ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm

      - run: npm ci

      # playwright.config.ts uses channel: 'chrome', which needs the real
      # Google Chrome binary rather than Playwright's bundled Chromium.
      - run: npx playwright install --with-deps chrome

      - run: npm run lint
      - run: npm run check

      - name: Unit tests with coverage
        run: |
          # pipefail so this step's exit code is test:coverage's, not tee's —
          # without it, a real coverage-threshold failure still exits 0
          # (tee's own status), and the step reports green regardless (#97).
          # set +e/capture/set -e around it: bash -e would otherwise abort at
          # the failing pipeline before the summary block below ever runs,
          # hiding the coverage numbers exactly when they're most needed to
          # explain the failure.
          set +e
          set -o pipefail
          npm run test:coverage 2>&1 | tee coverage-run.log
          status=$?
          set -e
          {
            echo '### Coverage'
            echo '```'
            grep -A 6 'Coverage summary' coverage-run.log || echo 'summary not found, see full log'
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"
          exit "$status"

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage-report
          path: coverage/
          retention-days: 14

      # tests/e2e/harness.ts serves real HTTP responses through
      # build/handler.js — without this, every route 404s and tier-b
      # silently fails to find any DOM element.
      - run: npm run build

      - run: npm run test:e2e