ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  quality:
    name: Format, Lint, Typecheck, Test, Browser Test, Build
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - name: Cache Bun and Turbo
        uses: actions/cache@v5
        with:
          path: |
            ~/.bun/install/cache
            .turbo
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-${{ hashFiles('turbo.json') }}
          restore-keys: |
            ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-

      - name: Cache Playwright browsers
        uses: actions/cache@v5
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-playwright-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Verify Linux terminal PTY native dependency
        if: runner.os == 'Linux'
        run: node scripts/node-pty-smoke.mjs

      - name: Verify Synara identity
        run: bun run brand:check

      - name: Format
        run: bun run fmt:check

      - name: Lint
        run: bun run lint

      - name: Typecheck
        run: bun run typecheck

      - name: Test
        run: bun run test

      # Run the workspace-local playwright binary directly: bunx stalled after
      # the chromium download on hosted runners. The step timeout stops any
      # remaining apt/download stalls from eating the whole job budget.
      - name: Install browser test runtime
        timeout-minutes: 15
        env:
          DEBIAN_FRONTEND: noninteractive
        run: |
          cd apps/web
          ./node_modules/.bin/playwright install --with-deps chromium

      - name: Browser test (stable)
        timeout-minutes: 20
        run: bun run --cwd apps/web test:browser:stable

      # Pixel/font/layout comparisons are tracked explicitly in
      # apps/web/BROWSER_TEST_QUARANTINE.md while their Linux rendering is fixed.
      # All untagged browser tests run in the blocking stable step above.
      - name: Browser test (Linux geometry quarantine)
        continue-on-error: true
        timeout-minutes: 10
        run: bun run --cwd apps/web test:browser:geometry

      - name: Build desktop pipeline
        run: bun run build:desktop

      - name: Verify preload bundle output
        run: |
          test -f apps/desktop/dist-electron/preload.js
          grep -nE "desktopBridge|getWsUrl|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.js

  windows_process:
    name: Windows Process Regression
    runs-on: windows-2022
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Verify Windows terminal PTY native dependency under Bun
        run: bun scripts/node-pty-smoke.mjs

      - name: Test Windows process planning
        run: bun run --cwd packages/shared test src/windowsProcess.test.ts

      - name: Test Effect Windows process spawn
        run: bun run --cwd apps/server test src/windowsProcessEffect.test.ts

      - name: Test Windows desktop backend shutdown
        run: bun run --cwd apps/desktop test src/backendShutdown.windows.integration.test.ts

      # The 0.6.0 wedge hit Windows hardest, and the repair path is built out of
      # exactly what Windows treats differently: unlinking a marker, reclaiming
      # stranded partials, and renaming a database file that may still be held
      # open. Linux-only coverage cannot speak for any of that.
      - name: Test migration recovery marker
        run: bun run --cwd packages/shared test src/migrationRecovery.test.ts

      - name: Test desktop migration recovery
        run: bun run --cwd apps/desktop test src/desktopMigrationRecovery.test.ts

      - name: Test migration backup and restore
        run: bun run --cwd apps/server test src/persistence/MigrationBackup.test.ts

      - name: Test migration replay
        run: bun run --cwd apps/server test src/persistence/Migrations/MigrationReplay.test.ts

  # Released (id, name) migration pairs are recorded in every user's
  # effect_sql_migrations table, so renumbering or renaming one corrupts existing
  # installs. This job needs the release tags, hence the unshallow checkout; the
  # guard itself is dependency-free and skips with a warning if tags are missing.
  migration_lineage:
    name: Migration Lineage
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - name: Verify released migration lineage
        run: node scripts/check-migration-lineage.ts

  release_smoke:
    name: Release Smoke
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - name: Install dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Verify Synara identity
        run: bun run brand:check

      - name: Exercise release-only workflow steps
        run: node scripts/release-smoke.ts