test.yml

# CI for typescript-sdk (ARCP)
#
# Action pinning policy:
#   - First-party actions (actions/*) use major version tags (e.g. @v4).
#   - Third-party actions are pinned to a full commit SHA with a version comment.
#
# package.json engines.node: ">=22"
# Matrix covers floor (22), active LTS (22), and latest (24).

name: test

on:
  push:
    branches: [main]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "LICENSE"
      - ".gitignore"
      - ".editorconfig"
  pull_request:
    branches: [main]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "LICENSE"
      - ".gitignore"
      - ".editorconfig"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  test:
    name: test (node ${{ matrix.node }})
    runs-on: [self-hosted, linux, arm64, arcp]
    strategy:
      fail-fast: false
      matrix:
        node: ["22", "24"]
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Setup Node.js ${{ matrix.node }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node }}

      # pnpm/action-setup's installer fails on the containerized self-hosted
      # runner (no system node at install time; standalone mode also broken).
      # corepack ships with node 22/24 and handles arm64 fine. The pnpm store
      # persists across jobs on a shared named volume at the default store
      # path, so no GitHub cache step is needed.
      - name: Setup pnpm (via corepack)
        run: |
          corepack enable
          corepack prepare pnpm@9.15.0 --activate
          pnpm --version

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint (biome)
        run: pnpm run lint:biome

      # The strict ESLint complexity rules from TYPESCRIPT_SDK_GUIDE.md
      # Section 11 are enforced but currently surface ~79 violations across
      # 12 files. Sub-phase 2.5 of the refactor (.refactor/STATE.md) is
      # closing them. Marked continue-on-error until that sub-phase wraps.
      - name: Lint (eslint, advisory during refactor)
        run: pnpm run lint:eslint
        continue-on-error: true

      - name: Typecheck
        run: pnpm run typecheck

      - name: Build
        run: pnpm run build

      - name: Test (with coverage)
        run: pnpm run test:coverage

      # Upload coverage from the LTS matrix entry only — the report is the
      # same on every Node version, so one upload is enough. Non-blocking:
      # a Codecov outage must not break CI.
      - name: Upload coverage to Codecov
        if: matrix.node == '22'
        # codecov/codecov-action v6.0.1
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          fail_ci_if_error: false
          flags: unittests
          token: ${{ secrets.CODECOV_TOKEN }}

      # check:cycles runs madge against the compiled .js so it reports only
      # real runtime cycles. Type-only imports (erased by
      # verbatimModuleSyntax) can form source-level cycles that don't exist
      # at runtime; those are not bugs.
      - name: Cycle check
        run: pnpm run check:cycles

      - name: Are the types wrong?
        run: pnpm run check:attw

      - name: publint
        run: pnpm run check:publint

      - name: Upload test artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: test-artifacts-node-${{ matrix.node }}
          path: |
            packages/*/coverage/
            packages/middleware/*/coverage/
            test-results/
            *.log
          if-no-files-found: ignore
          retention-days: 7