ci.yml

name: Build and run tests

on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened

jobs:
  scan_ruby:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Scan for common Rails security vulnerabilities using static analysis
        run: bin/brakeman --no-pager

      - name: Scan for known security vulnerabilities in gems used
        run: bin/bundler-audit

  build-and-test:
    runs-on: ubuntu-latest

    # GitHub-hosted ubuntu-latest runners have 4 vCPUs; split the suite across
    # 4 parallel_tests processes (each with its own database) to cut wall time.
    env:
      PARALLEL_TEST_PROCESSORS: 4

    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ROOT_PASSWORD: ''
          MYSQL_ALLOW_EMPTY_PASSWORD: 'yes'
          MYSQL_DATABASE: awbw_test
        ports:
          - 3306:3306
        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - uses: actions/setup-node@v6
        with:
          node-version: 22
      - run: npm ci

      # Precompile assets once up front. Vite's autoBuild would otherwise have
      # each parallel_tests process build into the shared public/vite-test dir
      # at first request, and those concurrent builds corrupt each other.
      - name: Build test assets
        run: bin/vite build --mode test
        env:
          RAILS_ENV: test

      - name: Setup databases
        run: |
          bundle exec rake parallel:create parallel:load_schema
        env:
          RAILS_ENV: test
          # AWS credentials
          AWS_REGION: ${{ vars.AWS_REGION }}
          AWS_S3_BUCKET: ${{ vars.AWS_S3_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          # SMTP settings
          SMTP_SERVER: ${{ secrets.SMTP_SERVER }}
          SMTP_PORT: ${{ secrets.SMTP_PORT }}
          SMTP_USERNAME: ${{ secrets.SMTP_USERNAME }}
          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}

      - name: Run tests and publish results
        run: bundle exec parallel_rspec spec/
        env:
          RAILS_ENV: test
          # Assets are prebuilt above; never let a test process rebuild them
          # (concurrent rebuilds race on the shared output dir).
          VITE_RUBY_AUTO_BUILD: "false"
          # AWS credentials
          AWS_REGION: ${{ vars.AWS_REGION }}
          AWS_S3_BUCKET: ${{ vars.AWS_S3_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          # SMTP settings
          SMTP_SERVER: ${{ secrets.SMTP_SERVER }}
          SMTP_PORT: ${{ secrets.SMTP_PORT }}
          SMTP_USERNAME: ${{ secrets.SMTP_USERNAME }}
          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
          CI: "true"

      - name: Publish test results
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: rspec-results
          path: tmp/rspec_results/