ci.yml

# ci.yml runs backend, frontend, build, and installer checks for pushes and pull requests.
# Each job uses the repository Make targets so local acceptance follows the same
# commands. Go jobs retain independent tool setup, while frontend jobs install the
# frozen dependency graph and run formatter, parser-policy, and application tests.
name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

# New commits cancel unfinished checks for the same branch or pull request.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  # CI reruns tests for each commit; local commands may reuse test results.
  GOFLAGS: -count=1

jobs:
  go-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          # Pull requests check their source commit; full history resolves the format base.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
      - id: go
        uses: ./.github/actions/setup-go
        with:
          group: lint
      - id: golangci
        run: echo "version=$(cat .golangci-version)" >> "$GITHUB_OUTPUT"
      - uses: golangci/golangci-lint-action@v9
        with:
          version: ${{ steps.golangci.outputs.version }}
          install-only: true
          skip-cache: true
      - run: make lint-go
      - run: make test-tools
      - name: Check formatting of changed Go files
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE: ${{ github.event.pull_request.base.sha }}
          PUSH_BASE: ${{ github.event.before }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          if [ "$EVENT_NAME" = pull_request ]; then
            BASE=$(git merge-base "$PR_BASE" HEAD)
          elif [ -n "$PUSH_BASE" ] && [ "$PUSH_BASE" != 0000000000000000000000000000000000000000 ]; then
            # A forced push can remove the previous commit from branch history. Fetch
            # that commit separately so formatting still checks the complete push range.
            git cat-file -e "$PUSH_BASE^{commit}" 2>/dev/null || git fetch origin "$PUSH_BASE"
            BASE=$PUSH_BASE
          elif [ "$GITHUB_REF_NAME" != "$DEFAULT_BRANCH" ]; then
            BASE=$(git merge-base "origin/$DEFAULT_BRANCH" HEAD)
          else
            # An initial default-branch push has no previous revision. Comparing to
            # the empty tree includes every source file in that first commit.
            BASE=$(git hash-object -t tree --stdin < /dev/null)
          fi
          make fmt-go-check BASE="$BASE"
      - if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/cache/save@v5
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
            ~/.cache/golangci-lint
          key: ${{ steps.go.outputs.cache-key }}

  go-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - id: go
        uses: ./.github/actions/setup-go
        with:
          group: test
      - run: make test-go
      - if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/cache/save@v5
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
            ~/.cache/golangci-lint
          key: ${{ steps.go.outputs.cache-key }}

  go-integration:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      # Integration restores the shared test cache saved by the go-test job.
      - uses: ./.github/actions/setup-go
        with:
          group: test
      - name: Install PostgreSQL 18 client
        run: |
          # Restore fixtures run PostgreSQL 18. The matching client can dump its
          # server data, while an older pg_dump rejects the newer server version.
          sudo install -d /usr/share/postgresql-common/pgdg
          sudo curl --fail --silent --show-error --location https://www.postgresql.org/media/keys/ACCC4CF8.asc -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc
          . /etc/os-release
          echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt ${VERSION_CODENAME}-pgdg main" | sudo tee /etc/apt/sources.list.d/tokenrouter-pgdg.list
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends postgresql-client-18
          echo "/usr/lib/postgresql/18/bin" >> "$GITHUB_PATH"
      - run: make test-integration

  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
        with:
          package_json_file: frontend/package.json
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm
          cache-dependency-path: frontend/pnpm-lock.yaml
      - run: pnpm --dir frontend install --frozen-lockfile
      - run: make lint-frontend
      - run: make test-frontend

  # Build production browser assets and the server variant that embeds them.
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - id: go
        uses: ./.github/actions/setup-go
        with:
          group: build
      - id: golangci
        run: echo "version=$(cat .golangci-version)" >> "$GITHUB_OUTPUT"
      - uses: golangci/golangci-lint-action@v9
        with:
          version: ${{ steps.golangci.outputs.version }}
          install-only: true
          skip-cache: true
      - uses: pnpm/action-setup@v6
        with:
          package_json_file: frontend/package.json
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm
          cache-dependency-path: frontend/pnpm-lock.yaml
      - run: pnpm --dir frontend install --frozen-lockfile
      - run: make build
      - run: make test-embed
      - if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/cache/save@v5
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
            ~/.cache/golangci-lint
          key: ${{ steps.go.outputs.cache-key }}

  scripts:
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v6
      - run: make test-scripts

  installer:
    # Installer fixtures require Bash 4 and sha256sum, so this job uses Linux.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - run: make test-installer