ci.yml

name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  actions: read

env:
  NODE_VERSION: '25.8.0'

jobs:
  lint:
    name: Lint & Typecheck
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm biome check .
      - run: pnpm --filter 'modern-cmdk' exec tsc --noEmit

  test:
    name: Test (${{ matrix.os }}, shard ${{ matrix.shard }}/4)
    needs: lint
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-latest, windows-latest]
        shard: [1, 2, 3, 4]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm -r --filter '!docs' --filter '!playground' --filter '!modern-cmdk-monorepo' --parallel run build
      - run: pnpm vitest run --shard=${{ matrix.shard }}/4

  e2e:
    name: E2E Tests
    needs: lint
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    continue-on-error: true
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile --ignore-scripts
      # Build sequentially — playground depends on modern-cmdk dist (styles.css, exports)
      - run: pnpm -r --filter '!docs' --filter '!modern-cmdk-monorepo' run build
      - run: pnpm playwright install --with-deps chromium
      - run: pnpm playwright test
      - uses: actions/upload-artifact@v7
        if: failure()
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 14
          include-hidden-files: true

  size:
    name: Bundle Size
    needs: lint
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm -r --filter '!docs' --filter '!playground' --filter '!modern-cmdk-monorepo' --parallel run build
      - id: size
        run: |
          pnpm size-limit --json > size-report.json
          {
            echo "report<<EOF"
            cat size-report.json
            echo "EOF"
          } >> "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@v7
        with:
          name: size-report
          path: size-report.json
          retention-days: 30

  security:
    name: Security Audit
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    continue-on-error: true
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm audit --audit-level=high || echo "::warning::Security audit found issues"

  bench:
    name: Benchmarks
    needs: lint
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm -r --filter '!docs' --filter '!playground' --filter '!modern-cmdk-monorepo' --parallel run build
      - run: pnpm bench:ci
      - run: pnpm bench:compare
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: benchmark-results
          path: benchmarks/results/
          retention-days: 30

  summary:
    name: CI Summary
    needs: [lint, test, e2e, size, bench, security]
    if: always()
    runs-on: ubuntu-24.04
    timeout-minutes: 2
    steps:
      - name: Generate summary
        run: |
          status_icon() {
            case "$1" in
              success) echo "pass" ;;
              failure) echo "FAIL" ;;
              cancelled) echo "skip" ;;
              skipped) echo "skip" ;;
              *) echo "warn" ;;
            esac
          }
          echo "## CI Summary" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Job | Status | Result |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-----|--------|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Lint & Typecheck | $(status_icon "${{ needs.lint.result }}") | \`${{ needs.lint.result }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Tests (3 OS x 4 shards) | $(status_icon "${{ needs.test.result }}") | \`${{ needs.test.result }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| E2E (Chromium) | $(status_icon "${{ needs.e2e.result }}") | \`${{ needs.e2e.result }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Bundle Size | $(status_icon "${{ needs.size.result }}") | \`${{ needs.size.result }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Benchmarks | $(status_icon "${{ needs.bench.result }}") | \`${{ needs.bench.result }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Security Audit | $(status_icon "${{ needs.security.result }}") | \`${{ needs.security.result }}\` |" >> "$GITHUB_STEP_SUMMARY"
      - name: Fail if critical jobs failed
        if: needs.lint.result == 'failure' || needs.test.result == 'failure'
        run: exit 1