ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scripts:
    name: Scripts
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Detect private guidance source contract
        shell: bash
        run: |
          private_guidance_paths=(
            AGENTS.md
            scripts/check-agent-guidance.py
            scripts/agent-preflight.py
          )
          present_count=0
          for path in "${private_guidance_paths[@]}"; do
            if [[ -f "$path" ]]; then
              present_count=$((present_count + 1))
            fi
          done
          if [[ "$present_count" -eq "${#private_guidance_paths[@]}" ]]; then
            echo "READMATES_PRIVATE_AGENT_GUIDANCE=true" >> "$GITHUB_ENV"
          elif [[ "$present_count" -eq 0 ]]; then
            echo "READMATES_PRIVATE_AGENT_GUIDANCE=false" >> "$GITHUB_ENV"
            echo "Private guidance tooling is intentionally absent; skipping its CI-only checks."
          else
            echo "Private guidance source contract is incomplete; refusing to weaken CI checks." >&2
            exit 1
          fi

      - name: Agent tooling self-tests
        if: env.READMATES_PRIVATE_AGENT_GUIDANCE == 'true'
        run: |
          python3 -B scripts/check-agent-guidance.py --self-test
          python3 -B scripts/agent-preflight.py --self-test

      - name: Agent guidance contract
        if: env.READMATES_PRIVATE_AGENT_GUIDANCE == 'true'
        run: python3 -B scripts/check-agent-guidance.py

      - name: Deploy workflow contract self-tests
        run: python3 -B scripts/check-deploy-workflow-contract.py --self-test

      - name: Deploy workflow contract
        run: python3 -B scripts/check-deploy-workflow-contract.py

      - name: Flyway migration checker self-tests
        run: python3 -B scripts/check-flyway-migration-immutability.py --self-test

      - name: Flyway migration workflow contract
        run: python3 -B scripts/check-flyway-migration-immutability.py --check-workflow .github/workflows/ci.yml

      - name: Flyway migration history immutability
        env:
          READMATES_FLYWAY_EVENT_NAME: ${{ github.event_name }}
          READMATES_FLYWAY_PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          READMATES_FLYWAY_PUSH_BEFORE_SHA: ${{ github.event.before }}
        shell: bash
        run: |
          base_sha=""
          case "${READMATES_FLYWAY_EVENT_NAME}" in
            pull_request)
              base_sha="${READMATES_FLYWAY_PR_BASE_SHA}"
              ;;
            push)
              base_sha="${READMATES_FLYWAY_PUSH_BEFORE_SHA}"
              if [[ "$base_sha" =~ ^0+$ ]]; then
                if ! base_sha="$(git rev-parse --verify --quiet 'HEAD^^{commit}')"; then
                  echo "Flyway comparison base is unavailable." >&2
                  exit 1
                fi
              fi
              ;;
            *)
              echo "Unsupported Flyway comparison event." >&2
              exit 1
              ;;
          esac
          if [[ -z "$base_sha" ]]; then
            echo "Flyway comparison base is empty." >&2
            exit 1
          fi
          if ! base_sha="$(git rev-parse --verify --quiet "${base_sha}^{commit}")"; then
            echo "Flyway comparison base cannot be resolved locally." >&2
            exit 1
          fi
          python3 -B scripts/check-flyway-migration-immutability.py --base-ref "$base_sha"

      - name: Install script tools
        if: ${{ always() }}
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends ripgrep shellcheck

      - name: Collect tracked shell scripts
        if: ${{ always() }}
        shell: bash
        run: |
          shell_script_list="$RUNNER_TEMP/readmates-tracked-shell-scripts.zlist"
          git ls-files -z -- \
            ':(glob)scripts/**/*.sh' \
            ':(glob)deploy/oci/**/*.sh' \
            > "$shell_script_list"
          if [[ ! -s "$shell_script_list" ]]; then
            echo "No tracked shell scripts found under scripts or deploy/oci." >&2
            exit 1
          fi
          printf 'READMATES_TRACKED_SHELL_SCRIPTS=%s\n' "$shell_script_list" >> "$GITHUB_ENV"

      - name: Bash syntax
        if: ${{ always() }}
        run: |
          shell_script_list="${READMATES_TRACKED_SHELL_SCRIPTS:?tracked shell-script list is unavailable}"
          while IFS= read -r -d '' shell_script; do
            bash -n "$shell_script"
          done < "$shell_script_list"

      - name: ShellCheck
        if: ${{ always() }}
        run: |
          shell_script_list="${READMATES_TRACKED_SHELL_SCRIPTS:?tracked shell-script list is unavailable}"
          mapfile -d '' -t shell_scripts < "$shell_script_list"
          shellcheck "${shell_scripts[@]}"

      - name: aigen PII regression check
        if: ${{ always() }}
        run: bash scripts/aigen-pii-check.sh

      - name: Validate Prometheus rules
        if: ${{ always() }}
        run: ./scripts/validate-prometheus-rules.sh

      - name: Validate Prometheus configs
        if: ${{ always() }}
        run: ./scripts/validate-prometheus-config.sh

      - name: Validate Tempo config
        if: ${{ always() }}
        run: bash scripts/validate-tempo-config.sh

      - name: Validate production AI config
        if: ${{ always() }}
        run: bash scripts/validate-production-ai-config.sh

      - name: Verify production AI config fixtures
        if: ${{ always() }}
        run: bash scripts/verify-production-ai-config-fixtures.sh

      - name: Lint Grafana dashboards
        if: ${{ always() }}
        run: ./scripts/lint-grafana-dashboards.sh

  public-release:
    name: Public release safety
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Build candidate and verify public release fixtures
        run: ./scripts/verify-public-release-fixtures.sh

      - name: Run public release check
        run: ./scripts/public-release-check.sh .tmp/public-release-candidate

  frontend:
    name: Frontend
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: front
    steps:
      - name: Configure Git defaults
        working-directory: .
        run: git config --global init.defaultBranch main

      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Set up pnpm from packageManager
        working-directory: .
        run: |
          if command -v corepack >/dev/null 2>&1; then
            corepack_cmd=(corepack)
          else
            corepack_cmd=(npx --yes corepack@0.35.0)
          fi
          "${corepack_cmd[@]}" enable
          "${corepack_cmd[@]}" prepare "$(node -p "require('./package.json').packageManager")" --activate
          "${corepack_cmd[@]}" pnpm --version

      - name: Restore pnpm cache
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        working-directory: .
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Front unit tests with coverage
        run: pnpm test:coverage

      - name: Upload coverage artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: front-coverage
          path: front/coverage/
          retention-days: 14

      - name: Build
        run: pnpm build

      - name: Check zod fixtures are up to date
        run: |
          pnpm zod:export-fixtures
          git diff --exit-code tests/unit/__fixtures__/zod-schemas/

      - name: Upload frontend reports
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-reports
          path: |
            front/test-results
            front/playwright-report
            front/coverage
          if-no-files-found: ignore

  frontend-visual-regression:
    name: Frontend visual regression
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: front
    steps:
      - name: Configure Git defaults
        working-directory: .
        run: git config --global init.defaultBranch main

      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Set up pnpm from packageManager
        working-directory: .
        run: |
          if command -v corepack >/dev/null 2>&1; then
            corepack_cmd=(corepack)
          else
            corepack_cmd=(npx --yes corepack@0.35.0)
          fi
          "${corepack_cmd[@]}" enable
          "${corepack_cmd[@]}" prepare "$(node -p "require('./package.json').packageManager")" --activate
          "${corepack_cmd[@]}" pnpm --version

      - name: Restore pnpm cache
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        working-directory: .
        run: pnpm install --frozen-lockfile

      - name: Run component visual regression tests
        run: pnpm test:ct:docker

      - name: Upload visual regression reports
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-visual-regression-reports
          path: |
            front/test-results
            front/playwright-report
          if-no-files-found: ignore

  design-system:
    name: Design system
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Set up pnpm from packageManager
        run: |
          if command -v corepack >/dev/null 2>&1; then
            corepack_cmd=(corepack)
          else
            corepack_cmd=(npx --yes corepack@0.35.0)
          fi
          "${corepack_cmd[@]}" enable
          "${corepack_cmd[@]}" prepare "$(node -p "require('./package.json').packageManager")" --activate
          "${corepack_cmd[@]}" pnpm --version

      - name: Restore pnpm cache
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build and test design system
        run: pnpm design:check

  backend:
    name: Backend
    runs-on: ubuntu-latest
    env:
      # ubuntu-latest is 4 vCPU; matches the build.gradle.kts default of
      # availableProcessors()/2. Set explicitly so the value is auditable
      # and survives any future runner-spec change.
      # Refs: docs/superpowers/specs/2026-05-16-readmates-build-test-speed-spec.md §4.3
      READMATES_TEST_FORKS: "2"
    steps:
      - name: Configure Git defaults
        run: git config --global init.defaultBranch main

      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: 25

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

      - name: Server quality gates (ktlint + detekt + tests + JaCoCo + architecture)
        run: ./scripts/server-ci-check.sh

      - name: Upload server reports
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: server-reports
          path: |
            server/build/reports/detekt/
            server/build/reports/jacoco/
            server/build/reports/ktlint/
          retention-days: 14

      - name: Upload backend reports
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: backend-reports
          path: |
            server/build/reports/tests
            server/build/test-results
          if-no-files-found: ignore

  backend-integration:
    name: Backend Integration
    runs-on: ubuntu-latest
    # Spec §7.3 followup option 2: move Testcontainers-backed integration
    # tests out of the `backend` critical path. This job runs in parallel
    # with `backend` (and `e2e`), so PR wall-clock is max(backend,
    # backend-integration, e2e) ≈ unchanged, but the metric job (C1
    # backend) drops to unit + arch + detekt + jacoco only.
    # Both jobs are required for PR green status — integration coverage
    # is preserved (spec §A6).
    steps:
      - name: Configure Git defaults
        run: git config --global init.defaultBranch main

      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: 25

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

      - name: Integration tests (Testcontainers; Docker required)
        working-directory: server
        run: ./gradlew integrationTest

      - name: Upload integration test results
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: backend-integration-reports
          path: |
            server/build/reports/tests
            server/build/test-results
          if-no-files-found: ignore

  e2e:
    name: E2E (${{ matrix.shard }})
    runs-on: ubuntu-latest
    env:
      READMATES_CI_MYSQL_ROOT_PASSWORD: ${{ secrets.READMATES_CI_MYSQL_ROOT_PASSWORD }}
      READMATES_CI_MYSQL_USER: ${{ secrets.READMATES_CI_MYSQL_USER }}
      READMATES_CI_MYSQL_PASSWORD: ${{ secrets.READMATES_CI_MYSQL_PASSWORD }}
    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_ROOT_PASSWORD: ${{ secrets.READMATES_CI_MYSQL_ROOT_PASSWORD }}
          MYSQL_ROOT_HOST: "%"
          MYSQL_USER: ${{ secrets.READMATES_CI_MYSQL_USER }}
          MYSQL_PASSWORD: ${{ secrets.READMATES_CI_MYSQL_PASSWORD }}
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -p$MYSQL_ROOT_PASSWORD --silent"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=12
    strategy:
      matrix:
        include:
          - shard: "1/3"
            artifact_shard: "1-of-3"
          - shard: "2/3"
            artifact_shard: "2-of-3"
          - shard: "3/3"
            artifact_shard: "3-of-3"
    steps:
      - name: Configure Git defaults
        run: git config --global init.defaultBranch main

      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Set up pnpm from packageManager
        run: |
          if command -v corepack >/dev/null 2>&1; then
            corepack_cmd=(corepack)
          else
            corepack_cmd=(npx --yes corepack@0.35.0)
          fi
          "${corepack_cmd[@]}" enable
          "${corepack_cmd[@]}" prepare "$(node -p "require('./package.json').packageManager")" --activate
          "${corepack_cmd[@]}" pnpm --version

      - name: Restore pnpm cache
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: 25

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Playwright browsers
        run: pnpm --dir front exec playwright install --with-deps chromium

      - name: Grant E2E database privileges
        env:
          MYSQL_PWD: ${{ env.READMATES_CI_MYSQL_ROOT_PASSWORD }}
        run: |
          mysql --protocol=TCP -h 127.0.0.1 -P 3306 -u root --execute \
            "grant all privileges on \`readmates_e2e_%\`.* to '${READMATES_CI_MYSQL_USER}'@'%';"

      - name: Run E2E tests (shard ${{ matrix.shard }})
        env:
          READMATES_E2E_DB_USER: ${{ env.READMATES_CI_MYSQL_USER }}
          READMATES_E2E_DB_PASSWORD: ${{ env.READMATES_CI_MYSQL_PASSWORD }}
        run: pnpm --dir front exec playwright test --shard=${{ matrix.shard }}

      - name: Upload E2E reports
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-${{ matrix.artifact_shard }}-reports
          path: |
            front/test-results
            front/playwright-report
          if-no-files-found: ignore