ci.yml

name: CI

on:
  push:
    branches: [main]
    paths-ignore:
      - .gitignore
  pull_request:
    paths-ignore:
      - .gitignore

permissions:
  contents: read

# satisfy validate-env on the web build.
env:
  VITE_KINORA_SERVER_URL: http://localhost:3000

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version-file: package.json
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

      - name: Test
        run: pnpm test

  # landing is a standalone Astro workspace (own lockfile), so pnpm -r above never touches it.
  # Lint is already covered by the root eslint .; this catches astro type errors + a broken build.
  landing:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        working-directory: landing
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version-file: package.json
          cache: pnpm
          cache-dependency-path: landing/pnpm-lock.yaml

      - run: pnpm install --frozen-lockfile

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

  docs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        working-directory: docs
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version-file: package.json
          cache: pnpm
          cache-dependency-path: docs/pnpm-lock.yaml

      - run: pnpm install --frozen-lockfile

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

  integration_tests:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:18.1
        env:
          POSTGRES_USER: kinora
          POSTGRES_PASSWORD: kinora
          POSTGRES_DB: kinora
        ports:
          - 5436:5432
        options: >-
          --health-cmd "pg_isready -U kinora"
          --health-interval 5s --health-timeout 5s --health-retries 10
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version-file: package.json
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      # MinIO can't run as a GH service (needs the `server /data` arg), so run it as a step.
      - name: Start MinIO
        run: |
          docker run -d --name minio -p 9000:9000 \
            -e MINIO_ROOT_USER=minio -e MINIO_ROOT_PASSWORD=minio12345 \
            minio/minio server /data
          timeout 30 sh -c 'until curl -sf http://localhost:9000/minio/health/ready; do sleep 1; done'

      # test-env falls back to the dev-compose defaults (kinora @ localhost:5436), which match the service.
      - name: Integration tests
        run: pnpm --filter @kinora/server test:coverage

  e2e_tests:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      postgres:
        image: postgres:18.1
        env:
          POSTGRES_USER: kinora
          POSTGRES_PASSWORD: kinora
          POSTGRES_DB: kinora
        ports:
          - 5436:5432
        options: >-
          --health-cmd "pg_isready -U kinora"
          --health-interval 5s --health-timeout 5s --health-retries 10
    env:
      VITE_KINORA_SERVER_URL: http://localhost:3399
      NODE_ENV: development
      PORT: '3399'
      BASE_URL: http://localhost:3399
      WEB_ORIGIN: http://localhost:5399
      AUTH_SECRET: ci-e2e-secret-not-used-for-anything-real
      POSTGRES_USER: kinora
      POSTGRES_PASSWORD: kinora
      POSTGRES_HOST: localhost
      POSTGRES_PORT: '5436'
      POSTGRES_DB: kinora_e2e
      STORAGE_DIR: .data/artifacts
      GOOGLE_CLIENT_ID: ''
      GOOGLE_CLIENT_SECRET: ''
      GITHUB_CLIENT_ID: ''
      GITHUB_CLIENT_SECRET: ''
      KINORA_CLOUD: 'false'
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version-file: package.json
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - name: Cache Playwright browsers
        id: playwright-cache
        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}

      # On a cache hit the browser binary is restored; OS deps live system-wide and aren't cached.
      - name: Install Playwright browser
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm --filter @kinora/web exec playwright install --with-deps chromium

      - name: Install Playwright OS deps
        if: steps.playwright-cache.outputs.cache-hit == 'true'
        run: pnpm --filter @kinora/web exec playwright install-deps chromium

      # test:e2e resets kinora_e2e + self-boots the stack on dedicated ports (same as local).
      - name: E2E (viewer + web suites)
        run: pnpm test:e2e