ci.yaml

name: build

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      app: ${{ steps.filter.outputs.app }}
      docker: ${{ steps.filter.outputs.docker }}
      docs: ${{ steps.filter.outputs.docs }}
      frontend: ${{ steps.filter.outputs.frontend }}
      infra-app: ${{ steps.filter.outputs.infra-app }}
      infra-db: ${{ steps.filter.outputs.infra-db }}
      infra-o11y: ${{ steps.filter.outputs.infra-o11y }}
    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Detect changes
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            app:
              - 'src/**'
              - 'tests/**'
              - 'pyproject.toml'
              - 'uv.lock'
              - '.github/workflows/ci.yaml'
            docker:
              - 'Dockerfile'
              - 'scripts/start*.sh'
              - 'pyproject.toml'
              - 'uv.lock'
            docs:
              - 'docs/**'
            frontend:
              - 'src/spellbot/web/templates/**/*.js'
              - 'tests-js/**'
              - 'package.json'
              - 'package-lock.json'
              - 'vitest.config.js'
              - '.github/workflows/ci.yaml'
            infra-app:
              - 'infrastructure/app/**'
            infra-db:
              - 'infrastructure/db/**'
            infra-o11y:
              - 'infrastructure/o11y/**'

  build:
    needs: changes
    if: needs.changes.outputs.app == 'true'
    runs-on: ubuntu-latest

    concurrency:
      group: ${{ github.workflow }}-build-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

    strategy:
      max-parallel: 4
      matrix:
        python-version: ["3.14"]
        postgres-version: ["17"]
        database-url:
          ["postgresql+psycopg://postgres:postgres@localhost:5432/postgres"]

    services:
      postgres:
        image: postgres:${{ matrix.postgres-version }}
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
          --name postgres
        ports:
          - 5432:5432
    env:
      PGHOST: localhost
      PGUSER: postgres
      PGDATABASE: postgres
      PGPASSWORD: postgres

    steps:
      - name: Install postgresql-client
        run: |
          sudo apt-get update
          sudo apt-get install --yes postgresql-client

      - name: Connect to PostgreSQL with CLI
        run: psql -c 'SELECT VERSION();'

      - name: Show PostgreSQL config file
        run: psql -c 'SHOW config_file;'

      - name: Alter max connections
        run: |
          docker exec -i postgres bash << EOF
            sed -i -e 's/max_connections = 100/max_connections = 1000/' /var/lib/postgresql/data/postgresql.conf
            sed -i -e 's/shared_buffers = 128MB/shared_buffers = 2GB/' /var/lib/postgresql/data/postgresql.conf
          EOF
          docker restart --time 0 postgres
          sleep 5

      - name: Show max connections
        run: psql -c 'SHOW max_connections;'

      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          version: latest
          enable-cache: true

      - name: Install Python ${{ matrix.python-version }}
        run: uv python install ${{ matrix.python-version }}

      - name: Run Tests
        run: uv run --frozen pytest -n auto -vv --cov --cov-report=html --cov-report=xml
        env:
          DATABASE_URL: ${{ matrix.database-url }}

      - name: Send Reports to Codecov
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
        env:
          PYTHON: ${{ matrix.python-version }}
          POSTGRES: ${{ matrix.postgres-version }}
          DB_URL: ${{ matrix.database-url }}
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

        with:
          env_vars: PYTHON,POSTGRES,DB_URL

  docker:
    needs: changes
    if: needs.changes.outputs.docker == 'true'
    runs-on: ubuntu-latest

    concurrency:
      group: ${{ github.workflow }}-docker-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Build Docker image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: false
          load: true
          tags: spellbot:test
          cache-from: type=gha,scope=docker-build
          cache-to: type=gha,mode=max,scope=docker-build

      - name: Verify CLI runs
        run: |
          docker run --rm spellbot:test /spellbot/.venv/bin/python -c "from spellbot import main; main()" --help

      - name: Check image size
        run: |
          SIZE=$(docker image inspect spellbot:test --format='{{.Size}}')
          SIZE_MB=$((SIZE / 1024 / 1024))
          echo "Image size: ${SIZE_MB}MB"
          # Fail if image is larger than 500MB
          if [ $SIZE_MB -gt 500 ]; then
            echo "::warning::Image size (${SIZE_MB}MB) exceeds 500MB"
          fi

  docs:
    needs: changes
    if: needs.changes.outputs.docs == 'true'
    runs-on: ubuntu-latest

    concurrency:
      group: ${{ github.workflow }}-docs-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Ruby
        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1
        with:
          ruby-version: "3.3"
          bundler-cache: true
          working-directory: docs

      - name: Build Jekyll site
        run: bundle exec jekyll build --strict_front_matter
        working-directory: docs

  vitest:
    needs: changes
    if: needs.changes.outputs.frontend == 'true'
    runs-on: ubuntu-latest

    concurrency:
      group: ${{ github.workflow }}-vitest-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run Vitest
        run: npm test

  terraform-app:
    needs: changes
    if: needs.changes.outputs.infra-app == 'true'
    runs-on: ubuntu-latest

    concurrency:
      group: ${{ github.workflow }}-tf-app-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.12"

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93 # v6.2.2
        with:
          tflint_version: latest

      - name: Terraform Format Check
        run: terraform fmt -check -recursive
        working-directory: infrastructure/app

      - name: Terraform Init
        run: terraform init -backend=false
        working-directory: infrastructure/app

      - name: Terraform Validate
        run: terraform validate
        working-directory: infrastructure/app

      - name: TFLint Init
        run: tflint --init
        working-directory: infrastructure/app

      - name: TFLint
        run: tflint --format=compact
        working-directory: infrastructure/app

  terraform-db:
    needs: changes
    if: needs.changes.outputs.infra-db == 'true'
    runs-on: ubuntu-latest

    concurrency:
      group: ${{ github.workflow }}-tf-db-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.12"

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93 # v6.2.2
        with:
          tflint_version: latest

      - name: Terraform Format Check
        run: terraform fmt -check -recursive
        working-directory: infrastructure/db

      - name: Terraform Init
        run: terraform init -backend=false
        working-directory: infrastructure/db

      - name: Terraform Validate
        run: terraform validate
        working-directory: infrastructure/db

      - name: TFLint Init
        run: tflint --init
        working-directory: infrastructure/db

      - name: TFLint
        run: tflint --format=compact
        working-directory: infrastructure/db

  terraform-o11y:
    needs: changes
    if: needs.changes.outputs.infra-o11y == 'true'
    runs-on: ubuntu-latest

    concurrency:
      group: ${{ github.workflow }}-tf-o11y-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.12"

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93 # v6.2.2
        with:
          tflint_version: latest

      - name: Terraform Format Check
        run: terraform fmt -check -recursive
        working-directory: infrastructure/o11y

      - name: Terraform Init
        run: terraform init -backend=false
        working-directory: infrastructure/o11y

      - name: Terraform Validate
        run: terraform validate
        working-directory: infrastructure/o11y

      - name: TFLint Init
        run: tflint --init
        working-directory: infrastructure/o11y

      - name: TFLint
        run: tflint --format=compact
        working-directory: infrastructure/o11y

  deploy-stage:
    name: Deploy to stage
    needs:
      [
        changes,
        build,
        docker,
        docs,
        vitest,
        terraform-app,
        terraform-db,
        terraform-o11y,
      ]
    if: |
      always() &&
      github.ref == 'refs/heads/main' &&
      github.event_name == 'push' &&
      !contains(needs.*.result, 'failure') &&
      !contains(needs.*.result, 'cancelled')
    uses: ./.github/workflows/deploy.yml
    with:
      environment: stage
    secrets: inherit

  # Gate job - this is the only required check for PRs
  ci:
    runs-on: ubuntu-latest
    needs:
      [
        changes,
        build,
        docker,
        docs,
        vitest,
        terraform-app,
        terraform-db,
        terraform-o11y,
        deploy-stage,
      ]
    if: always()
    steps:
      - name: Check required jobs
        run: |
          # Check if any job failed (not skipped, not successful)
          if [[ "${{ needs.changes.result }}" == "failure" ]]; then
            echo "changes job failed"
            exit 1
          fi
          if [[ "${{ needs.build.result }}" == "failure" ]]; then
            echo "build job failed"
            exit 1
          fi
          if [[ "${{ needs.docker.result }}" == "failure" ]]; then
            echo "docker job failed"
            exit 1
          fi
          if [[ "${{ needs.docs.result }}" == "failure" ]]; then
            echo "docs job failed"
            exit 1
          fi
          if [[ "${{ needs.vitest.result }}" == "failure" ]]; then
            echo "vitest job failed"
            exit 1
          fi
          if [[ "${{ needs.terraform-app.result }}" == "failure" ]]; then
            echo "terraform-app job failed"
            exit 1
          fi
          if [[ "${{ needs.terraform-db.result }}" == "failure" ]]; then
            echo "terraform-db job failed"
            exit 1
          fi
          if [[ "${{ needs.terraform-o11y.result }}" == "failure" ]]; then
            echo "terraform-o11y job failed"
            exit 1
          fi
          if [[ "${{ needs.deploy-stage.result }}" == "failure" ]]; then
            echo "deploy-stage job failed"
            exit 1
          fi
          echo "All required jobs passed or were skipped"