ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    # Do not restrict by base branch: stacked PR layers target the preceding
    # feature branch rather than main/develop.
  merge_group:
    branches: [main]

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name != 'merge_group' }}

permissions:
  contents: read

jobs:
  # ═══════════════════════════════════════════════════════════════
  # Change Detection — decides which expensive jobs to run
  # ═══════════════════════════════════════════════════════════════
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      ci: ${{ steps.filter.outputs.ci }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
          filters: |
            backend:
              - 'server/smp/**'
              - 'shared/**'
              - 'server/smp/build.gradle.kts'
            frontend:
              - 'apps/web/marketing/**'
              - 'apps/web/app/**'
              - 'apps/web/admin/**'
              - 'pnpm-lock.yaml'
            ci:
              - '.github/workflows/**'
              - '.github/actions/**'
              - 'justfile'
              - 'package.json'
              - 'pnpm-workspace.yaml'
              - 'pnpm-lock.yaml'
              - 'settings.gradle.kts'
              - 'build.gradle.kts'

  # ═══════════════════════════════════════════════════════════════
  # Always-on jobs — fast, run on every push
  # ═══════════════════════════════════════════════════════════════

  # ──────────────────────────────────────────────────────────────
  # 1. Lint — Biome (marketing/app) + Detekt (backend)
  # ──────────────────────────────────────────────────────────────
  lint:
    name: 🧹 Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-frontend

      - uses: ./.github/actions/setup-backend

      - name: Biome lint (marketing + app + admin)
        shell: bash
        run: |
          cd apps/web/marketing && pnpm lint
          cd ../app && pnpm lint
          cd ../admin && pnpm lint

      - name: Spotless check (backend)
        shell: bash
        run: ./gradlew spotlessCheck --no-daemon

      - name: Detekt (backend)
        shell: bash
        run: ./gradlew :server:smp:detekt --no-daemon

  # ──────────────────────────────────────────────────────────────
  # 2. Frontend unit tests (marketing + app)
  # ──────────────────────────────────────────────────────────────
  frontend-unit:
    name: 🧪 Frontend Unit Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-frontend

      - name: Run marketing unit tests + coverage
        shell: bash
        run: cd apps/web/marketing && pnpm test:coverage

      - name: Run web/app unit tests + coverage
        shell: bash
        run: cd apps/web/app && pnpm test:coverage

      - name: Run web/admin unit tests
        shell: bash
        run: cd apps/web/admin && pnpm test:run

  # ──────────────────────────────────────────────────────────────
  # 3. Production builds and frontend type checks
  # ──────────────────────────────────────────────────────────────
  build:
    name: 🔨 Production Builds
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-frontend

      - uses: ./.github/actions/setup-backend

      - name: Build marketing site
        shell: bash
        run: pnpm --filter marketing build

      - name: Type-check and build dashboard
        shell: bash
        run: pnpm --filter app build

      - name: Type-check and build admin
        shell: bash
        run: pnpm --filter @profiletailors/admin build

      - name: Build backend artifact
        shell: bash
        run: ./gradlew :server:smp:bootJar --no-daemon

  # ──────────────────────────────────────────────────────────────
  # 4. Backend unit tests (Kotlin — no Postgres)
  # ──────────────────────────────────────────────────────────────
  backend-unit:
    name: 🧪 Backend Unit Tests
    runs-on: ubuntu-latest
    env:
      SMP_DB_TEST_PASSWORD: ${{ secrets.SMP_POSTGRES_PASSWORD }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-backend

      - name: Run unit tests (exclude BDD suites)
        shell: bash
        run: ./gradlew :server:smp:test -x :server:smp:bddFastTest -x :server:smp:bddPostgresTest --no-daemon

  # ═══════════════════════════════════════════════════════════════
  # Conditional jobs — only run when relevant paths change
  # ═══════════════════════════════════════════════════════════════

  # ──────────────────────────────────────────────────────────────
  # 5. Backend BDD fast suite
  # ──────────────────────────────────────────────────────────────
  backend-bdd:
    name: 🔨 Backend BDD
    needs: changes
    if: needs.changes.outputs.backend == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: write
    env:
      SMP_DB_TEST_PASSWORD: ${{ secrets.SMP_POSTGRES_PASSWORD }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-backend

      - name: Run BDD fast suite (with verbose output)
        id: bdd-test
        continue-on-error: true
        shell: bash
        run: ./gradlew :server:smp:bddFastTest --no-daemon --info --stacktrace -x :shared:common:test -x :shared:spring-boot-common:test

      - name: Upload BDD test report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bdd-test-report
          path: server/smp/build/reports/tests/bddFastTest/

      - name: Check BDD test result
        if: steps.bdd-test.outcome == 'failure'
        run: exit 1

  # ──────────────────────────────────────────────────────────────
  # 5a. Backend Postgres integration suite
  # ──────────────────────────────────────────────────────────────
  backend-postgres:
    name: 🐘 Backend Postgres
    needs: changes
    if: needs.changes.outputs.backend == 'true'
    runs-on: ubuntu-latest
    env:
      SMP_DB_TEST_PASSWORD: ${{ secrets.SMP_POSTGRES_PASSWORD }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-backend

      - name: Run Postgres integration tests
        shell: bash
        run: ./gradlew :server:smp:postgresIntegrationTest --no-daemon -x :shared:common:test -x :shared:spring-boot-common:test

      - name: Run Postgres BDD suite
        shell: bash
        run: ./gradlew :server:smp:bddPostgresTest --no-daemon -x :shared:common:test -x :shared:spring-boot-common:test

  # ──────────────────────────────────────────────────────────────
  # 6. Marketing E2E (Playwright — all browsers)
  # ──────────────────────────────────────────────────────────────
  marketing-e2e:
    name: 🌐 Marketing E2E
    needs: changes
    if: needs.changes.outputs.frontend == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-frontend
        with:
          install-playwright: 'true'
          playwright-browsers: 'chromium firefox webkit'

      - name: Run Marketing E2E
        shell: bash
        run: cd apps/web/marketing && pnpm test:e2e

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: marketing-e2e-report
          path: apps/web/marketing/playwright-report/
          retention-days: 7

  # ──────────────────────────────────────────────────────────────
  # 7. Dashboard E2E (Playwright — isolated browser/API mocks)
  #
  # Each test owns its browser context and resets the route-backed mock state.
  # Shards run independently and require no backend services or secrets.
  # ──────────────────────────────────────────────────────────────
  dashboard-e2e-mocked:
    name: 🎭 Dashboard E2E Mocked (${{ matrix.shard }}/4)
    needs: changes
    if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true' || needs.changes.outputs.ci == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-frontend
        with:
          install-playwright: 'true'
          playwright-browsers: 'chromium'

      - name: Run scheduler E2E shard
        shell: bash
        run: |
          pnpm --filter app exec playwright test \
            -c e2e/playwright.scheduler.config.ts \
            --shard=${{ matrix.shard }}/4

      - name: Upload Scheduler E2E report
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: scheduler-e2e-report-${{ matrix.shard }}
          path: apps/web/app/e2e/playwright-scheduler-report/
          retention-days: 7

  media-e2e-mocked:
    name: 🖼️ Media E2E Mocked
    needs: changes
    if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.ci == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-frontend
        with:
          install-playwright: 'true'
          playwright-browsers: chromium
      - name: Run mocked media E2E
        run: pnpm --filter app test:e2e:media:mocked
      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: media-e2e-mocked-report
          path: apps/web/app/e2e/playwright-media-mocked-report/
          retention-days: 7

  ci-gate:
    name: ✅ CI Gate
    if: always()
    needs:
      - changes
      - lint
      - frontend-unit
      - build
      - backend-unit
      - backend-bdd
      - backend-postgres
      - marketing-e2e
      - dashboard-e2e-mocked
      - media-e2e-mocked
    runs-on: ubuntu-latest
    steps:
      - name: Require every applicable check to pass
        env:
          RESULTS: >-
            ${{ join(needs.*.result, ' ') }}
        run: |
          for result in $RESULTS; do
            if [[ "$result" != 'success' && "$result" != 'skipped' ]]; then
              echo "::error::At least one applicable CI check did not pass: $RESULTS"
              exit 1
            fi
          done
          echo "All applicable CI checks passed: $RESULTS"