node.yml

name: Node.js CI

on:
  push:
    branches: [master]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Reconfigure git to use HTTP authentication
        run: >
          git config --global url."https://github.com/".insteadOf ssh://git@github.com/

      - name: Use Node.js from .nvmrc
        uses: actions/setup-node@v7
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Verify dependencies match this PR lockfile
        run: |
          expected=$(grep -Eo '[0-9]+' .nvmrc | head -1)
          actual=$(node -p "process.versions.node.split('.')[0]")
          echo "Node from .nvmrc: $expected"
          echo "Installed Node major: $actual"
          test "$actual" = "$expected"
          npm ci --include=optional
          ROLLUP_LINUX=$(node -p "require('./node_modules/rollup/package.json').optionalDependencies['@rollup/rollup-linux-x64-gnu']")
          npm install --no-save --no-package-lock "@rollup/rollup-linux-x64-gnu@${ROLLUP_LINUX}"
          echo "Installed packages from this PR package-lock.json:"
          npm ls --depth=0 --omit=dev || true
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git fetch --depth=1 origin "${{ github.base_ref }}"
            echo "package-lock.json changes vs ${{ github.base_ref }}:"
            git diff "origin/${{ github.base_ref }}" -- package-lock.json package.json || true
          fi

      - run: npm run build

      - name: run coverage
        env:
          HOST: localhost
          VITE_URL: https://$HOST
          VITE_SERVER_PORT: 5000
          API_HOST: https://testrant.internet.ee
          PUBLIC_API_HOST: https://www.internet.ee
          PUBLIC_API_KEY: ${{ secrets.PUBLIC_API_KEY }}
          CLIENT_ID: eis_client_test
          CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
          ISSUER_URL: https://tara-test.ria.ee
          TOKEN_PATH: /oidc/token
          JWKS_PATH: /oidc/jwks
          AUTH_PATH: /oidc/authorize
          REDIRECT_URL: /auth/callback
          SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
          HTTPS: true
        run: npm run coverage -- --coverage.reporter=lcov

      - name: Install qlty CLI
        if: always()
        run: |
          curl -LSs https://qlty.sh | bash
          echo "${HOME}/.qlty/bin" >> $GITHUB_PATH

      - name: Upload coverage to Qlty
        if: always()
        env:
          QLTY_COVERAGE_TOKEN: ${{ secrets.QLTY_COVERAGE_TOKEN }}
        run: |
          if [ -z "$QLTY_COVERAGE_TOKEN" ]; then
            echo "Missing secret QLTY_COVERAGE_TOKEN; skipping Qlty upload."
            exit 0
          fi
          if [ -f "coverage/lcov.info" ]; then
            qlty coverage publish --format=lcov coverage/lcov.info
          else
            echo "No LCOV output found (expected coverage/lcov.info); skipping."
            ls -la coverage || true
            exit 0
          fi