ci.yml

name: 🧪 CI

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches: [dev]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.number }}
  cancel-in-progress: true

env:
  DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/effectify"
  NODE_OPTIONS: "--max-old-space-size=4096"

jobs:
  release-policy:
    name: 🛡️ Release Policy Contract
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: 📥 Checkout stable release PR head
        if: github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.ref, 'release/stable-')
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: 🛡️ Require one stable release source commit
        if: github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.ref, 'release/stable-')
        shell: bash
        env:
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail
          [[ "$PR_HEAD_REF" == release/stable-* ]] || { echo '::error::invalid stable release head branch'; exit 1; }
          [[ "$PR_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo '::error::stable release PR head SHA must be full lowercase hexadecimal'; exit 1; }
          [[ "$PR_BASE_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo '::error::stable release PR base SHA must be full lowercase hexadecimal'; exit 1; }
          test "$(git rev-parse HEAD)" = "$PR_HEAD_SHA" || { echo '::error::stable release PR checkout does not match the GitHub head SHA'; exit 1; }
          git fetch --no-tags --no-write-fetch-head origin "$PR_BASE_SHA"
          git cat-file -e "${PR_HEAD_SHA}^{commit}"
          git cat-file -e "${PR_BASE_SHA}^{commit}"
          SOURCE_COMMIT_COUNT=$(git rev-list --count "$PR_BASE_SHA..$PR_HEAD_SHA")
          if [ "$SOURCE_COMMIT_COUNT" != 1 ]; then
            echo "::error::stable release PR must contain exactly one source commit; found $SOURCE_COMMIT_COUNT"
            exit 1
          fi
          echo "Stable release PR contains exactly one source commit."

      - name: 📥 Checkout
        uses: actions/checkout@v5

      - name: 🏗️ Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "24.19.0"
          package-manager-cache: false

      - name: 🛡️ Verify release policy contract
        run: node --test scripts/release-policy-contract.test.mjs

      - name: 🧪 Verify stable FINALIZE harness
        run: node --test scripts/release-finalize-stable.test.mjs

  # Lint and format check
  lint:
    name: 🔍 Lint & Format
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: 📦 Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.14.0

      - name: 🏗️ Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "24.19.0"
          cache: "pnpm"

      - name: 📦 Install dependencies
        run: pnpm install --frozen-lockfile

      - name: 🎯 Resolve affected base
        id: affected-base
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            BASE="origin/${{ github.base_ref }}"
          else
            BEFORE="${{ github.event.before }}"
            DEFAULT_BASE="origin/${{ github.event.repository.default_branch }}"
            ZERO_SHA="0000000000000000000000000000000000000000"
            if [[ -n "$BEFORE" && "$BEFORE" != "$ZERO_SHA" ]] && git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
              BASE="$BEFORE"
            elif git cat-file -e "${DEFAULT_BASE}^{commit}" 2>/dev/null; then
              BASE="$DEFAULT_BASE"
            elif git rev-parse --verify HEAD^ >/dev/null 2>&1; then
              BASE="HEAD^"
            else
              BASE="HEAD"
            fi
          fi
          echo "sha=$BASE" >> "$GITHUB_OUTPUT"

      - name: 🔍 Run oxlint on affected projects
        run: pnpm nx affected --target=lint --base="${{ steps.affected-base.outputs.sha }}" --head=HEAD --parallel=1

      - name: 🎨 Check changed files with oxfmt
        run: pnpm nx run @effectify/repo:format:check --args="--base=${{ steps.affected-base.outputs.sha }} --head=HEAD" || (echo "❌ Some changed files are not formatted. Run 'pnpm format' to fix formatting." && exit 1)

  # Type checking
  typecheck:
    name: 🔍 Type Check
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: 📦 Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.14.0

      - name: 🏗️ Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "24.19.0"
          cache: "pnpm"

      - name: 📦 Install dependencies
        run: pnpm install --frozen-lockfile

      - name: 🎯 Resolve affected base
        id: affected-base
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            BASE="origin/${{ github.base_ref }}"
          else
            BEFORE="${{ github.event.before }}"
            DEFAULT_BASE="origin/${{ github.event.repository.default_branch }}"
            ZERO_SHA="0000000000000000000000000000000000000000"
            if [[ -n "$BEFORE" && "$BEFORE" != "$ZERO_SHA" ]] && git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
              BASE="$BEFORE"
            elif git cat-file -e "${DEFAULT_BASE}^{commit}" 2>/dev/null; then
              BASE="$DEFAULT_BASE"
            elif git rev-parse --verify HEAD^ >/dev/null 2>&1; then
              BASE="HEAD^"
            else
              BASE="HEAD"
            fi
          fi
          echo "sha=$BASE" >> "$GITHUB_OUTPUT"

      - name: 🔍 Type check affected projects
        run: pnpm nx affected --target=typecheck --base="${{ steps.affected-base.outputs.sha }}" --head=HEAD --parallel=1 --verbose

  # Build affected projects
  build:
    name: 🏗️ Build
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    outputs:
      has-build-artifacts: ${{ steps.build.outputs.has-artifacts }}
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: 📦 Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.14.0

      - name: 🏗️ Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "24.19.0"
          cache: "pnpm"

      - name: 📦 Install dependencies
        run: pnpm install --frozen-lockfile

      - name: 🎯 Resolve affected base
        id: affected-base
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            BASE="origin/${{ github.base_ref }}"
          else
            BEFORE="${{ github.event.before }}"
            DEFAULT_BASE="origin/${{ github.event.repository.default_branch }}"
            ZERO_SHA="0000000000000000000000000000000000000000"
            if [[ -n "$BEFORE" && "$BEFORE" != "$ZERO_SHA" ]] && git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
              BASE="$BEFORE"
            elif git cat-file -e "${DEFAULT_BASE}^{commit}" 2>/dev/null; then
              BASE="$DEFAULT_BASE"
            elif git rev-parse --verify HEAD^ >/dev/null 2>&1; then
              BASE="HEAD^"
            else
              BASE="HEAD"
            fi
          fi
          echo "sha=$BASE" >> "$GITHUB_OUTPUT"

      - name: 🏗️ Build affected projects
        id: build
        run: |
          BASE="${{ steps.affected-base.outputs.sha }}"

          # Build affected projects with caching
          pnpm nx affected --target=build --base="$BASE" --head=HEAD --parallel=1 --verbose

          # Check if any projects were built
          AFFECTED_PROJECTS=$(pnpm nx show projects --affected --base="$BASE" --head=HEAD --json | jq -r '.[]' | tr '\n' ' ')
          if [ -n "$AFFECTED_PROJECTS" ]; then
            echo "has-artifacts=true" >> $GITHUB_OUTPUT
            echo "📦 Built projects: $AFFECTED_PROJECTS"

            # Create build manifest for artifact upload
            echo "BUILT_PROJECTS=$AFFECTED_PROJECTS" >> $GITHUB_ENV
          else
            echo "has-artifacts=false" >> $GITHUB_OUTPUT
            echo "ℹ️ No projects to build"
          fi

      - name: 📦 Upload build artifacts
        if: steps.build.outputs.has-artifacts == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: build-artifacts-${{ github.sha }}
          path: |
            packages/**/dist/
            apps/*/dist/
            apps/*/build/
          retention-days: 7
      - run: pnpm nx fix-ci
        if: always() # IMPORTANT: Always run
  # Test affected projects
  test:
    name: 🧪 Test
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: 📦 Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.14.0

      - name: 🏗️ Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "24.19.0"
          cache: "pnpm"

      - name: 📦 Install dependencies
        run: pnpm install --frozen-lockfile

      - name: 🎯 Resolve affected base
        id: affected-base
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            BASE="origin/${{ github.base_ref }}"
          else
            BEFORE="${{ github.event.before }}"
            DEFAULT_BASE="origin/${{ github.event.repository.default_branch }}"
            ZERO_SHA="0000000000000000000000000000000000000000"
            if [[ -n "$BEFORE" && "$BEFORE" != "$ZERO_SHA" ]] && git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
              BASE="$BEFORE"
            elif git cat-file -e "${DEFAULT_BASE}^{commit}" 2>/dev/null; then
              BASE="$DEFAULT_BASE"
            elif git rev-parse --verify HEAD^ >/dev/null 2>&1; then
              BASE="HEAD^"
            else
              BASE="HEAD"
            fi
          fi
          echo "sha=$BASE" >> "$GITHUB_OUTPUT"

      - name: 📦 Download build artifacts
        if: needs.build.outputs.has-build-artifacts == 'true'
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts-${{ github.sha }}

      - name: 🧪 Test affected projects
        run: pnpm nx affected --target=test --base="${{ steps.affected-base.outputs.sha }}" --head=HEAD --parallel=1 --verbose --passWithNoTests
  # Summary job
  ci-summary:
    name: 📊 CI Summary
    runs-on: ubuntu-latest
    needs: [release-policy, lint, typecheck, build, test]
    if: always() && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
    steps:
      - name: 📊 CI Summary
        run: |
          echo "## 🧪 CI Results Summary" >> $GITHUB_STEP_SUMMARY
          echo "| Job | Status | Details |" >> $GITHUB_STEP_SUMMARY
          echo "|-----|--------|---------|" >> $GITHUB_STEP_SUMMARY
          echo "| 🛡️ Release Policy | ${{ needs.release-policy.result == 'success' && '✅ Success' || '❌ Failed' }} | Enforces alpha, beta, and stable separation |" >> $GITHUB_STEP_SUMMARY
          echo "| 🔍 Lint & Format | ${{ needs.lint.result == 'success' && '✅ Success' || '❌ Failed' }} | Uses oxlint + oxfmt |" >> $GITHUB_STEP_SUMMARY
          echo "| 🔍 Type Check | ${{ needs.typecheck.result == 'success' && '✅ Success' || '❌ Failed' }} | TypeScript compiler checks |" >> $GITHUB_STEP_SUMMARY
          echo "| 🏗️ Build | ${{ needs.build.result == 'success' && '✅ Success' || '❌ Failed' }} | Nx affected build |" >> $GITHUB_STEP_SUMMARY
          echo "| 🧪 Test | ${{ needs.test.result == 'success' && '✅ Success' || '❌ Failed' }} | Unit tests with Vitest |" >> $GITHUB_STEP_SUMMARY

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 📈 Performance Metrics" >> $GITHUB_STEP_SUMMARY
          echo "- 🔄 Parallel execution: 1x for lint/typecheck/build/test" >> $GITHUB_STEP_SUMMARY
          echo "- 📦 Caching: Nx computation caching enabled" >> $GITHUB_STEP_SUMMARY
          echo "- 🎯 Affected projects only: Runs only on changed code" >> $GITHUB_STEP_SUMMARY

          if [[ "${{ needs.lint.result }}" != "success" ]]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### ❌ Linting Issues" >> $GITHUB_STEP_SUMMARY
            echo "Please run 'pnpm format' to fix formatting issues" >> $GITHUB_STEP_SUMMARY
          fi
            # NEW: Add this step at the end of your job