ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  check-paths:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    outputs:
      cli_code: ${{ steps.detect.outputs.cli_code }}
      root_code: ${{ steps.detect.outputs.root_code }}
      workflow_code: ${{ steps.detect.outputs.workflow_code }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Detect changed paths
        id: detect
        shell: bash
        run: |
          set -euo pipefail

          BASE_SHA='${{ github.event.pull_request.base.sha }}'
          HEAD_SHA='${{ github.event.pull_request.head.sha }}'
          echo "Base SHA: $BASE_SHA"
          echo "Head SHA: $HEAD_SHA"
          mapfile -t files < <(git diff --name-only --no-renames "$BASE_SHA" "$HEAD_SHA")

          cli_code=false
          root_code=false
          workflow_code=false

          for f in "${files[@]}"; do
            case "$f" in
              .github/workflows/*)
                workflow_code=true
                ;;
            esac

            case "$f" in
              .bun-version|.node-version|.github/rulesets/*|scripts/*|package.json|packages/tsconfig/*)
                # Comment: Root automation scripts are outside Turbo's package
                # affected graph, so CI must track them explicitly or script-only
                # changes bypass validation. Runtime pins affect every JS task
                # even when Turbo does not associate them with one package.
                root_code=true
                ;;
            esac

            case "$f" in
              apps/cli/*)
                if [[ "$f" != *.md ]]; then
                  cli_code=true
                fi
                ;;
              .github/workflows/cli-release.yml|.github/workflows/cli-cargo-audit.yml|.github/workflows/ci.yml|package.json|turbo.json|packages/server/scripts/generate-cli-auth-openapi.ts|packages/server/package.json|packages/server/scripts/generate-cli-openapi.ts|packages/server/src/app.ts|packages/server/src/auth.ts|packages/server/src/env.ts|packages/server/src/problem-details/*|packages/server/src/routes/cli/*|apps/dashboard/src/lib/check-authenticated-redirect.ts|apps/dashboard/src/lib/check-authenticated-redirect.test.ts|apps/dashboard/src/server/cli-auth-login-session.ts)
                cli_code=true
                ;;
            esac
          done

          {
            echo "cli_code=$cli_code"
            echo "root_code=$root_code"
            echo "workflow_code=$workflow_code"
          } >> "$GITHUB_OUTPUT"

  workflow-lint:
    needs: [check-paths]
    if: always() && !cancelled() && (github.event_name != 'pull_request' || needs.check-paths.outputs.workflow_code == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - uses: actions/checkout@v6

      - name: actionlint
        # CONTEXT: rhysd/actionlint does not currently publish a floating `v1`
        # tag, so pin a concrete release or workflow setup fails before linting.
        uses: rhysd/actionlint@v1.7.11

  ci:
    needs: [check-paths]
    if: always() && !cancelled()
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      TURBO_API: ${{ secrets.TURBO_API }}
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
      TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
      ONEQUERY_PGLITE_DIR: /tmp/onequery-ci/pglite/onequery

    steps:
      - uses: actions/checkout@v6
        with:
          # CONTEXT: Turbo's source-control filters need the full git history
          # so PR-scoped runs compare the correct base and head revisions.
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".node-version"

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: ".bun-version"

      - name: Detect affected JS tasks
        if: github.event_name == 'pull_request'
        id: affected
        shell: bash
        run: |
          set -euo pipefail

          BASE_SHA='${{ github.event.pull_request.base.sha }}'
          HEAD_SHA='${{ github.event.pull_request.head.sha }}'
          # Keep detection lightweight by using the repo-pinned Turbo CLI
          # without installing the full workspace dependencies first.
          TURBO_VERSION="$(bun -e 'process.stdout.write(require("./package.json").devDependencies.turbo)')"
          json="$(bunx "turbo@$TURBO_VERSION" run typecheck build test --dry=json --filter="...[$BASE_SHA...$HEAD_SHA]" --filter='!@onequery/cli')"
          count="$(printf '%s\n' "$json" | bun -e 'const fs = require("fs"); const input = fs.readFileSync(0, "utf8"); const data = JSON.parse(input.slice(input.indexOf("{"))); const count = data.tasks.filter((task) => task.package !== "//" && task.package !== "@onequery/cli" && task.command !== "<NONEXISTENT>").length; process.stdout.write(String(count));')"

          if [[ "$count" -gt 0 ]]; then
            echo "has_tasks=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_tasks=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Skip JS CI
        if: github.event_name == 'pull_request' && steps.affected.outputs.has_tasks != 'true'
        run: echo "Skipping JS CI - no affected non-CLI Turbo tasks"

      - name: Install dependencies
        if: github.event_name != 'pull_request' || steps.affected.outputs.has_tasks == 'true' || needs.check-paths.outputs.root_code == 'true'
        run: bun ci

      - name: Prepare PGlite database directory
        if: github.event_name != 'pull_request' || steps.affected.outputs.has_tasks == 'true'
        run: mkdir -p "$ONEQUERY_PGLITE_DIR"

      - name: Drizzle migration graph check
        if: github.event_name != 'pull_request' || steps.affected.outputs.has_tasks == 'true'
        run: cd packages/db && bunx drizzle-kit check

      - name: Apply PGlite test database schema
        if: github.event_name != 'pull_request' || steps.affected.outputs.has_tasks == 'true'
        # Comment: CI validates Drizzle against the same PGlite driver used by
        # local workspace commands; migration graph validation still runs above.
        run: cd packages/db && bunx drizzle-kit push --force --config drizzle.config.ts

      - name: Lint & Format
        if: github.event_name != 'pull_request' || steps.affected.outputs.has_tasks == 'true' || needs.check-paths.outputs.root_code == 'true'
        # CONTEXT: `turbo` is installed as a repo devDependency, so invoke it
        # through Bun instead of assuming the binary is on the runner PATH.
        run: bunx turbo run //#check

      - name: Type check (root)
        if: github.event_name != 'pull_request' || needs.check-paths.outputs.root_code == 'true'
        run: bun run typecheck:root

      - name: Type check (affected)
        if: github.event_name == 'pull_request' && steps.affected.outputs.has_tasks == 'true'
        run: bunx turbo run typecheck --filter='...[${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}]' --filter='!@onequery/cli'

      - name: Type check (full)
        if: github.event_name != 'pull_request'
        run: bunx turbo run typecheck --filter=!@onequery/cli

      - name: Build (affected)
        if: github.event_name == 'pull_request' && steps.affected.outputs.has_tasks == 'true'
        run: bunx turbo run build --filter='...[${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}]' --filter='!@onequery/cli'

      - name: Build (full)
        if: github.event_name != 'pull_request'
        run: bunx turbo run build --filter=!@onequery/cli

      - name: Test (affected)
        if: github.event_name == 'pull_request' && steps.affected.outputs.has_tasks == 'true'
        run: bunx turbo run test --filter='...[${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}]' --filter='!@onequery/cli'

      - name: Test (full)
        if: github.event_name != 'pull_request'
        run: bunx turbo run test --filter=!@onequery/cli

      # - name: Check unused code
      #   run: bun run knip

  cli-ci:
    needs: [check-paths]
    if: always() && !cancelled() && (github.event_name != 'pull_request' || needs.check-paths.outputs.cli_code == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".node-version"

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: ".bun-version"

      - name: Setup Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          rust-src-dir: apps/cli
          rustflags: ""

      - name: Install dependencies
        run: bun ci

      - name: Add Bun tool binaries to PATH
        run: echo "${GITHUB_WORKSPACE}/node_modules/.bin" >> "$GITHUB_PATH"

      - name: CLI Lint & Format
        working-directory: apps/cli
        run: |
          # CONTEXT: Keep CI independent from `just`; invoke the underlying checks directly.
          cargo fmt -- --check --config imports_granularity=Item
          cargo clippy --tests
          cd ../..
          bun run proto:check

      - name: CLI Build
        working-directory: apps/cli
        run: cargo build

      - name: CLI Test
        working-directory: apps/cli
        run: cargo test

  results:
    name: CI results (required)
    needs: [check-paths, workflow-lint, ci, cli-ci]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Summarize
        shell: bash
        run: |
          echo "workflow-lint: ${{ needs['workflow-lint'].result }}"
          echo "ci           : ${{ needs.ci.result }}"
          echo "cli-ci       : ${{ needs['cli-ci'].result }}"

          if [[ '${{ needs['workflow-lint'].result }}' != 'success' && '${{ needs['workflow-lint'].result }}' != 'skipped' ]]; then
            echo 'workflow-lint failed'
            exit 1
          fi

          if [[ '${{ needs.ci.result }}' != 'success' && '${{ needs.ci.result }}' != 'skipped' ]]; then
            echo 'ci failed'
            exit 1
          fi

          if [[ '${{ needs['cli-ci'].result }}' != 'success' && '${{ needs['cli-ci'].result }}' != 'skipped' ]]; then
            echo 'cli-ci failed'
            exit 1
          fi