ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# The pnpm version is read from `packageManager` in package.json and the Node
# version from .node-version, so neither is repeated in this workflow.
env:
  TURBO_TELEMETRY_DISABLED: 1

jobs:
  quality:
    name: Quality gate
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version

      - name: Install pnpm and dependencies
        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
        with:
          cache: true
          require-lockfile: true

      - name: Restore Turborepo cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: .turbo/cache
          key: turbo-quality-${{ runner.os }}-${{ github.sha }}
          restore-keys: |
            turbo-quality-${{ runner.os }}-

      - name: Check formatting, lint and types
        run: pnpm check

      - name: Run unit and component tests
        run: pnpm test:unit

      - name: Audit production dependencies
        run: pnpm audit --prod --audit-level=high

  routes:
    name: Route gate
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version

      - name: Install pnpm and dependencies
        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
        with:
          cache: true
          require-lockfile: true

      - name: Restore Turborepo cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: .turbo/cache
          key: turbo-routes-${{ runner.os }}-${{ github.sha }}
          restore-keys: |
            turbo-routes-${{ runner.os }}-

      - name: Install Chromium
        run: pnpm --filter @coursemap/web exec playwright install --with-deps chromium

      - name: Check authenticated access control
        run: pnpm --filter @coursemap/web test:build:auth && pnpm --filter @coursemap/web test:auth-access

      - name: Check for whitespace errors
        run: git diff --check

      - name: Upload route-test report and traces
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: playwright-route-report
          path: |
            apps/web/playwright-report
            apps/web/test-results
          retention-days: 7

  database:
    name: Database gate
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version

      - name: Install pnpm and dependencies
        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
        with:
          cache: true
          require-lockfile: true

      - name: Set up Supabase CLI
        uses: supabase/setup-cli@46f7f98c7f948ad727d22c1e67fab04c223a0520 # v3.0.0
        with:
          version: 2.114.0

      - name: Start local database
        run: pnpm db:start

      - name: Reset and seed local preview database
        run: pnpm db:reset

      - name: Run database tests
        run: pnpm db:test

      - name: Lint database schemas
        run: pnpm db:lint

      - name: Verify generated database types
        run: |
          cp apps/web/types/database.ts /tmp/database.committed.ts
          pnpm db:types
          diff --ignore-blank-lines --unified /tmp/database.committed.ts apps/web/types/database.ts

      - name: Test catalogue database import
        run: pnpm test:catalogue-db

  browser:
    name: Browser gate
    runs-on: ubuntu-latest
    timeout-minutes: 25

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version

      - name: Install pnpm and dependencies
        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
        with:
          cache: true
          require-lockfile: true

      - name: Restore Turborepo cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: .turbo/cache
          key: turbo-browser-${{ runner.os }}-${{ github.sha }}
          restore-keys: |
            turbo-browser-${{ runner.os }}-

      - name: Install Chromium
        run: pnpm --filter @coursemap/web exec playwright install --with-deps chromium

      - name: Set up Supabase CLI
        uses: supabase/setup-cli@46f7f98c7f948ad727d22c1e67fab04c223a0520 # v3.0.0
        with:
          version: 2.114.0

      - name: Start local services
        run: pnpm db:start

      - name: Seed local catalogue
        run: pnpm db:reset

      - name: Run authenticated browser journeys
        run: pnpm test:e2e

      - name: Upload Playwright report and failure traces
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: playwright-browser-report
          path: |
            apps/web/playwright-report
            apps/web/test-results
          retention-days: 7

  production-database:
    name: Apply production migrations
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs:
      - quality
      - routes
      - database
      - browser
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: Production
    env:
      SUPABASE_POOLER_URL: postgresql://postgres.mogdmhkqkpvksvtvwdgl@aws-0-ap-southeast-2.pooler.supabase.com:5432/postgres

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version

      - name: Set up Supabase CLI
        uses: supabase/setup-cli@46f7f98c7f948ad727d22c1e67fab04c223a0520 # v3.0.0
        with:
          version: 2.114.0

      - name: Prepare production database connection
        env:
          SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }}
        run: >-
          node -e 'const fs = require("node:fs"); const url = new
          URL(process.env.SUPABASE_POOLER_URL); url.password =
          process.env.SUPABASE_DB_PASSWORD;
          fs.appendFileSync(process.env.GITHUB_ENV,
          `SUPABASE_DB_URL=${url.href}\n`);'

      - name: Preview production migrations
        run: supabase db push --db-url "$SUPABASE_DB_URL" --dry-run

      - name: Apply production migrations
        run: supabase db push --db-url "$SUPABASE_DB_URL" --yes