ci.yml

name: CI

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

# graphle is a public repository, so it runs on GitHub-hosted ubuntu-latest
# runners (free, unlimited Actions minutes for public repos) and deploys to
# GitHub Pages. No self-hosted fleet or runner-selection step is needed.

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-and-run
        with:
          task: lint
          command: pnpm lint

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-and-run
        with:
          task: typecheck
          command: pnpm typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-and-run
        with:
          task: test
          command: pnpm test:coverage
      - name: Post coverage summary
        if: always()
        run: |
          if [ -f coverage/coverage-summary.json ]; then
            node -e "
              const cov = require('./coverage/coverage-summary.json');
              const t = cov.total;
              const pct = (k) => t[k].pct.toFixed(1) + '%';
              const row = (label, k) => '| ' + label + ' | ' + pct(k) + ' |';
              console.log('## Coverage');
              console.log('');
              console.log('| Metric | Coverage |');
              console.log('|--------|----------|');
              console.log(row('Lines', 'lines'));
              console.log(row('Statements', 'statements'));
              console.log(row('Functions', 'functions'));
              console.log(row('Branches', 'branches'));
            " >> "$GITHUB_STEP_SUMMARY"
          fi
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage-report
          path: coverage/

  integration-e2e:
    name: Integration & E2E
    # Independent of lint/typecheck/test and NOT in release/build-and-deploy's
    # needs: below — real-network, third-party-API-dependent tests are more
    # flake-prone than the mocked unit suite, and gating deploys on a
    # transient GitHub API hiccup would trade deploy reliability for coverage
    # already exercised, deterministically, by the mocked *.unit.test.ts
    # suite. Still runs and reports on every push, just doesn't block release.
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # All four secrets are optional and independent — the tests run once per
    # secret that's actually configured, and skip cleanly for the others.
    # Named GH_ rather than GITHUB_: Actions rejects any secret name starting
    # with GITHUB_ (reserved for its own built-ins). The _PRIVATE pair are
    # separate, more-privileged tokens dedicated to reading two otherwise-
    # unused fixture repos (Mearman/graphle-test-private,
    # ExaDev/graphle-test-private) — kept apart from the public-only pair so
    # those stay minimally scoped.
    env:
      GH_TEST_PAT_CLASSIC: ${{ secrets.GH_TEST_PAT_CLASSIC }}
      GH_TEST_PAT_FINE_GRAINED: ${{ secrets.GH_TEST_PAT_FINE_GRAINED }}
      GH_TEST_PAT_CLASSIC_PRIVATE: ${{ secrets.GH_TEST_PAT_CLASSIC_PRIVATE }}
      GH_TEST_PAT_FINE_GRAINED_PRIVATE: ${{ secrets.GH_TEST_PAT_FINE_GRAINED_PRIVATE }}
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-and-run
        with:
          task: integration-e2e
          command: >-
            pnpm test:integration &&
            pnpm exec playwright install --with-deps chromium &&
            pnpm test:e2e

  release:
    name: Release
    needs: [lint, typecheck, test]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
      issues: write
    steps:
      - uses: actions/checkout@v6
        with:
          # semantic-release analyses the full commit history since the last release.
          fetch-depth: 0
      - uses: ./.github/actions/setup-and-run
        with:
          task: release
          # HUSKY=0 so local git hooks never fire during the CI release commit.
          command: HUSKY=0 pnpm release
          github-token: ${{ secrets.GITHUB_TOKEN }}

  build-and-deploy:
    name: Build and deploy to Pages
    # Build AFTER release so the deploy is built from the tagged release commit
    # (semantic-release bumps package.json + tags on the chore(release) commit),
    # which makes the header show the version instead of the un-tagged feat
    # commit's hash. For non-releasing commits release creates no new tag and the
    # header falls back to the hash, which is correct.
    needs: [lint, typecheck, test, release]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    # Never overlap two Pages deploys; queue the next behind an in-progress one.
    concurrency:
      group: deploy-pages
      cancel-in-progress: false
    # `actions: write` (beyond contents/pages/id-token) lets the artifact-cleanup
    # step below delete a `github-pages` artifact left by a prior failed attempt,
    # so re-running this job never collides with a stale upload.
    permissions:
      contents: read
      pages: write
      id-token: write
      actions: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/checkout@v6
        with:
          # Check out the latest main (the release commit semantic-release just
          # pushed), not the trigger commit, so the build resolves the new tag.
          ref: main
          # Full history + tags so the build can resolve the release tag.
          fetch-depth: 0
      - uses: ./.github/actions/setup-and-run
        with:
          task: build
          command: pnpm build
      # enablement: true re-enables Pages if it was disabled (e.g. by a
      # repository visibility change), so a redeploy never fails on a missing
      # Pages site.
      - uses: actions/configure-pages@v6
        with:
          enablement: true
      # A failed `deploy-pages` step (GitHub Pages' "Deployment failed, try
      # again later" transient) leaves this run's uploaded `github-pages`
      # artifact behind. Re-running the job then uploads a second one and
      # `deploy-pages` refuses both ("Multiple artifacts named github-pages ...
      # count is 2"). Drop any prior attempt's artifact before uploading so
      # reruns are clean. No-op on the first attempt (nothing to delete).
      - name: Remove prior github-pages artifacts from this run
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
            --jq '.artifacts[] | select(.name=="github-pages") | .id' |
          while read -r id; do
            [ -z "$id" ] && continue
            echo "Removing stale github-pages artifact $id from a prior attempt"
            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id"
          done
      - uses: actions/upload-pages-artifact@v5
        with:
          path: dist
      - id: deployment
        uses: actions/deploy-pages@v5