ci.yml

name: Verify Build & Typecheck (Zero-Strapi 2026)

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - dev
  pull_request:
    branches:
      - main
      - dev

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  NEXT_PUBLIC_SUPABASE_URL: https://example.supabase.co
  NEXT_PUBLIC_SUPABASE_ANON_KEY: ci-placeholder-anon-key
  SUPABASE_URL: https://example.supabase.co
  SUPABASE_SECRET_KEY: ci-placeholder-secret-key

jobs:
  verify:
    name: Typecheck & Build Monorepo
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.34.5

      - name: Setup Node.js environment
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Test the Vercel production build guard
        run: node --test scripts/vercel-production-guard.test.mjs

      - name: Test the task-claim check
        run: node --test scripts/task-claim-check.test.mjs

      - name: Test the E2E stale-stack pruning
        run: node --test scripts/e2e/stale-stacks.test.mjs

      - name: Test the agent release scripts
        run: node --test scripts/ops/merge-when-green.test.mjs scripts/ops/board.test.mjs scripts/ops/promote.test.mjs scripts/ops/verify-live.test.mjs scripts/ops/incident-report.test.mjs scripts/ops/warm-sitemap.test.mjs scripts/ops/rekey-dry-run.test.mjs

      - name: Replay rate migrations on PostgreSQL 17 (Docker)
        run: node scripts/test-migration-replay.mjs

      - name: Replay the DOS-Me Item migration proposal (Docker)
        run: node scripts/test-item-migration-proposal.mjs

      - name: Replay the DOS-Me M0 seed re-key proposal (Docker)
        run: node scripts/test-m0-seed-rekey-proposal.mjs

      - name: Replay the DOS-Me Item RPC and M3/M4 proposals (Docker)
        run: node scripts/test-m3-m4-item-rpcs-proposal.mjs

      - name: Check generated rate schema types match the migrations
        run: pnpm check:db-types

      - name: Build, Lint & Test @repo/shared-data (strict --max-warnings 0)
        run: |
          pnpm --filter @repo/shared-data lint
          pnpm --filter @repo/shared-data build
          pnpm --filter @repo/shared-data test

      - name: Build & Typecheck @repo/crawlers
        run: |
          pnpm --filter @repo/crawlers typecheck
          pnpm --filter @repo/crawlers build

      - name: Run @repo/crawlers Open-Core Intelligence Tests
        run: pnpm --filter @repo/crawlers test

      - name: Lint @repo/crawlers (strict --max-warnings 0)
        run: pnpm --filter @repo/crawlers lint

      - name: Verify @repo/crawlers dist entry points (consumed by DOS/Rate-Services)
        run: pnpm --filter @repo/crawlers test:dist

      - name: Build, Typecheck & Lint @repo/extension (MV3, strict --max-warnings 0)
        run: |
          pnpm --filter @repo/extension lint
          pnpm --filter @repo/extension build

      - name: Run @repo/extension E2E Pipeline Tests
        run: pnpm --filter @repo/extension test

      - name: Typecheck @repo/web
        run: pnpm --filter @repo/web typecheck

      - name: Lint @repo/web (strict --max-warnings 0)
        run: pnpm --filter @repo/web lint

      - name: Run @repo/web Core Architecture Tests
        run: pnpm --filter @repo/web test

      # Fonts come from local files (DOS/Rate#447): the build needs no network.
      - name: Build @repo/web (Next.js 16)
        run: pnpm --filter @repo/web build

  e2e:
    name: E2E (Playwright)
    timeout-minutes: 20
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.34.5

      - name: Setup Node.js environment
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Playwright Chromium
        run: pnpm exec playwright install --with-deps chromium

      # PostgreSQL 17 + PostgREST in Docker, seeded catalog, production build;
      # no Supabase secret is involved (scripts/e2e/run.mjs).
      - name: Run browser E2E against a throwaway database
        run: pnpm test:e2e

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: playwright-report
          path: |
            playwright-report/
            test-results/e2e/
          retention-days: 7

      # Light and dark screenshots of the main pages, for theme reviews
      # (apps/web/e2e/theme-screenshots.spec.ts, DOS/Rate#1435).
      - name: Upload theme screenshots
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: theme-screenshots
          path: test-results/e2e/theme-screenshots/
          if-no-files-found: ignore
          retention-days: 7

  # RATE_ITEM_MODEL=nullable_variant on the DOS-Me M0 + M1+M2 proposals (DOS/Rate#1159):
  # the Item routes, redirects and canonicals. The default E2E job above stays flag-off.
  e2e-item-model:
    name: E2E (Playwright, Item model)
    timeout-minutes: 20
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.34.5

      - name: Setup Node.js environment
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Playwright Chromium
        run: pnpm exec playwright install --with-deps chromium

      - name: Run Item-model browser E2E against a throwaway database
        run: node scripts/e2e/run.mjs --item-model

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: playwright-report-item-model
          path: |
            playwright-report-item-model/
            test-results/e2e-item-model/
          retention-days: 7