devtrack/.github/workflows/ci.yml at main · Priyanshu-byte-coder/devtrack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]

# Cancel outdated runs on the same PR/branch to save CI minutes
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ── 1. Type check ──────────────────────────────────────────────────────────
  typecheck:
    name: Type check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run tsc
        run: npm run type-check

  # ── 2. Lint ────────────────────────────────────────────────────────────────
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run ESLint
        run: npm run lint

  # ── 3. Build ───────────────────────────────────────────────────────────────
  # Catches: missing modules, bad JSX, broken dynamic imports, and anything
  # tsc misses (e.g. a package present locally but absent from package.json).
  build:
    name: Build
    runs-on: ubuntu-latest
    env:
      # Dummy values — API routes are force-dynamic and only run at request
      # time, not build time, so these are never actually used.
      NEXTAUTH_SECRET: ci-placeholder-secret-that-is-long-enough-32c
      NEXTAUTH_URL: http://localhost:3000
      GITHUB_ID: ci-placeholder
      GITHUB_SECRET: ci-placeholder
      NEXT_PUBLIC_SUPABASE_URL: https://placeholder.supabase.co
      NEXT_PUBLIC_SUPABASE_ANON_KEY: placeholder-anon-key
      SUPABASE_SERVICE_ROLE_KEY: placeholder-service-key
      NEXT_PUBLIC_APP_URL: http://localhost:3000
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build Next.js app
        run: npm run build

  # ── 4. Dependency audit ────────────────────────────────────────────────────
  # Checks every third-party import in src/ has a matching entry in
  # package.json. Catches the "installed locally but missing from
  # package.json" problem (e.g. the jspdf incident on PR #114).
  dep-check:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Check all imports exist in package.json
        run: node scripts/check-deps.js

  # ── Summary gate ───────────────────────────────────────────────────────────
  # Single status check to add to branch protection rules.
  # Branch: main → require "CI passed" before merge.
  ci-pass:
    name: CI passed
    runs-on: ubuntu-latest
    needs: [typecheck, lint, build, dep-check]
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          if [[ "${{ needs.typecheck.result }}" != "success" ||
                "${{ needs.lint.result }}"      != "success" ||
                "${{ needs.build.result }}"     != "success" ||
                "${{ needs.dep-check.result }}" != "success" ]]; then
            echo "One or more CI jobs failed."
            exit 1
          fi
          echo "All CI jobs passed."