ci.yml

name: CI

on:
  pull_request:
    types:
      - opened
      - synchronize
  push:
    branches:
      - main
      - canary

env:
  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
  TURBO_TEAM: ${{ vars.TURBO_TEAM || github.repository_owner }}

jobs:
  format:
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-format-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0

      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version-file: ".nvmrc"
          registry-url: "https://registry.npmjs.org"
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Format check (oxfmt)
        run: pnpm run fmt:check

  build-typecheck:
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-build-typecheck-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Cache turbo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-turbo-

      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0

      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version-file: ".nvmrc"
          registry-url: "https://registry.npmjs.org"
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Build packages
        run: pnpm exec turbo run build --filter="./packages/*"

      - name: Typecheck packages
        run: pnpm exec turbo run typecheck --filter="./packages/*"

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency:
      group: ${{ github.workflow }}-test-${{ matrix.node-version }}-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    strategy:
      fail-fast: false
      matrix:
        node-version: [22.x, 24.x]
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Cache turbo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-turbo-

      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0

      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: ${{ matrix.node-version }}
          registry-url: "https://registry.npmjs.org"
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Build packages
        run: pnpm exec turbo run build --filter="./packages/*"

      - name: Test packages
        run: pnpm exec turbo run test --filter="./packages/*"

  db-migrations-current:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    concurrency:
      group: ${{ github.workflow }}-db-migrations-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0

      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version-file: ".nvmrc"
          registry-url: "https://registry.npmjs.org"
          cache: pnpm

      - name: Install
        run: pnpm install --frozen-lockfile

      # drizzle-kit generate only reads schema.ts (no DB connection), so this
      # needs no DATABASE_URL and no secrets. Apps are discovered from their
      # drizzle.config.ts so a newly added app is covered automatically.
      # Contract: every app with a drizzle.config.ts must expose a db:generate
      # script — a config without one fails this job (fail-closed) rather than
      # being silently skipped. stdin is closed (< /dev/null) so an ambiguous
      # rename prompt fails fast instead of hanging until the job timeout.
      - name: Regenerate migrations from schema
        run: |
          set -e
          for cfg in $(git ls-files '*/drizzle.config.ts'); do
            app="$(dirname "$cfg")"
            if ! node -e "const fs=require('fs');const pkg=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));process.exit(pkg.scripts&&pkg.scripts['db:generate']?0:1)" "$app/package.json"; then
              echo "::error ::$app has a drizzle.config.ts but no db:generate script. Add a db:generate script (drizzle-kit generate) so the migration drift guard can check it."
              exit 1
            fi
            echo "::group::drizzle-kit generate ($app)"
            (cd "$app" && pnpm run db:generate < /dev/null)
            echo "::endgroup::"
          done

      - name: Fail if a schema change is missing its migration
        run: |
          CHANGED="$(git status --porcelain | grep '/drizzle/' || true)"
          if [ -n "$CHANGED" ]; then
            echo "::error ::A schema.ts change has no committed migration. Run 'pnpm db:generate' in the affected app and commit the drizzle/ folder."
            echo "$CHANGED"
            git add -A -- '*/drizzle/*'
            git --no-pager diff --cached -- '*/drizzle/*'
            exit 1
          fi
          echo "All Drizzle migrations are up to date."