ci.yml

name: CI
on:
  workflow_dispatch:
  pull_request:

# Prevent duplicate runs for the same branch, but do NOT cancel in-progress runs.
# Why: When using Graphite's `gt restack && gt submit` on a PR stack, GitHub often
# triggers two workflow runs simultaneously for the same commit (duplicate webhook events).
# With `cancel-in-progress: true`, one run gets cancelled - but GitHub shows check status
# from the higher run_number, which may be the cancelled one. This causes PRs to show
# "failed" status even when the other run succeeds. Setting to false lets both complete,
# ensuring the PR displays the successful status.
# Trade-off: Occasional duplicate CI runs during bulk stack operations.
# See: https://github.com/orgs/community/discussions/27174
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  actions: read
  pull-requests: write # for preview comments
  deployments: write # Netlify action needs it

jobs:
  # ─────────────────────────────────────── SKIP DUPLICATE RUNS ──────────────────────────────────────
  # Skip CI when tree content already passed (e.g., Graphite rebase with no code changes)
  pre_job:
    runs-on: ubuntu-latest
    outputs:
      should_skip: ${{ steps.skip_check.outputs.should_skip }}
    steps:
      - id: skip_check
        uses: fkirc/skip-duplicate-actions@v5
        with:
          skip_after_successful_duplicate: 'true'

  # ─────────────────────────────────────── 0. VALIDATE CHANGESETS ──────────────────────────────────────
  validate-changesets:
    needs: pre_job
    if: needs.pre_job.outputs.should_skip != 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Validate changesets
        run: |
          if find .changeset -name "*.md" -not -name "README.md" 2>/dev/null | grep -q .; then
            echo "Found changeset files, validating..."
            VERSION=$(jq -r '.devDependencies["@changesets/cli"]' package.json | tr -d '^~')
            if ! pnpm dlx @changesets/cli@$VERSION status --since=origin/main; then
              echo ""
              echo "::error::Changeset validation failed. This usually means a changeset references a package that doesn't exist in the workspace."
              echo "Check the package names in your .changeset/*.md files match the 'name' field in package.json files."
              exit 1
            fi
            echo "✅ Changesets are valid"
          else
            echo "No changeset files found, skipping validation"
          fi

  # ─────────────────────────────────────── 1. BUILD & TEST ──────────────────────────────────────
  build-and-test:
    needs: pre_job
    if: needs.pre_job.outputs.should_skip != 'true'
    runs-on: ubuntu-latest
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Set Nx base for affected commands
        run: |
          echo "NX_BASE=origin/main" >> $GITHUB_ENV
          echo "NX_HEAD=HEAD" >> $GITHUB_ENV

      - name: Pre-start Supabase for affected packages
        run: ./scripts/ci-prestart-supabase.sh core

      - name: Quality gate (lint + typecheck + test)
        run: pnpm nx affected -t lint typecheck test --parallel --configuration=production --base="$NX_BASE" --head="$NX_HEAD"

      - name: Build all affected packages (excludes website and demo - they build during deploy)
        run: pnpm nx affected -t build --configuration=production --parallel --exclude=website,demo --base="$NX_BASE" --head="$NX_HEAD"

      - name: Verify exports for built packages
        run: pnpm nx affected -t verify-exports --base="$NX_BASE" --head="$NX_HEAD"

  # ─────────────────────────────────────── 2. EDGE-WORKER E2E ──────────────────────────────────────
  edge-worker-e2e:
    needs: pre_job
    if: needs.pre_job.outputs.should_skip != 'true'
    runs-on: ubuntu-latest
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Check if edge-worker is affected
        id: check
        run: |
          if pnpm nx show projects --affected --base=origin/main --head=HEAD | grep -q "^edge-worker$"; then
            echo "affected=true" >> $GITHUB_OUTPUT
            echo "edge-worker is affected, running e2e tests"
          else
            echo "affected=false" >> $GITHUB_OUTPUT
            echo "edge-worker not affected, skipping e2e tests"
          fi

      - name: Pre-start Supabase
        if: steps.check.outputs.affected == 'true'
        run: ./scripts/ci-prestart-supabase.sh edge-worker

      - name: Run edge-worker e2e tests
        if: steps.check.outputs.affected == 'true'
        run: pnpm nx run edge-worker:e2e

  # ─────────────────────────────────────── 2a. EDGE-WORKER INTEGRATION ──────────────────────────────────────
  edge-worker-integration:
    needs: pre_job
    if: needs.pre_job.outputs.should_skip != 'true'
    runs-on: ubuntu-latest
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Check if edge-worker is affected
        id: check
        run: |
          if pnpm nx show projects --affected --base=origin/main --head=HEAD | grep -q "^edge-worker$"; then
            echo "affected=true" >> $GITHUB_OUTPUT
            echo "edge-worker is affected, running integration tests"
          else
            echo "affected=false" >> $GITHUB_OUTPUT
            echo "edge-worker not affected, skipping integration tests"
          fi

      - name: Pre-start Supabase
        if: steps.check.outputs.affected == 'true'
        run: ./scripts/ci-prestart-supabase.sh edge-worker

      - name: Run edge-worker integration tests
        if: steps.check.outputs.affected == 'true'
        run: pnpm nx run edge-worker:test:integration

  # ─────────────────────────────────────── 2b. CLI E2E ──────────────────────────────────────
  cli-e2e:
    needs: pre_job
    if: needs.pre_job.outputs.should_skip != 'true'
    runs-on: ubuntu-latest
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Check if cli is affected
        id: check
        run: |
          if pnpm nx show projects --affected --base=origin/main --head=HEAD | grep -q "^cli$"; then
            echo "affected=true" >> $GITHUB_OUTPUT
            echo "cli is affected, running e2e tests"
          else
            echo "affected=false" >> $GITHUB_OUTPUT
            echo "cli not affected, skipping e2e tests"
          fi

      - name: Pre-start Supabase
        if: steps.check.outputs.affected == 'true'
        run: ./scripts/ci-prestart-supabase.sh cli

      - name: Run cli e2e tests
        if: steps.check.outputs.affected == 'true'
        run: pnpm nx run cli:e2e

  # ─────────────────────────────────────── 2c. CLIENT E2E ──────────────────────────────────────
  client-e2e:
    needs: pre_job
    if: needs.pre_job.outputs.should_skip != 'true'
    runs-on: ubuntu-latest
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Check if client is affected
        id: check
        run: |
          if pnpm nx show projects --affected --base=origin/main --head=HEAD | grep -q "^client$"; then
            echo "affected=true" >> $GITHUB_OUTPUT
            echo "client is affected, running e2e tests"
          else
            echo "affected=false" >> $GITHUB_OUTPUT
            echo "client not affected, skipping e2e tests"
          fi

      - name: Pre-start Supabase
        if: steps.check.outputs.affected == 'true'
        run: ./scripts/ci-prestart-supabase.sh client

      - name: Run client e2e tests
        if: steps.check.outputs.affected == 'true'
        run: pnpm nx run client:e2e

  # ─────────────────────────────────────── 2d. CORE PGTAP ──────────────────────────────────────
  core-pgtap:
    needs: pre_job
    if: needs.pre_job.outputs.should_skip != 'true'
    runs-on: ubuntu-latest
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Check if core is affected
        id: check
        run: |
          if pnpm nx show projects --affected --base=origin/main --head=HEAD | grep -q "^core$"; then
            echo "affected=true" >> $GITHUB_OUTPUT
            echo "core is affected, running pgtap tests"
          else
            echo "affected=false" >> $GITHUB_OUTPUT
            echo "core not affected, skipping pgtap tests"
          fi

      - name: Pre-start Supabase
        if: steps.check.outputs.affected == 'true'
        run: ./scripts/ci-prestart-supabase.sh core

      - name: Run core pgtap tests
        if: steps.check.outputs.affected == 'true'
        run: pnpm nx run core:pgtap

  # ────────────────────────────────── 3. DEPLOY WEBSITE (PREVIEW) ───────────────────────────
  deploy-website:
    if: github.event_name == 'pull_request'
    needs:
      [
        build-and-test,
        edge-worker-e2e,
        edge-worker-integration,
        cli-e2e,
        client-e2e,
        core-pgtap,
      ]
    runs-on: ubuntu-latest
    environment: preview
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Check if website is affected
        id: check-affected
        run: |
          if pnpm nx show projects --affected -t build --base=origin/main --head=HEAD | grep -q "^website$"; then
            echo "affected=true" >> $GITHUB_OUTPUT
            echo "Website is affected by changes"
          else
            echo "affected=false" >> $GITHUB_OUTPUT
            echo "Website is not affected by changes - skipping deployment"
          fi

      - name: Deploy website preview
        if: steps.check-affected.outputs.affected == 'true'
        uses: ./.github/actions/deploy-website
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}
          environment: preview
          supabase-url: ${{ secrets.WEBSITE_PREVIEW_SUPABASE_URL }}
          supabase-anon-key: ${{ secrets.WEBSITE_PREVIEW_SUPABASE_ANON_KEY }}
          cloudflare-api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          cloudflare-account-id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          preview-name: pr-${{ github.event.pull_request.number }}
          preview-url: https://pr-${{ github.event.pull_request.number }}.pgflow.pages.dev
          production-url: https://pgflow.dev

  # ────────────────────────────────── 4. DEPLOY DEMO ───────────────────────────
  deploy-demo:
    if: false # temporarily disabled
    needs:
      [
        build-and-test,
        edge-worker-e2e,
        edge-worker-integration,
        cli-e2e,
        client-e2e,
        core-pgtap,
      ]
    runs-on: ubuntu-latest
    environment: ${{ github.event_name == 'pull_request' && 'preview' || 'production' }}
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
      VITE_SUPABASE_URL: ${{ github.event_name == 'pull_request' && secrets.DEMO_PREVIEW_SUPABASE_URL || secrets.DEMO_PRODUCTION_SUPABASE_URL }}
      VITE_SUPABASE_ANON_KEY: ${{ github.event_name == 'pull_request' && secrets.DEMO_PREVIEW_SUPABASE_ANON_KEY || secrets.DEMO_PRODUCTION_SUPABASE_ANON_KEY }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          atlas-cloud-token: ${{ secrets.ATLAS_CLOUD_TOKEN }}

      - name: Set Nx base for affected commands
        run: |
          echo "NX_BASE=origin/main" >> $GITHUB_ENV
          echo "NX_HEAD=HEAD" >> $GITHUB_ENV

      - name: Validate Supabase environment variables
        run: |
          if [ -z "$VITE_SUPABASE_URL" ]; then
            echo "❌ Error: VITE_SUPABASE_URL is not set"
            echo "Required GitHub secret missing: DEMO_${{ github.event_name == 'pull_request' && 'PREVIEW' || 'PRODUCTION' }}_SUPABASE_URL"
            exit 1
          fi
          if [ -z "$VITE_SUPABASE_ANON_KEY" ]; then
            echo "❌ Error: VITE_SUPABASE_ANON_KEY is not set"
            echo "Required GitHub secret missing: DEMO_${{ github.event_name == 'pull_request' && 'PREVIEW' || 'PRODUCTION' }}_SUPABASE_ANON_KEY"
            exit 1
          fi
          if [[ ! "$VITE_SUPABASE_URL" =~ ^https:// ]]; then
            echo "❌ Error: VITE_SUPABASE_URL must use https:// (not http://)"
            echo "Current value: $VITE_SUPABASE_URL"
            exit 1
          fi
          echo "✅ Supabase environment variables are valid"

      - name: Deploy demo
        id: deploy-demo
        env:
          PREVIEW_NAME: pr-${{ github.event.pull_request.number }}
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            pnpm nx affected -t deploy:preview --projects=demo --base="$NX_BASE" --head="$NX_HEAD"
          else
            pnpm nx affected -t deploy --projects=demo --base="$NX_BASE" --head="$NX_HEAD"
          fi

      - name: Post deployment comment
        if: success()
        uses: ./.github/actions/deployment-comment
        with:
          project-name: Demo
          preview-url: https://pr-${{ github.event.pull_request.number }}-pgflow-demo.jumski.workers.dev
          production-url: https://demo.pgflow.dev