ci.yml

name: CI

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main

jobs:
  pack:
    name: Build package
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: corepack enable
      - run: yarn install --immutable
      - run: yarn pack
      - uses: actions/upload-artifact@v4
        with:
          name: package
          path: '*.tgz'

  biome:
    name: Lint (Biome)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: corepack enable
      - run: yarn install --immutable
      - run: yarn lint

  typescript:
    name: Lint (TypeScript)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: corepack enable
      - run: yarn install --immutable
      - run: yarn typecheck

  unit:
    name: Unit tests (Node ${{ matrix.node }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node:
          - 20
          - 22
          - 24
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
      - run: corepack enable
      - run: yarn install --immutable
      - run: yarn test

  browser:
    name: Browser tests
    if: >
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: corepack enable
      - run: yarn install --immutable
      - name: Ensure Transloadit secrets
        run: |
          missing=()
          if [ -z "${TRANSLOADIT_KEY}" ]; then
            missing+=("TRANSLOADIT_KEY")
          fi
          if [ -z "${TRANSLOADIT_SECRET}" ]; then
            missing+=("TRANSLOADIT_SECRET")
          fi
          if [ -z "${TRANSLOADIT_R2_CREDENTIALS}" ]; then
            if [ -z "${R2_BUCKET}" ] || [ -z "${R2_ACCESS_KEY_ID}" ] || [ -z "${R2_SECRET_ACCESS_KEY}" ] || ([ -z "${R2_HOST}" ] && [ -z "${R2_ACCOUNT_ID}" ]) || [ -z "${R2_PUBLIC_URL}" ]; then
              missing+=("TRANSLOADIT_R2_CREDENTIALS (or R2_* variables)")
            fi
          fi
          if [ ${#missing[@]} -ne 0 ]; then
            echo "Missing secrets: ${missing[*]}" >&2
            exit 1
          fi
        env:
          TRANSLOADIT_KEY: ${{ secrets.TRANSLOADIT_KEY }}
          TRANSLOADIT_SECRET: ${{ secrets.TRANSLOADIT_SECRET }}
          TRANSLOADIT_R2_CREDENTIALS: ${{ secrets.TRANSLOADIT_R2_CREDENTIALS }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_HOST: ${{ secrets.R2_HOST }}
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          R2_PUBLIC_URL: ${{ secrets.R2_PUBLIC_URL }}
      - name: Check hosted Chrome
        run: |
          set -euo pipefail
          echo "::group::Browser test diagnostics"
          node --version
          yarn --version
          google-chrome --version
          df -h
          echo "::endgroup::"
      - name: Run local browser verification
        run: timeout --foreground 12m yarn verify:local
        env:
          PLAYWRIGHT_SKIP_INSTALL: "1"
          PLAYWRIGHT_CHROMIUM_CHANNEL: chrome
          TRANSLOADIT_KEY: ${{ secrets.TRANSLOADIT_KEY }}
          TRANSLOADIT_SECRET: ${{ secrets.TRANSLOADIT_SECRET }}
          TRANSLOADIT_R2_CREDENTIALS: ${{ secrets.TRANSLOADIT_R2_CREDENTIALS }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_HOST: ${{ secrets.R2_HOST }}
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          R2_PUBLIC_URL: ${{ secrets.R2_PUBLIC_URL }}

  convex-qa:
    name: Convex deployment QA
    if: >
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: corepack enable
      - run: yarn install --immutable
      - name: Compute preview deployment name
        if: github.event_name == 'pull_request'
        id: preview_name
        run: |
          echo "name=$(node scripts/slugify-branch.ts)" >> "$GITHUB_OUTPUT"
      - name: Deploy Convex preview (PR)
        if: github.event_name == 'pull_request'
        run: |
          timeout --foreground 12m node scripts/deploy-cloud.ts >> "$GITHUB_ENV"
        env:
          CI_OUTPUT: "1"
          CONVEX_PREVIEW_NAME: ${{ steps.preview_name.outputs.name }}
          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_PREVIEW_DEPLOY_KEY }}
          TRANSLOADIT_KEY: ${{ secrets.TRANSLOADIT_KEY }}
          TRANSLOADIT_SECRET: ${{ secrets.TRANSLOADIT_SECRET }}
          TRANSLOADIT_R2_CREDENTIALS: ${{ secrets.TRANSLOADIT_R2_CREDENTIALS }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_HOST: ${{ secrets.R2_HOST }}
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          R2_PUBLIC_URL: ${{ secrets.R2_PUBLIC_URL }}
      - name: Deploy Convex stable (main)
        if: github.ref == 'refs/heads/main'
        run: |
          timeout --foreground 12m node scripts/deploy-cloud.ts >> "$GITHUB_ENV"
        env:
          CI_OUTPUT: "1"
          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
          TRANSLOADIT_KEY: ${{ secrets.TRANSLOADIT_KEY }}
          TRANSLOADIT_SECRET: ${{ secrets.TRANSLOADIT_SECRET }}
          TRANSLOADIT_R2_CREDENTIALS: ${{ secrets.TRANSLOADIT_R2_CREDENTIALS }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_HOST: ${{ secrets.R2_HOST }}
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          R2_PUBLIC_URL: ${{ secrets.R2_PUBLIC_URL }}
      - name: Set stable demo URL (main)
        if: github.ref == 'refs/heads/main'
        run: |
          if [ -z "${E2E_REMOTE_APP_URL}" ]; then
            echo "E2E_REMOTE_APP_URL missing" >&2
            exit 1
          fi
          echo "E2E_REMOTE_APP_URL=${E2E_REMOTE_APP_URL}" >> "$GITHUB_ENV"
        env:
          E2E_REMOTE_APP_URL: ${{ secrets.E2E_REMOTE_APP_URL }}
      - name: Resolve Vercel preview URL
        if: env.E2E_REMOTE_APP_URL == ''
        run: |
          preview_url="$(timeout --foreground 7m node scripts/resolve-vercel-preview.ts)"
          echo "Resolved Vercel preview URL: ${preview_url}"
          echo "E2E_REMOTE_APP_URL=${preview_url}" >> "$GITHUB_ENV"
        env:
          VERCEL_PREVIEW_DEPLOY_HOOK: ${{ secrets.VERCEL_PREVIEW_DEPLOY_HOOK }}
          VERCEL_PROJECT_SLUG: convex
          VERCEL_TEAM_SLUG: transloadit-com
          VERCEL_PROTECTION_BYPASS: ${{ secrets.VERCEL_PROTECTION_BYPASS }}
          GITHUB_TOKEN: ${{ github.token }}
      - name: Ensure cloud QA secrets
        run: |
          missing=()
          if [ -z "${E2E_REMOTE_APP_URL}" ]; then
            missing+=("E2E_REMOTE_APP_URL")
          fi
          if [ -z "${E2E_REMOTE_CONVEX_URL}" ] && [ -n "${E2E_REMOTE_CONVEX_URL_STABLE}" ]; then
            echo "E2E_REMOTE_CONVEX_URL=${E2E_REMOTE_CONVEX_URL_STABLE}" >> "$GITHUB_ENV"
            E2E_REMOTE_CONVEX_URL="${E2E_REMOTE_CONVEX_URL_STABLE}"
          fi
          if [ -z "${VERCEL_PROTECTION_BYPASS}" ]; then
            missing+=("VERCEL_PROTECTION_BYPASS")
          fi
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ] && [ -z "${CONVEX_PREVIEW_DEPLOY_KEY}" ]; then
            missing+=("CONVEX_PREVIEW_DEPLOY_KEY")
          fi
          if [ -z "${E2E_REMOTE_CONVEX_URL}" ]; then
            missing+=("E2E_REMOTE_CONVEX_URL")
          fi
          if [ ${#missing[@]} -ne 0 ]; then
            echo "Missing secrets: ${missing[*]}" >&2
            exit 1
          fi
        env:
          E2E_REMOTE_APP_URL: ${{ env.E2E_REMOTE_APP_URL }}
          E2E_REMOTE_CONVEX_URL: ${{ env.E2E_REMOTE_CONVEX_URL }}
          E2E_REMOTE_CONVEX_URL_STABLE: ${{ secrets.E2E_REMOTE_CONVEX_URL }}
          VERCEL_PROTECTION_BYPASS: ${{ secrets.VERCEL_PROTECTION_BYPASS }}
          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
          CONVEX_PREVIEW_DEPLOY_KEY: ${{ secrets.CONVEX_PREVIEW_DEPLOY_KEY }}
      - name: Run cloud verification
        run: timeout --foreground 12m yarn verify:cloud
        env:
          E2E_REMOTE_APP_URL: ${{ env.E2E_REMOTE_APP_URL }}
          E2E_REMOTE_CONVEX_URL: ${{ env.E2E_REMOTE_CONVEX_URL }}
          PLAYWRIGHT_SKIP_INSTALL: "1"
          PLAYWRIGHT_CHROMIUM_CHANNEL: chrome
          VERCEL_PROTECTION_BYPASS: ${{ secrets.VERCEL_PROTECTION_BYPASS }}

  deploy-example:
    name: Deploy example (Vercel)
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs:
      - pack
      - biome
      - typescript
      - unit
      - browser
      - convex-qa
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: corepack enable
      - run: yarn install --immutable
      - name: Deploy demo Convex backend
        run: node scripts/deploy-demo.ts
        env:
          CI_OUTPUT: "1"
          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
          E2E_REMOTE_CONVEX_URL: ${{ secrets.E2E_REMOTE_CONVEX_URL }}
          TRANSLOADIT_KEY: ${{ secrets.TRANSLOADIT_KEY }}
          TRANSLOADIT_SECRET: ${{ secrets.TRANSLOADIT_SECRET }}
          TRANSLOADIT_R2_CREDENTIALS: ${{ secrets.TRANSLOADIT_R2_CREDENTIALS }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_HOST: ${{ secrets.R2_HOST }}
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          R2_PUBLIC_URL: ${{ secrets.R2_PUBLIC_URL }}
      - name: Trigger Vercel deploy hook
        run: |
          if [ -z "${VERCEL_DEPLOY_HOOK}" ]; then
            echo "VERCEL_DEPLOY_HOOK missing" >&2
            exit 1
          fi
          curl -fsSL -X POST "${VERCEL_DEPLOY_HOOK}"
        env:
          VERCEL_DEPLOY_HOOK: ${{ secrets.VERCEL_DEPLOY_HOOK }}