ci.yml

name: CI

on:
  push:
    branches: [main, staging]
  pull_request:
  workflow_dispatch:
    inputs:
      update-visual:
        description: Regenerate the visual baselines and upload them as an artifact
        type: boolean
        default: false

concurrency:
  group: ci-${{ github.ref }}
  # Never cancel a push to main or staging: its release job may be halfway through publishing.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  commits:
    name: conventional commits
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
      - run: bun install --frozen-lockfile
      # Every commit lands on staging as is, and a squash merge lands the title instead: both drive the release.
      - name: Commits
        run: bunx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
      - name: PR title
        env:
          TITLE: ${{ github.event.pull_request.title }}
        run: printf '%s\n' "$TITLE" | bunx commitlint --verbose

  check:
    name: test · typecheck · build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: bun install --frozen-lockfile
      - run: bun run test
      - run: bun run typecheck
      - run: bun run build
      - name: CLI smoke (deliver is deterministic)
        run: node packages/cli/scripts/smoke.mjs

  site:
    name: site · test · typecheck · build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: bun install --frozen-lockfile
      # build-data needs the viewer template for the delivered-file receipt.
      - run: bun run --filter @stackmap/viewer build
      - run: bun run --filter @stackmap/site test
      - run: bun run --filter @stackmap/site typecheck
      - run: bun run --filter @stackmap/site build
      - name: Site smoke against the production build
        working-directory: site
        run: |
          bunx playwright install --with-deps chromium
          bunx playwright test
      - name: Upload site Playwright results on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: site-playwright-results
          path: site/test-results/

  e2e:
    name: e2e · visual
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # The same image the visual baselines were generated in, so fonts rasterise identically.
    container: mcr.microsoft.com/playwright:v1.63.0-noble
    env:
      HOME: /root
    steps:
      - uses: actions/checkout@v4
      - run: npm install -g bun@1.3.14
      - run: bun install --frozen-lockfile
      - run: bun run build
      - name: Viewer e2e and visual regression
        working-directory: packages/viewer
        run: bunx playwright test ${{ inputs.update-visual && '--update-snapshots=all' || '' }}
      - name: Delivered-file and live-serve e2e
        if: success() || failure()
        working-directory: packages/cli
        run: bunx playwright test
      # Always: a missing baseline is written by Playwright, and this is how it gets back into the repo.
      - name: Upload visual snapshots
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: visual-baselines
          path: packages/viewer/e2e/visual.spec.ts-snapshots/
      - name: Upload Playwright results on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-results
          path: |
            packages/viewer/test-results/
            packages/cli/test-results/

  release:
    name: release
    needs: [check, e2e]
    # Off until launch: the repository variable RELEASE_ENABLED is set to true once v0.0.0 is tagged and staging exists.
    # Without the tag, semantic-release counts every commit and picks 1.0.0.
    if: github.event_name == 'push' && vars.RELEASE_ENABLED == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    concurrency:
      group: release
      cancel-in-progress: false
    permissions:
      contents: write # tags and the GitHub release
      issues: write # release comments on issues
      pull-requests: write # and on pull requests
      id-token: write # npm trusted publishing (OIDC) and provenance
    steps:
      # The deploy key pushes the release commit and the back-merge past branch protection.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }}
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
      # Trusted publishing needs npm 11.5.1+, newer than some Node 24 images bundle.
      - run: npm install -g npm@^11.5.1
      - run: bun install --frozen-lockfile
      # The CLI's prepack bundles the viewer template, which this fresh checkout hasn't built yet.
      - run: bun run build
      - run: npx --no-install semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GIT_AUTHOR_NAME: github-actions[bot]
          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
          GIT_COMMITTER_NAME: github-actions[bot]
          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
      # A release commits its version to main; staging takes it back so the next staging → main merge is clean.
      - name: Merge main back into staging
        if: github.ref_name == 'main'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
          git fetch origin main staging
          git checkout -B staging origin/staging
          git merge --no-ff origin/main -m "chore(release): merge main into staging [skip ci]"
          git push origin staging