ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  workflow_call:
    inputs:
      ref:
        type: string
        default: ""
        description: Git ref to checkout. Leave empty for default checkout behavior.
      run-e2e:
        type: boolean
        default: true
        description: Whether to run E2E tests

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}
      - uses: oven-sh/setup-bun@v2
      # Skip cache restore when invoked via workflow_call from release.yml's
      # snapshot path (issue_comment trigger). That path checks out
      # PR-author-controlled code in the default branch's privileged context;
      # consuming a cached install in that context is a poisoning surface.
      - if: github.event_name != 'issue_comment'
        uses: actions/cache/restore@v5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
          restore-keys: bun-${{ runner.os }}-
      - run: bun install --frozen-lockfile
      - run: bun run build

  lint:
    name: Lint
    needs: [build]
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}
      - uses: oven-sh/setup-bun@v2
      - if: github.event_name != 'issue_comment'
        uses: actions/cache/restore@v5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
          restore-keys: bun-${{ runner.os }}-
      - run: bun install --frozen-lockfile
      - run: bun run format:check
      - run: bun run lint
      - run: bun run typecheck

  test:
    name: Test
    needs: [build]
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}
      - uses: oven-sh/setup-bun@v2
      - if: github.event_name != 'issue_comment'
        uses: actions/cache/restore@v5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
          restore-keys: bun-${{ runner.os }}-
      - run: bun install --frozen-lockfile
      - run: bun run check:patches
      - run: bun run test

  test-e2e:
    name: E2E Test
    needs: [build]
    # For workflow_call: respect the run-e2e input.
    # For pull_request: skip fork PRs (no access to secrets) and Dependabot PRs
    # (cannot access Actions secrets, so CLERK_CLI_TEST_APP_ID would be empty).
    if: >-
      (github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.actor != 'dependabot[bot]') ||
      (github.event_name != 'pull_request' && inputs.run-e2e)
    runs-on: blacksmith-8vcpu-ubuntu-2404
    container:
      image: mcr.microsoft.com/playwright:v1.59.1-noble
    timeout-minutes: 30
    steps:
      - name: Install unzip (required by setup-bun)
        run: apt-get update && apt-get install -y unzip
      - name: Pin localhost to IPv4 in /etc/hosts
        # The playwright image resolves `localhost` to `::1` first, which
        # breaks Next.js dev: Next's internal proxy connects to `localhost`
        # regardless of the -H flag, so if localhost is IPv6-only the
        # proxy gets ECONNRESET. Drop the `::1 localhost` entry so every
        # consumer (Next dev proxy, Bun fetch, Chromium) reaches 127.0.0.1.
        run: |
          grep -v '::1.*localhost' /etc/hosts > /tmp/hosts.new
          cat /tmp/hosts.new > /etc/hosts
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}
      - uses: actions/setup-node@v6
        with:
          node-version: 22
      - name: Mark workspace as safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - uses: oven-sh/setup-bun@v2
      - if: github.event_name != 'issue_comment'
        uses: actions/cache/restore@v5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
          restore-keys: bun-${{ runner.os }}-
      - run: bun install --frozen-lockfile

      - name: Cleanup stale test users
        run: bun scripts/cleanup-test-users.ts
        env:
          CLERK_CLI_TEST_APP_ID: ${{ secrets.CLERK_CLI_TEST_APP_ID }}
          CLERK_PLATFORM_API_KEY: ${{ secrets.CLERK_PLATFORM_API_KEY }}

      - name: Run E2E tests
        run: bun run test:e2e
        env:
          CLERK_CLI_TEST_APP_ID: ${{ secrets.CLERK_CLI_TEST_APP_ID }}
          CLERK_PLATFORM_API_KEY: ${{ secrets.CLERK_PLATFORM_API_KEY }}
          CLERK_E2E_DEBUG: "1"