ci.yml

name: CI Workflow

permissions:
  contents: read

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

# A new push to the same branch/PR supersedes the running check. Cancel the
# old run instead of queueing behind it.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  discover-packages:
    name: Discover workspace packages
    runs-on: ubuntu-latest
    outputs:
      packages: ${{ steps.packages.outputs.value }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 20
      - run: npm run check:labs && npm run check:content && npm run test:labs
      - id: packages
        run: echo "value=$(node scripts/list-ci-packages.mjs)" >> "$GITHUB_OUTPUT"

  package-checks:
    name: ${{ matrix.package }} checks
    needs: discover-packages
    runs-on: ubuntu-latest
    # Every job here finishes in under a minute when healthy. A tight timeout
    # turns a hang (see LEARNINGS.md, 2026-07-12 node --test entry) into a
    # fast red X instead of a 6-hour stuck run.
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJSON(needs.discover-packages.outputs.packages) }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm
          # The gateway is zero-dependency and has no lockfile; point the
          # cache at every lockfile that exists instead of the matrix path.
          cache-dependency-path: '**/package-lock.json'

      - name: Install Dependencies
        working-directory: ${{ matrix.package }}
        env:
          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
        run: |
          if [ -f "package-lock.json" ]; then
            npm ci --no-audit --no-fund
          else
            npm install --no-audit --no-fund
          fi

      - name: Run Linter
        working-directory: ${{ matrix.package }}
        run: npm run lint --if-present

      - name: Run Tests
        working-directory: ${{ matrix.package }}
        run: npm test --if-present

  docker-build:
    name: Docker Build Verification
    # Pull requests verify the exact deployable container. A push to main is
    # immediately built and smoke-tested by deploy.yml, so repeating this
    # expensive build on the same commit only adds runner time and queueing.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # This is the single full application build in PR CI. Package jobs keep
      # lint and unit-test isolation; the container build proves compilation,
      # packaging, and the gateway boundary once.
      - name: Build Docker Image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          load: true
          tags: fieldwork
          build-args: |
            VITE_STRAVA_CLIENT_ID=smoke-test-placeholder-client-id
            ALLOW_MISSING_ARTIFACTS=1
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Smoke test the built container
        run: |
          set -euo pipefail
          docker run --rm -d -p 8080:8080 --name fieldwork-smoke fieldwork
          trap 'docker rm -f fieldwork-smoke >/dev/null 2>&1 || true' EXIT
          for attempt in $(seq 1 30); do
            if curl --fail --silent http://127.0.0.1:8080/healthz >/dev/null; then
              break
            fi
            if [ "$attempt" -eq 30 ]; then
              docker logs fieldwork-smoke
              exit 1
            fi
            sleep 1
          done
          BASE_URL=http://127.0.0.1:8080 node scripts/smoke.mjs

  build-and-smoke:
    # Branch protection requires this historical check name. Keep it as a
    # lightweight compatibility gate over the production-shaped Docker job;
    # do not rebuild every app a second time here.
    name: Build all apps + gateway smoke test
    if: github.event_name == 'pull_request'
    needs: docker-build
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - run: echo "Docker build and gateway smoke test passed."

  secret-scan:
    name: Secret Scanner
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Secret Scanner (Gitleaks)
        run: |
          docker run --rm -v "${{ github.workspace }}:/repo" ghcr.io/gitleaks/gitleaks:latest detect --source=/repo --verbose --redact