ci.yml

name: CI

on:
  push:
    branches: [main]
    paths-ignore:
      - '**/*.md'
  pull_request:
    branches: [main]
    paths-ignore:
      - '**/*.md'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  lint-and-check:
    name: Lint, Type Check, Build
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Lint (ratchet - no net-new warnings allowed)
        # lint:ci threshold = current warning count (44). Ratchet down as tech debt is resolved.
        # Pre-commit enforces --max-warnings 0 on changed files, so new code must be clean.
        run: npm run lint:ci

      - name: Format check
        run: npm run format:check

      - name: Type check
        run: npm run type-check

      - name: Unit tests
        run: npm test
        env:
          IRON_SESSION_PASSWORD: test-password-that-is-at-least-32-characters-long
          POLL_SECRET: test-poll-secret-16chars
          NEXT_PUBLIC_APP_URL: https://test.swapify.app

      - name: Integration tests
        run: npm run test:integration
        env:
          IRON_SESSION_PASSWORD: test-password-that-is-at-least-32-characters-long
          POLL_SECRET: test-poll-secret-16chars
          NEXT_PUBLIC_APP_URL: https://test.swapify.app

      - name: Test with coverage
        run: npm run test:coverage
        continue-on-error: true
        env:
          IRON_SESSION_PASSWORD: test-password-that-is-at-least-32-characters-long
          POLL_SECRET: test-poll-secret-16chars
          NEXT_PUBLIC_APP_URL: https://test.swapify.app

      - name: Upload coverage report
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: coverage
          path: coverage/
          retention-days: 7

      - name: Check for schema drift
        run: |
          SCHEMA_CHANGED=$(git diff origin/main...HEAD --name-only -- src/db/schema.ts | wc -l)
          MIGRATION_ADDED=$(git diff origin/main...HEAD --name-only -- 'drizzle/*.sql' | wc -l)
          if [ "$SCHEMA_CHANGED" -gt 0 ] && [ "$MIGRATION_ADDED" -eq 0 ]; then
            echo "::error::Schema changed (src/db/schema.ts) but no migration file added in drizzle/*.sql"
            echo "Run 'npm run db:generate' or write a manual migration, then commit the SQL file."
            exit 1
          fi

      - name: Build
        run: npm run build
        env:
          NEXT_PUBLIC_APP_URL: https://swapify.312.dev

      - name: Worker build
        run: npm run worker:build

  ci:
    name: CI Status
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: [lint-and-check]
    if: always()
    steps:
      - name: Check CI results
        run: |
          results="${{ needs.lint-and-check.result }}"
          echo "Job results: $results"
          if echo "$results" | grep -qE '(failure|cancelled)'; then
            echo "::error::CI job failed or was cancelled"
            exit 1
          fi
          echo "All CI checks passed"