ci.yml

name: CI

on:
  pull_request:
    branches: [ main ]
  push:
    branches: [ main ]

# Cancel in-progress runs for the same branch when a new commit is pushed
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

# Minimum permissions; individual jobs request more as needed
permissions:
  contents: read

jobs:
  # ===========================================================================
  # Template guard — short-circuits the entire workflow if .template-repo
  # marker file exists. Delete .template-repo to enable real CI runs.
  # ===========================================================================
  guard:
    name: Template guard
    runs-on: ubuntu-latest
    outputs:
      is_template: ${{ steps.check.outputs.is_template }}
    steps:
      - uses: actions/checkout@v4
      - id: check
        run: |
          if [ -f .template-repo ]; then
            echo "::notice::This is the unconfigured template repo. Skipping CI."
            echo "is_template=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_template=false" >> "$GITHUB_OUTPUT"
          fi

  # ===========================================================================
  # Path filter — determines which language jobs need to run
  # ===========================================================================
  changes:
    name: Detect changes
    needs: guard
    if: needs.guard.outputs.is_template != 'true'
    runs-on: ubuntu-latest
    outputs:
      python: ${{ steps.filter.outputs.python }}
      typescript: ${{ steps.filter.outputs.typescript }}
      rust: ${{ steps.filter.outputs.rust }}
      terraform: ${{ steps.filter.outputs.terraform }}
      docker: ${{ steps.filter.outputs.docker }}
      workflows: ${{ steps.filter.outputs.workflows }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            python:
              - '**/*.py'
              - '**/pyproject.toml'
              - '**/uv.lock'
              - '**/requirements*.txt'
              - '.python-version'
            typescript:
              - '**/*.ts'
              - '**/*.tsx'
              - '**/*.js'
              - '**/*.jsx'
              - '**/*.mjs'
              - '**/*.cjs'
              - '**/package.json'
              - '**/pnpm-lock.yaml'
              - '**/tsconfig*.json'
              - '**/.eslintrc*'
              - '**/.prettierrc*'
            rust:
              - '**/*.rs'
              - '**/Cargo.toml'
              - '**/Cargo.lock'
              - '**/rustfmt.toml'
              - '**/clippy.toml'
              - 'rust-toolchain.toml'
            terraform:
              - '**/*.tf'
              - '**/*.tfvars'
              - '**/*.hcl'
              - '.terraform-version'
            docker:
              - '**/Dockerfile'
              - '**/Dockerfile.*'
              - '**/.dockerignore'
              - '**/docker-compose*.yml'
              - '**/compose*.yml'
            workflows:
              - '.github/workflows/**'
              - '.github/actions/**'

  # ===========================================================================
  # Python: lint, typecheck, test
  # ===========================================================================
  python:
    name: Python
    needs: changes
    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.workflows ==
      'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install

      - name: Install dependencies
        run: uv sync --all-extras --dev

      - name: Lint (ruff check)
        run: uv run ruff check --output-format=github .

      - name: Format check (ruff format)
        run: uv run ruff format --check .

      - name: Type check
        run: |
          if uv run python -c "import pyright" 2>/dev/null; then
            uv run pyright
          elif uv run python -c "import mypy" 2>/dev/null; then
            uv run mypy .
          else
            echo "::warning::No type checker installed (pyright or mypy). Skipping."
          fi

      - name: Test
        run: uv run pytest --junitxml=junit-python.xml

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: junit-python
          path: junit-python.xml
          retention-days: 7

  # ===========================================================================
  # TypeScript / JavaScript: lint, typecheck, test
  # ===========================================================================
  typescript:
    name: TypeScript
    needs: changes
    if: needs.changes.outputs.typescript == 'true' ||
      needs.changes.outputs.workflows == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: "package.json"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm run lint

      - name: Format check
        run: pnpm exec prettier --check .

      - name: Type check
        run: pnpm exec tsc --noEmit

      - name: Test
        run: pnpm test -- --ci --reporters=default --reporters=jest-junit
        env:
          JEST_JUNIT_OUTPUT_FILE: junit-typescript.xml

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: junit-typescript
          path: junit-typescript.xml
          retention-days: 7

  # ===========================================================================
  # Rust: clippy, fmt, test
  # ===========================================================================
  rust:
    name: Rust
    needs: changes
    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.workflows ==
      'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      - name: Cache cargo registry and target
        uses: Swatinem/rust-cache@v2

      - name: Format check
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Build
        run: cargo build --all-targets --all-features --locked

      - name: Test
        run: cargo test --all-features --locked

  # ===========================================================================
  # Terraform: fmt, validate
  # ===========================================================================
  terraform:
    name: Terraform
    needs: changes
    if: needs.changes.outputs.terraform == 'true' || needs.changes.outputs.workflows
      == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: latest

      - name: Format check
        run: terraform fmt -check -recursive

      - name: Validate
        run: |
          # Find every directory containing .tf files and validate it
          find . -type f -name '*.tf' -not -path './.terraform/*' \
            | xargs -n1 dirname | sort -u | while read -r dir; do
              echo "::group::Validating $dir"
              (cd "$dir" && terraform init -backend=false && terraform validate)
              echo "::endgroup::"
            done

  # ===========================================================================
  # Docker: lint Dockerfiles
  # ===========================================================================
  docker:
    name: Docker
    needs: changes
    if: needs.changes.outputs.docker == 'true' || needs.changes.outputs.workflows ==
      'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Lint Dockerfiles (hadolint)
        uses: hadolint/hadolint-action@v3.3.0
        with:
          recursive: true
          ignore: DL3008,DL3018 # version-pin warnings; tune per project

  # ===========================================================================
  # Aggregator — single required check that gates merge
  # ===========================================================================
  ci-passed:
    name: CI passed
    runs-on: ubuntu-latest
    needs: [ guard, changes, python, typescript, rust, terraform, docker ]
    if: always()
    steps:
      - name: Verify all required jobs succeeded or were skipped
        run: |
          # If the template guard fired, allow the workflow to pass.
          if [ "${{ needs.guard.outputs.is_template }}" = "true" ]; then
            echo "Template guard active. CI skipped intentionally."
            exit 0
          fi
          # Any required job that ran must have succeeded.
          # Skipped jobs (because their language wasn't changed) are fine.
          results='${{ toJSON(needs) }}'
          echo "Job results:"
          echo "$results" | jq .
          failed=$(echo "$results" | jq -r 'to_entries[] | select(.value.result == "failure" or .value.result == "cancelled") | .key')
          if [ -n "$failed" ]; then
            echo "::error::The following jobs failed or were cancelled:"
            echo "$failed"
            exit 1
          fi
          echo "All jobs succeeded or were skipped."