ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  validate:
    name: Run Quality Checks & End-to-End Tests
    runs-on: ubuntu-latest

    env:
      NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL || 'http://127.0.0.1:54321' }}
      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY || 'mock-anon-key' }}
      DATABASE_URL: ${{ secrets.DATABASE_URL || 'postgresql://postgres:postgres@localhost:5432/postgres' }}
      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY || 'mock-gemini-key' }}
      SUPADATA_API_KEY: ${{ secrets.SUPADATA_API_KEY || 'mock-supadata-key' }}
      INNGEST_EVENT_KEY: ${{ secrets.INNGEST_EVENT_KEY || 'mock-event-key' }}
      INNGEST_SIGNING_KEY: ${{ secrets.INNGEST_SIGNING_KEY || 'mock-signing-key' }}
      E2E_USER_EMAIL: ${{ secrets.E2E_USER_EMAIL }}
      E2E_USER_PASSWORD: ${{ secrets.E2E_USER_PASSWORD }}

    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgrespassword
          POSTGRES_DB: codenotes_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      # Vitest 5 has a peer requirement for newer @types/node while this project intentionally uses @types/node 20, so --legacy-peer-deps is required.
      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      - name: Run automated unit and integration tests (Vitest)
        run: npm test

      - name: Run PostgreSQL RLS integration tests
        env:
          TEST_DATABASE_URL: postgresql://postgres:postgrespassword@localhost:5432/codenotes_test
        run: npm run test:integration:rls

      - name: Validate Prometheus configuration and alert rules
        run: |
          docker run --rm --entrypoint promtool -v "${{ github.workspace }}/prometheus:/etc/prometheus" prom/prometheus:v2.54.1 check config /etc/prometheus/prometheus.yml
          docker run --rm --entrypoint promtool -v "${{ github.workspace }}/prometheus:/etc/prometheus" prom/prometheus:v2.54.1 check rules /etc/prometheus/rules/alerts.yml

      - name: Validate Docker Compose monitoring configuration
        run: docker compose -f docker-compose.prometheus.yml config --quiet

      - name: Run linter (ESLint)
        run: npm run lint

      - name: Run TypeScript typecheck
        run: npx tsc --noEmit

      - name: Build Next.js application
        run: npm run build

      - name: Cache Playwright Chromium browser
        uses: actions/cache@v4
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

      - name: Install Playwright Chromium with OS dependencies
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: npx playwright install --with-deps chromium

      - name: Install Playwright system dependencies if cache hit
        if: steps.playwright-cache.outputs.cache-hit == 'true'
        run: npx playwright install-deps chromium

      - name: Run deterministic Playwright E2E tests
        run: npm run test:e2e

      - name: Upload Playwright test failure artifacts
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: |
            playwright-report/
            test-results/
          retention-days: 14