
          TYPES
          cat > packages/package-builder/build/dev/out/socketaddon-iocraft/index.mjs << 'CODE'
          export const text = (content) => ({ type: 'Text', content })
          export const view = (children) => ({ type: 'View', children })
          const extractText = (node) => {
            if (!node) return ''
            if (node.type === 'Text') return node.content || ''
            if (node.children) return node.children.map(extractText).join('')
            return ''
          }
          export const renderToString = (tree) => extractText(tree)
          export const renderToStringWithWidth = (tree, width) => extractText(tree)
          export const printComponent = (tree) => console.log(renderToString(tree))
          export const eprintComponent = (tree) => console.error(renderToString(tree))
          export const getTerminalSize = () => [80, 24]
          export class TuiRenderer { setTree(t) { return Promise.resolve() } isRunning() { return false } getSize() { return [80, 24] } renderOnce() { return Promise.resolve('') } renderWithWidth(w) { return Promise.resolve('') } print() { return Promise.resolve() } eprint() { return Promise.resolve() } }
          export const init = () => {}
          export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
          CODE

      - uses: SocketDev/socket-registry/.github/actions/install@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main

      - name: Run type check
        shell: bash
        run: |
          pnpm --filter @socketsecurity/cli run type

  # Sharded unit tests for faster CI.
  test-sharded:
    name: Unit Tests (Shard ${{ matrix.shard }}/3)
    needs: [lint, type-check, versions]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        node-version: ${{ fromJSON(inputs.node-versions || needs.versions.outputs.node) }}
        shard: [1, 2, 3]
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'
          cache-dependency-path: 'pnpm-lock.yaml'

      - name: Create stub packages
        run: |
          mkdir -p packages/package-builder/build/dev/out/socketaddon-iocraft
          echo '{"name":"@socketaddon/iocraft","version":"0.0.0","type":"module","main":"./index.mjs","types":"./index.d.ts"}' > packages/package-builder/build/dev/out/socketaddon-iocraft/package.json
          cat > packages/package-builder/build/dev/out/socketaddon-iocraft/index.d.ts << 'TYPES'
          export interface ComponentNode { type: string; children?: ComponentNode[]; content?: string; [key: string]: any }
          export function text(content: string): ComponentNode
          export function view(children: ComponentNode[]): ComponentNode
          export function renderToString(tree: ComponentNode): string
          export function renderToStringWithWidth(tree: ComponentNode, maxWidth: number): string
          export function printComponent(tree: ComponentNode): void
          export function eprintComponent(tree: ComponentNode): void
          export function getTerminalSize(): [number, number]
          export class TuiRenderer { constructor(); setTree(tree: ComponentNode): Promise<void>; isRunning(): boolean; getSize(): [number, number]; renderOnce(): Promise<string>; renderWithWidth(maxWidth: number): Promise<string>; print(): Promise<void>; eprint(): Promise<void> }
          export function init(): void
          declare const iocraft: { text: typeof text; view: typeof view; renderToString: typeof renderToString; renderToStringWithWidth: typeof renderToStringWithWidth; printComponent: typeof printComponent; eprintComponent: typeof eprintComponent; getTerminalSize: typeof getTerminalSize; TuiRenderer: typeof TuiRenderer; init: typeof init }
          export default iocraft
          TYPES
          cat > packages/package-builder/build/dev/out/socketaddon-iocraft/index.mjs << 'CODE'
          export const text = (content) => ({ type: 'Text', content })
          export const view = (children) => ({ type: 'View', children })
          const extractText = (node) => {
            if (!node) return ''
            if (node.type === 'Text') return node.content || ''
            if (node.children) return node.children.map(extractText).join('')
            return ''
          }
          export const renderToString = (tree) => extractText(tree)
          export const renderToStringWithWidth = (tree, width) => extractText(tree)
          export const printComponent = (tree) => console.log(renderToString(tree))
          export const eprintComponent = (tree) => console.error(renderToString(tree))
          export const getTerminalSize = () => [80, 24]
          export class TuiRenderer { setTree(t) { return Promise.resolve() } isRunning() { return false } getSize() { return [80, 24] } renderOnce() { return Promise.resolve('') } renderWithWidth(w) { return Promise.resolve('') } print() { return Promise.resolve() } eprint() { return Promise.resolve() } }
          export const init = () => {}
          export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
          CODE

      - uses: SocketDev/socket-registry/.github/actions/install@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main

      - name: Build CLI
        working-directory: packages/cli
        shell: bash
        run: |
          pnpm run build

      - name: Run unit tests (shard ${{ matrix.shard }})
        working-directory: packages/cli
        shell: bash
        env:
          SHARD: ${{ matrix.shard }}
        run: |
          pnpm test:unit --shard="$SHARD"/3

  # E2E tests
  e2e:
    name: E2E Tests (Shard ${{ matrix.shard }}/2)
    needs: [lint, type-check, versions]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        node-version: ${{ fromJSON(inputs.node-versions || needs.versions.outputs.node) }}
        shard: [1, 2]
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'
          cache-dependency-path: 'pnpm-lock.yaml'

      - name: Create stub packages
        run: |
          mkdir -p packages/package-builder/build/dev/out/socketaddon-iocraft
          echo '{"name":"@socketaddon/iocraft","version":"0.0.0","type":"module","main":"./index.mjs","types":"./index.d.ts"}' > packages/package-builder/build/dev/out/socketaddon-iocraft/package.json
          cat > packages/package-builder/build/dev/out/socketaddon-iocraft/index.d.ts << 'TYPES'
          export interface ComponentNode { type: string; children?: ComponentNode[]; content?: string; [key: string]: any }
          export function text(content: string): ComponentNode
          export function view(children: ComponentNode[]): ComponentNode
          export function renderToString(tree: ComponentNode): string
          export function renderToStringWithWidth(tree: ComponentNode, maxWidth: number): string
          export function printComponent(tree: ComponentNode): void
          export function eprintComponent(tree: ComponentNode): void
          export function getTerminalSize(): [number, number]
          export class TuiRenderer { constructor(); setTree(tree: ComponentNode): Promise<void>; isRunning(): boolean; getSize(): [number, number]; renderOnce(): Promise<string>; renderWithWidth(maxWidth: number): Promise<string>; print(): Promise<void>; eprint(): Promise<void> }
          export function init(): void
          declare const iocraft: { text: typeof text; view: typeof view; renderToString: typeof renderToString; renderToStringWithWidth: typeof renderToStringWithWidth; printComponent: typeof printComponent; eprintComponent: typeof eprintComponent; getTerminalSize: typeof getTerminalSize; TuiRenderer: typeof TuiRenderer; init: typeof init }
          export default iocraft
          TYPES
          cat > packages/package-builder/build/dev/out/socketaddon-iocraft/index.mjs << 'CODE'
          export const text = (content) => ({ type: 'Text', content })
          export const view = (children) => ({ type: 'View', children })
          const extractText = (node) => {
            if (!node) return ''
            if (node.type === 'Text') return node.content || ''
            if (node.children) return node.children.map(extractText).join('')
            return ''
          }
          export const renderToString = (tree) => extractText(tree)
          export const renderToStringWithWidth = (tree, width) => extractText(tree)
          export const printComponent = (tree) => console.log(renderToString(tree))
          export const eprintComponent = (tree) => console.error(renderToString(tree))
          export const getTerminalSize = () => [80, 24]
          export class TuiRenderer { setTree(t) { return Promise.resolve() } isRunning() { return false } getSize() { return [80, 24] } renderOnce() { return Promise.resolve('') } renderWithWidth(w) { return Promise.resolve('') } print() { return Promise.resolve() } eprint() { return Promise.resolve() } }
          export const init = () => {}
          export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
          CODE

      - uses: SocketDev/socket-registry/.github/actions/install@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main

      - name: Build CLI
        working-directory: packages/cli
        shell: bash
        run: |
          pnpm run build

      - name: Run e2e tests (shard ${{ matrix.shard }})
        working-directory: packages/cli
        shell: bash
        env:
          SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_CLI_API_TOKEN }}
          SHARD: ${{ matrix.shard }}
        run: |
          pnpm run e2e-tests --shard="$SHARD"/2