ci.yml

name: CI

on:
  push:
    branches: [main, develop]
    paths-ignore:
      - '**/*.md'
      - 'content/**'
      - 'docs/**'
      - 'apps/site/**'
      - '.changeset/**'
  pull_request:
    branches: [main, develop]
    paths-ignore:
      - '**/*.md'
      - 'content/**'
      - 'docs/**'
      - 'apps/site/**'
      - '.changeset/**'

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  changeset-check:
    name: Changeset Fixed Group Check
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Verify all packages are in changeset fixed group
        run: node scripts/check-changeset-fixed.mjs

  # PRs run the suite split across 4 runners. The suite is dominated by fixed
  # per-file cost rather than by the assertions: a PR run reported 495s wall
  # clock of which only 178s was `tests` — the rest was `setup` (831s
  # cumulative), `import` (199s) and `environment` (156s), each paid once per
  # test file because `isolate: true` re-executes the module graph per file
  # (vitest.config.mts explains why isolation has to stay on). That cost shards
  # near-linearly, and the fixed overhead of an extra runner here is only ~30s
  # (checkout + Node + a warm-pnpm-store install), so 4 shards cut wall clock
  # ~3x for ~26% more runner minutes.
  #
  # Vitest shards by hashing each test file's path, so `unit` and `dom` files
  # interleave across shards on their own — no manual balancing needed.
  test:
    name: Test (shard ${{ matrix.shard }}/4)
    # Coverage instrumentation (v8 adds 40-100% overhead) is skipped on PRs;
    # the `test-coverage` job below keeps Codecov current on push.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    # Bound the job so a stalled runner / non-exiting test worker fails fast and
    # is retryable, instead of hanging up to GitHub's 6h default.
    timeout-minutes: 20

    strategy:
      # Report every shard's failures, not just the first one to break.
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          submodules: true

      - name: Enable Corepack
        run: corepack enable

      - name: Verify pnpm version
        run: pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20.x'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Run the canonical root Vitest project once. Running `turbo run test`
      # here starts one Vitest process per package; several package configs
      # intentionally inherit the root monorepo project list, so CI ends up
      # repeating large chunks of the suite and can starve slower plugin tests.
      - name: Run tests (shard ${{ matrix.shard }}/4)
        run: pnpm test --shard=${{ matrix.shard }}/4

  # Push to main/develop: one unsharded run so Codecov still receives a single
  # complete report. Nothing blocks on this job, so it isn't worth the blob
  # report merge that sharding a coverage run would require.
  test-coverage:
    name: Test (coverage)
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 40

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          submodules: true

      - name: Enable Corepack
        run: corepack enable

      - name: Verify pnpm version
        run: pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20.x'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run tests with coverage
        run: pnpm test:coverage --coverage.reporter=json --coverage.reporter=text

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  # Build + E2E merged into one job: avoids artifact upload/download (~30s)
  # and a duplicate `pnpm install` (~60s). This job only needs the console SPA
  # artifact for Playwright; package build and package-size checks are covered
  # by the Bundle Analysis workflow for package / console changes.
  e2e:
    name: Build & E2E
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          submodules: true

      - name: Enable Corepack
        run: corepack enable

      - name: Verify pnpm version
        run: pnpm --version

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20.x'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build Console for E2E
        # Pin VITE_BASE_PATH so the E2E suite (which mounts the SPA at
        # /console/) gets an absolute-base build whose asset URLs resolve
        # under that prefix. The default ('./') is correct for embedded
        # deployments but breaks vite preview's SPA fallback.
        #
        # Use Vite directly instead of `pnpm --filter @object-ui/console build`:
        # the package build runs `tsc` and `build:plugin`, which need built
        # workspace declaration files. The Vite bundle aliases workspace
        # packages to `src/` and is the only artifact Playwright consumes.
        env:
          VITE_BASE_PATH: /console/
        run: pnpm --filter @object-ui/console exec vite build

      - name: Verify build artifacts
        run: |
          if [ ! -f "apps/console/dist/index.html" ]; then
            echo "Console build failed"
            exit 1
          fi
          echo "Console build artifact is ready"

      - name: Get Playwright version
        id: playwright-version
        run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[0].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT

      - name: Cache Playwright browsers
        uses: actions/cache@v6
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}

      - name: Install Playwright browsers
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm exec playwright install --with-deps chromium

      - name: Install Playwright system dependencies
        if: steps.playwright-cache.outputs.cache-hit == 'true'
        run: pnpm exec playwright install-deps chromium

      - name: Run E2E tests
        run: pnpm test:e2e --project=chromium

      - name: Upload Playwright report
        uses: actions/upload-artifact@v7
        if: ${{ !cancelled() && failure() }}
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 14

  docs:
    name: Build Docs
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          submodules: true

      - name: Check for docs changes
        id: docs-changes
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            echo "should_run=true" >> "$GITHUB_OUTPUT"
          else
            # Check if docs-related files changed in this PR
            CHANGED=$(git diff --name-only ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- \
              'apps/site/' 'content/' 2>/dev/null || echo "")
            if [ -n "$CHANGED" ]; then
              echo "should_run=true" >> "$GITHUB_OUTPUT"
              echo "Docs-related files changed:"
              echo "$CHANGED"
            else
              echo "should_run=false" >> "$GITHUB_OUTPUT"
              echo "No docs-related files changed, skipping build"
            fi
          fi

      - name: Enable Corepack
        if: steps.docs-changes.outputs.should_run == 'true'
        run: corepack enable

      - name: Verify pnpm version
        if: steps.docs-changes.outputs.should_run == 'true'
        run: pnpm --version

      - name: Setup Node.js
        if: steps.docs-changes.outputs.should_run == 'true'
        uses: actions/setup-node@v7
        with:
          node-version: '20.x'
          cache: 'pnpm'

      - name: Turbo Cache
        if: steps.docs-changes.outputs.should_run == 'true'
        uses: actions/cache@v6
        with:
          path: node_modules/.cache/turbo
          key: turbo-${{ runner.os }}-docs-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-docs-
            turbo-${{ runner.os }}-

      - name: Install dependencies
        if: steps.docs-changes.outputs.should_run == 'true'
        run: pnpm install --frozen-lockfile

      - name: Build Site
        if: steps.docs-changes.outputs.should_run == 'true'
        run: pnpm turbo run build --filter='@object-ui/site'

  # Guard against fixture / @objectstack/spec drift: ensure the in-repo
  # debug backend (apps/dev-server) still compiles its `objectstack.config.ts`
  # into a valid artifact. Cheap (~10s after install) and protects the
  # contributor on-ramp documented in apps/console/README.md.
  dev-server:
    name: Dev-server fixture build
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          submodules: true

      - name: Enable Corepack
        run: corepack enable

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20.x'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build dev-server fixtures
        run: pnpm --filter @object-ui/dev-server build