ci.yml

name: ci

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_INCREMENTAL: 0
  CARGO_TERM_COLOR: always
  PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.cache/ms-playwright

jobs:
  frontend-quality:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: crates/needle-app/web/package-lock.json
      - name: Install web dependencies
        working-directory: crates/needle-app/web
        run: npm ci
      - name: Test, type-check, lint, and build the web control plane
        working-directory: crates/needle-app/web
        run: |
          npm test
          npm run typecheck
          npm run lint
          npm run build
      - name: Upload web production bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: web-dist
          path: crates/needle-app/web/dist
          retention-days: 1
          if-no-files-found: error

  rust-format:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: 1.90.0
          components: rustfmt
      - name: Check Rust formatting
        run: cargo fmt --all -- --check

  platform-checks:
    needs: [frontend-quality, rust-format]
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: 1.90.0
          components: clippy
      - name: Cache Rust dependencies and build
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-rust-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}
          restore-keys: |
            ${{ runner.os }}-rust-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}-
            ${{ runner.os }}-rust-
      - name: Download web production bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: web-dist
          path: crates/needle-app/web/dist
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        if: matrix.os == 'ubuntu-latest'
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: crates/needle-app/web/package-lock.json
      - name: Install web dependencies
        if: matrix.os == 'ubuntu-latest'
        working-directory: crates/needle-app/web
        run: npm ci
      - name: Check Rust lints
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'windows-latest'
        run: cargo clippy --locked --workspace --all-targets -- -D warnings
      - name: Test the Rust workspace
        run: cargo test --locked --workspace
      - name: Build the Rust workspace
        run: cargo build --locked --workspace
      - name: Cache Playwright browsers
        if: matrix.os == 'ubuntu-latest'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ hashFiles('crates/needle-app/web/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-playwright-
      - name: Install Playwright Chromium
        if: matrix.os == 'ubuntu-latest'
        working-directory: crates/needle-app/web
        run: npx playwright install chromium
      - name: Verify embedded control plane end to end
        if: matrix.os == 'ubuntu-latest'
        working-directory: crates/needle-app/web
        run: npm run test:e2e:local
      - name: Validate product and benchmark plugins
        run: |
          cargo run --locked -p needle-app -- plugin validate
          cargo run --locked -p needle-app -- plugin validate --benchmark
      - name: Package product and benchmark plugins
        run: |
          cargo run --locked -p needle-app -- plugin package --output ci-plugin
          cargo run --locked -p needle-app -- plugin package --benchmark --output ci-benchmark-plugin

  # Single required check covering every CI stage and operating system.
  ci-required:
    name: ci-required
    if: always()
    needs: [frontend-quality, rust-format, platform-checks]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require every CI stage
        env:
          FRONTEND_RESULT: ${{ needs['frontend-quality'].result }}
          RUST_FORMAT_RESULT: ${{ needs['rust-format'].result }}
          PLATFORM_RESULT: ${{ needs['platform-checks'].result }}
        run: |
          if [[ "$FRONTEND_RESULT" != "success" ]]; then
            echo "::error::Frontend quality failed: $FRONTEND_RESULT"
            exit 1
          fi
          if [[ "$RUST_FORMAT_RESULT" != "success" ]]; then
            echo "::error::Rust formatting failed: $RUST_FORMAT_RESULT"
            exit 1
          fi
          if [[ "$PLATFORM_RESULT" != "success" ]]; then
            echo "::error::One or more platform checks failed: $PLATFORM_RESULT"
            exit 1
          fi