ci.yaml

# =============================================================================
# CI - ModularIoT Monorepo
# =============================================================================
# This workflow validates Turbo repo changes on pull requests, trunk/main pushes,
# and manual dispatches. Release tagging, image publishing, and deployment are
# handled by app-release-train.yml.
# =============================================================================

name: CI

run-name: ${{ github.actor }} is validating ${{ github.repository }}

on:
  push:
    paths:
      - 'turbo-repo/**'
    branches:
      - trunk
      - main
  pull_request:
    paths:
      - 'turbo-repo/**'
    branches:
      - trunk
      - main
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  NODE_VERSION: "24"
  NEXT_PUBLIC_INGEST_URL: ${{ vars.NEXT_PUBLIC_INGEST_URL }}
  NEXT_PUBLIC_MAPBOX_API_KEY: ${{ secrets.NEXT_PUBLIC_MAPBOX_API_KEY }}
  NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: ${{ secrets.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY }}
  NEXT_PUBLIC_AUTENTIA_PATH: ${{ secrets.NEXT_PUBLIC_AUTENTIA_PATH }}

jobs:
  # ===========================================================================
  # Changed paths - Detect whether app build inputs changed
  # ===========================================================================
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      apps: ${{ steps.filter.outputs.apps }}
    steps:
      - uses: actions/checkout@v5

      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            apps:
              - 'turbo-repo/apps/**'
              - 'turbo-repo/packages/ui/**'
              - 'turbo-repo/packages/db/**'
              - 'turbo-repo/packages/typescript-config/**'
              - 'turbo-repo/packages/eslint-config/**'
              - 'turbo-repo/package-lock.json'
              - 'turbo-repo/docker/**'

  # ===========================================================================
  # Install - Shared dependency installation with node_modules cache
  # ===========================================================================
  install:
    name: Install Dependencies
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: "npm"
          cache-dependency-path: turbo-repo/package-lock.json

      - name: Cache node_modules
        id: cache-modules
        uses: actions/cache@v4
        with:
          path: |
            turbo-repo/node_modules
            turbo-repo/packages/*/node_modules
            turbo-repo/apps/*/node_modules
          key: node-modules-${{ hashFiles('turbo-repo/package-lock.json') }}

      - name: Install dependencies
        if: steps.cache-modules.outputs.cache-hit != 'true'
        run: npm ci
        working-directory: turbo-repo

  # ===========================================================================
  # Lint and Type Check - Fast feedback on code quality
  # ===========================================================================
  lint:
    name: Lint and Type Check
    runs-on: ubuntu-latest
    needs: install
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 2

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Restore node_modules cache
        uses: actions/cache/restore@v4
        with:
          path: |
            turbo-repo/node_modules
            turbo-repo/packages/*/node_modules
            turbo-repo/apps/*/node_modules
          key: node-modules-${{ hashFiles('turbo-repo/package-lock.json') }}

      - name: Run linting
        run: npx turbo run lint --filter='!@modulariot/web-admin'
        working-directory: turbo-repo

      - name: Run type checking
        run: npx turbo run check-types --filter='!@modulariot/web-admin'
        working-directory: turbo-repo

      - name: Check i18n locale integrity (en/es parity + no duplicate keys)
        run: npx vitest run src/test/i18n/locale-parity.test.ts
        working-directory: turbo-repo/apps/app

  # ===========================================================================
  # Build - Validate the Next.js apps that participate in release/deploy flows
  # ===========================================================================
  build:
    name: Build Apps
    runs-on: ubuntu-latest
    needs: [install, changes]
    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.apps == 'true'
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Restore node_modules cache
        uses: actions/cache/restore@v4
        with:
          path: |
            turbo-repo/node_modules
            turbo-repo/packages/*/node_modules
            turbo-repo/apps/*/node_modules
          key: node-modules-${{ hashFiles('turbo-repo/package-lock.json') }}

      - name: Build apps with Turbo
        run: npx turbo run build --filter=@modulariot/docs --filter=@modulariot/app --filter=@modulariot/web
        working-directory: turbo-repo

  # ===========================================================================
  # Summary Job - Aggregate results
  # ===========================================================================
  summary:
    name: CI Summary
    runs-on: ubuntu-latest
    needs: [install, lint, build, changes]
    if: always()
    permissions: {}
    steps:
      - name: Create summary
        run: |
          echo "# CI Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Component | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-----------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Install | ${{ needs.install.result == 'success' && 'Passed' || 'Failed' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Lint & Types | ${{ needs.lint.result == 'success' && 'Passed' || 'Failed' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Build Apps | ${{ needs.build.result == 'success' && 'Built' || needs.build.result == 'skipped' && 'Skipped' || 'Failed' }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- Commit: \`${GITHUB_SHA::7}\`" >> $GITHUB_STEP_SUMMARY
          echo "- Release publishing: handled by \`app-release-train.yml\`" >> $GITHUB_STEP_SUMMARY