ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  packages: read

jobs:
  # Build once, enumerate the test groups (unit + per-domain/house a11y), and
  # hand both to the fan-out below. dist/ is the a11y suite's input.
  build:
    runs-on: ubuntu-latest
    outputs:
      groups: ${{ steps.list.outputs.groups }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: "npm"
      - name: install
        run: npm ci
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: prettier check
        run: npm run format:check
      - name: build
        run: npm run build
      - name: enumerate test groups
        id: list
        run: echo "groups=$(node scripts/khai-tests.mjs --list)" >> "$GITHUB_OUTPUT"
      - name: upload built site
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist
          retention-days: 1

  # One check per group ("khai-tests (unit)", "khai-tests (plays-grimm-1)", ...),
  # run in parallel. Each downloads the prebuilt site and runs only its group, so
  # the per-page jsdom heap stays bounded however large a house grows.
  khai-tests:
    needs: build
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        group: ${{ fromJSON(needs.build.outputs.groups) }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: "npm"
      - name: install
        run: npm ci
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: download built site
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist
      - name: ${{ matrix.group }}
        run: node scripts/khai-tests.mjs --group "${{ matrix.group }}"

  # Single required status check: green only when build and EVERY group passed.
  # `if: always()` is essential -- a `needs` job is skipped when a dependency
  # fails, and branch protection treats a skipped required check as passing, so
  # the gate must run regardless and fail explicitly. Point branch protection at
  # THIS job (khai-tests-gate), not the matrix, whose check names vary by group.
  khai-tests-gate:
    needs: [build, khai-tests]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: require build + all groups to pass
        run: |
          echo "build=${{ needs.build.result }} khai-tests=${{ needs.khai-tests.result }}"
          [ "${{ needs.build.result }}" = "success" ] || { echo "build failed"; exit 1; }
          [ "${{ needs.khai-tests.result }}" = "success" ] || { echo "a test group failed"; exit 1; }

  khai-guard:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: "npm"
      - name: install
        run: npm ci
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: source/test separation gate
        run: npx khai-guard --base "${{ github.event.pull_request.base.sha }}" --head "${{ github.event.pull_request.head.sha }}"

  branch-scope:
    # The branch-NAME-to-lane gate (see docs/BRANCHING.md). ENFORCED: with no
    # KHAI_GUARD_BRANCH_ADVISORY env, branch-check exits 1 on a violation and
    # this job fails. To make it BLOCK merges, add "branch-scope" to the
    # required status checks in branch protection (an admin setting; no change
    # to @chbrain/khai-guard is needed). To temporarily relax, set
    # KHAI_GUARD_BRANCH_ADVISORY=1 here again.
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: "npm"
      - name: install
        run: npm ci
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: branch-scope lane gate
        # On a PR, actions/checkout leaves a detached HEAD (the merge commit),
        # so pass the PR head ref via --branch for the lane classification and
        # the PR base/head as the diff range (matching the source/test gate).
        run: npx khai-guard branch-check --branch "${{ github.head_ref }}" --base "${{ github.event.pull_request.base.sha }}" --head "${{ github.event.pull_request.head.sha }}"