ci.yml

name: CI

# This repository auto-deploys to production on every push to main, with no
# gate in between. These checks do not block that -- Coolify reacts to the
# push directly -- but they turn "the deploy went out broken" into a red mark
# within a couple of minutes instead of a report from a user.
on:
  push:
    branches: [main]
  pull_request:

jobs:
  go:
    name: Go
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Build
        run: go build ./...

      # Formatting drifts silently otherwise: twenty-three files had drifted
      # before this check existed, which buries real changes in whitespace
      # noise whenever someone's editor finally reformats one.
      - name: Gofmt
        run: |
          unformatted=$(gofmt -l .)
          if [ -n "$unformatted" ]; then
            echo "These files need gofmt:"
            echo "$unformatted"
            exit 1
          fi

      # vet is the point of this job. It reports real defects here -- a Printf
      # whose format string did not match its arguments mangled every request
      # log line for months, because ./... could not compile and nobody ran it.
      - name: Vet
        run: go vet ./...

      # Nothing was checking this, and it had rotted badly: echo carried an
      # encoded-slash bug exposing static files, golang-jwt v3 an unfixable
      # memory-exhaustion bug, x/net the HTTP/2 CONTINUATION flood. All three
      # were reachable from this code, and all three sat there for months
      # because a version number does not announce itself.
      - name: Vulnerabilities
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          "$(go env GOPATH)/bin/govulncheck" ./...

      # Tests that need Postgres skip themselves when nothing is listening, so
      # this stays fast without a service container. The integration probes
      # additionally require PROBE_DSN and are skipped here by design.
      - name: Test
        run: go test ./... -timeout 5m

  frontend:
    name: Frontend
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2

      # --frozen-lockfile matches the Dockerfile, so a lockfile that would
      # break the image build breaks here first.
      - name: Install
        run: bun install --frozen-lockfile

      - name: Typecheck
        run: bunx tsc -b

      - name: Lint
        run: bunx eslint .

      - name: Build
        run: bunx vite build

  spec:
    name: OpenAPI
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      # api-docs.yaml is a compiled contract, not documentation: gameplan
      # generates its client from it with openapi-typescript, so a malformed
      # spec breaks a different repository's build. Duplicate keys parse fine
      # in most YAML loaders and are caught here.
      - name: Lint OpenAPI description
        run: npx --yes @redocly/cli@1.25.11 lint api-docs.yaml