ci.yml

# NOTE: Branch protection should require the "ci" job to pass before merge.
# Configure in GitHub: Settings > Branches > Branch protection rules > main
#   - Require status checks: ci
#   - Require branches to be up to date before merging

name: CI

on:
  push:
    branches: [main]
    paths-ignore: ['docs/**', '*.md']
  pull_request:
    branches: [main]
    # No paths-ignore: always trigger so the required "ci" check is posted.
    # The changes job below skips heavy work for non-code PRs.
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  changes:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 2
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            code:
              - 'src/**'
              - 'static/**'
              - 'package*.json'
              - '*.config.js'
              - '*.config.ts'
              - 'tsconfig.json'
              - 'Dockerfile'

  lint-and-check:
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Validate commit messages
        if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
        run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

      - name: Lint (ratcheted)
        run: npm run lint:ci

      - name: Format check
        run: npm run format:check

      - name: Type check
        run: npm run type-check

      - name: Tests with coverage
        run: npm run test:coverage

      - name: Upload coverage
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: coverage-report
          path: coverage/
          retention-days: 7

      - name: Production build
        run: npm run build

  ci:
    runs-on: ubuntu-latest
    if: always()
    needs: [changes, lint-and-check]
    steps:
      - name: Check CI status
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" && "${{ needs.changes.outputs.code }}" != "true" ]]; then
            echo "No code changes detected, CI auto-passed"
            exit 0
          fi
          if [[ "${{ needs.lint-and-check.result }}" == "failure" || "${{ needs.lint-and-check.result }}" == "cancelled" ]]; then
            echo "CI failed"
            exit 1
          fi
          echo "CI passed"