ci.yaml

name: CI

on:
  push:
    branches: ["**"]
    tags: ["v*"]
  pull_request:
    branches: ["**"]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        # pgvector, not stock postgres — the schema migration creates the
        # `vector` extension and an hnsw index.
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: app
          POSTGRES_PASSWORD: app
          POSTGRES_DB: app
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U app -d app"
          --health-interval 5s --health-timeout 3s --health-retries 10
    env:
      POSTGRES_HOST: localhost
      POSTGRES_PORT: "5432"
      POSTGRES_USER: app
      POSTGRES_PASSWORD: app
      POSTGRES_DB: app
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Typecheck
        run: bunx tsc --noEmit

      - name: Apply database schema
        working-directory: apps/backend
        run: bun run migration:run

      - name: Run scenario tests
        # @mainnet and @manual scenarios are run by a human against Base
        # mainnet; funded keys never reach CI.
        run: bun test

      - name: Scenario coverage report
        run: bun run scenarios

      - name: Smoke-build frontend
        run: bun apps/frontend/build.ts

  publish:
    needs: test
    if: github.event_name != 'pull_request' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || startsWith(github.ref, 'refs/tags/v'))
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        include:
          - { app: backend, image: backend }
          - { app: frontend, image: frontend }
          - { app: admin, image: admin }
          # The site ships twice from one Dockerfile: the default stage is the
          # nginx runtime image, and `deploy` is the stage that renders the
          # pages and pushes them to Cloudflare Pages. operations/ runs the
          # second one as a Nomad batch job.
          - { app: frontend, image: frontend-deploy, target: deploy }
    steps:
      - uses: actions/checkout@v5

      - uses: docker/setup-buildx-action@v3

      - name: Log in to the container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.image }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,format=long
            type=semver,pattern={{version}}

      - name: Build and push image
        uses: docker/build-push-action@v6
        env:
          # The action otherwise uploads a .dockerbuild build record artifact and
          # writes a build summary onto every run. The registry is the artifact
          # we care about.
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
        with:
          context: .
          file: apps/${{ matrix.app }}/Dockerfile
          # Empty for every entry but frontend-deploy, which means the default
          # (final) stage, so the runtime images are unaffected.
          target: ${{ matrix.target }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}