tests-pr.yml

name: PR

on:
  pull_request:
  merge_group:

concurrency:
  group: shopify-cli-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  DEBUG: '1'
  SHOPIFY_CLI_ENV: development
  SHOPIFY_CONFIG: debug
  PNPM_VERSION: '10.11.1'
  BUNDLE_WITHOUT: 'test:development'
  GH_TOKEN: ${{ secrets.SHOPIFY_GH_READ_CONTENT_TOKEN }}
  GH_TOKEN_SHOP: ${{ secrets.SHOP_GH_READ_CONTENT_TOKEN }}
  DEFAULT_NODE_VERSION: '26.1.0'
  PLAYWRIGHT_NODE_VERSION: '24.1.0'

jobs:
  type-check:
    name: 'Type check'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: Type check
        run: pnpm nx run-many --all --target=type-check --output-style=stream

  lint:
    name: 'Lint'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: Lint
        run: pnpm nx run-many --all --target=lint --output-style=stream

  bundle:
    name: 'Bundle'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: 'Build'
        run: pnpm nx run-many --all --target=build --output-style=stream
      - name: 'Bundle'
        run: pnpm nx run-many --all --target=bundle --output-style=stream

  knip:
    name: 'Knip (unused code check)'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: Run knip
        run: node bin/run-knip-ci.js

  graphql-schema:
    # Skip on dependabot PRs (no access to required secrets) and on PRs opened
    # from forks (also no access to secrets), but always run on merge_group
    # events since merge queue runs from the base repo.
    if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && (github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name == github.repository) }}
    name: 'Check graphql-codegen has been run'
    runs-on: macos-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: Get schemas for codegen
        run: pnpm graphql-codegen:get-graphql-schemas
      - name: Run graphql-codegen
        run: pnpm graphql-codegen
      - name: Run git diff
        run: git diff
      - name: Fail if any changes were made
        run: 'test -z "$(git status --porcelain)" || { echo -e "Run pnpm graphql-codegen when queries are changed, committing any fixes and generated files" ; exit 1; }'

  oclif-checks:
    name: 'Check OCLIF manifests & readme & docs'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: Build
        run: pnpm build --output-style=stream
      - name: Refresh manifests
        run: pnpm refresh-manifests
      - name: Check if there are changes
        run: 'test -z "$(git status --porcelain "**/oclif.manifest.json" )" || { echo -e "Run pnpm refresh-manifests before pushing new commands or flags. Diff here:\n\n$(git diff)" ; exit 1; }'
      - name: Refresh readme
        run: pnpm refresh-readme
      - name: Check if there are changes
        run: 'test -z "$(git status --porcelain "packages/cli/README.md" )" || { echo -e "Run pnpm refresh-readme before pushing new commands or flags. Diff here:\n\n$(git diff)" ; exit 1; }'
      - name: Refresh code documentation
        run: pnpm refresh-code-documentation
      - name: Check if there are changes
        run: 'test -z "$(git status --porcelain)" || { echo -e "Run pnpm refresh-code-documentation when you update functions with autogenerated examples. Diff here:\n\n$(git diff)" ; exit 1; }'
      - name: Build shopify.dev docs
        run: pnpm build-dev-docs
      - name: Check if there are changes
        run: 'test -z "$(git status --porcelain "docs-shopify.dev/generated/*.json" )" || { echo -e "Run (pnpm build-dev-docs) before pushing new commands or flags." ; exit 1; }'

  unit-tests:
    name: "Unit tests with Node ${{ matrix.node }} in ${{ matrix.os }}${{ matrix.shard != '' && format(' (shard {0})', matrix.shard) || '' }}"
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'windows-latest', 'macos-latest' ]
        node: [ '22.12.0', '24.1.0', '26.1.0' ]
        shard: [ '' ]
        include:
          # Add sharding for Windows jobs to reduce wall-clock time
          - os: windows-latest
            node: '22.12.0'
            shard: '1/2'
          - os: windows-latest
            node: '22.12.0'
            shard: '2/2'
          - os: windows-latest
            node: '24.1.0'
            shard: '1/2'
          - os: windows-latest
            node: '24.1.0'
            shard: '2/2'
          - os: windows-latest
            node: '26.1.0'
            shard: '1/2'
          - os: windows-latest
            node: '26.1.0'
            shard: '2/2'
        exclude:
          # Exclude the non-sharded Windows entries (replaced by sharded ones above)
          - os: windows-latest
            node: '22.12.0'
            shard: ''
          - os: windows-latest
            node: '24.1.0'
            shard: ''
          - os: windows-latest
            node: '26.1.0'
            shard: ''
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ matrix.node }}
      - name: Unit tests
        run: pnpm vitest run ${{ env.POOL_OPTIONS }} ${{ env.SHARD_OPTIONS }}
        env:
          POOL_OPTIONS: ${{ matrix.os == 'macos-latest' && '--pool forks' || '' }}
          SHARD_OPTIONS: ${{ matrix.shard && format('--shard {0}', matrix.shard) || '' }}
          VITEST_MIN_THREADS: "1"
          VITEST_MAX_THREADS: "4"

  unit-tests-gate:
    name: "Unit tests"
    needs: unit-tests
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Verify all unit tests passed
        if: needs.unit-tests.result != 'success'
        run: exit 1

  e2e-tests:
    name: "E2E tests (shard ${{ matrix.shard }})"
    if: github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 20
    continue-on-error: true
    strategy:
      fail-fast: false
      matrix:
        shard: ['1/2', '2/2']
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.PLAYWRIGHT_NODE_VERSION }}
      - name: Build
        run: pnpm nx run-many --all --target=build --output-style=stream
      - name: Install Playwright Chromium
        run: pnpm exec playwright install chromium
        working-directory: packages/e2e
      - name: Rebuild node-pty
        run: pnpm rebuild node-pty
      - name: Run E2E tests
        working-directory: packages/e2e
        env:
          E2E_ACCOUNT_EMAIL: ${{ secrets.E2E_ACCOUNT_EMAIL }}
          E2E_ACCOUNT_PASSWORD: ${{ secrets.E2E_ACCOUNT_PASSWORD }}
          E2E_STORE_FQDN: ${{ secrets.E2E_STORE_FQDN }}
          E2E_ORG_ID: ${{ secrets.E2E_ORG_ID }}
          E2E_LOADTEST_HEADER: ${{ secrets.E2E_LOADTEST_HEADER }}
        run: pnpm exec playwright test --shard ${{ matrix.shard }}
      - name: Upload Playwright report
        uses: actions/upload-artifact@v4
        if: ${{ !cancelled() }}
        with:
          name: playwright-report-${{ strategy.job-index }}
          # Playwright traces contain request headers and must not expose E2E_LOADTEST_HEADER.
          path: |
            packages/e2e/playwright-report/
            !packages/e2e/playwright-report/**/*.zip
          retention-days: 14
      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: ${{ !cancelled() }}
        with:
          name: playwright-results-${{ strategy.job-index }}
          path: |
            packages/e2e/test-results/
            !packages/e2e/test-results/**/trace.zip
          retention-days: 14

  e2e-cleanup:
    name: 'Cleanup current-run E2E resources'
    needs: e2e-tests
    if: ${{ always() && needs.e2e-tests.result != 'skipped' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    continue-on-error: true
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.PLAYWRIGHT_NODE_VERSION }}
      - name: Install Playwright Chromium
        run: pnpm exec playwright install chromium
        working-directory: packages/e2e
      - name: Build CLI for cleanup auth
        run: pnpm nx run cli:build
      - name: Prime cleanup auth state
        continue-on-error: true
        env:
          E2E_ACCOUNT_EMAIL: ${{ secrets.E2E_ACCOUNT_EMAIL }}
          E2E_ACCOUNT_PASSWORD: ${{ secrets.E2E_ACCOUNT_PASSWORD }}
          E2E_ORG_ID: ${{ secrets.E2E_ORG_ID }}
          E2E_LOADTEST_HEADER: ${{ secrets.E2E_LOADTEST_HEADER }}
        run: pnpm --filter e2e exec tsx scripts/prime-browser-auth.ts
      - name: Cleanup current-run E2E apps
        if: ${{ always() }}
        continue-on-error: true
        env:
          E2E_ACCOUNT_EMAIL: ${{ secrets.E2E_ACCOUNT_EMAIL }}
          E2E_ACCOUNT_PASSWORD: ${{ secrets.E2E_ACCOUNT_PASSWORD }}
          E2E_ORG_ID: ${{ secrets.E2E_ORG_ID }}
          E2E_LOADTEST_HEADER: ${{ secrets.E2E_LOADTEST_HEADER }}
        run: |
          RUN_TOKEN=$(node -e "process.stdout.write(BigInt(process.env.GITHUB_RUN_ID).toString(36))")
          pnpm --filter e2e exec tsx scripts/cleanup-apps.ts --pattern "r${RUN_TOKEN}"
      - name: Cleanup current-run E2E stores
        if: ${{ always() }}
        continue-on-error: true
        env:
          E2E_ACCOUNT_EMAIL: ${{ secrets.E2E_ACCOUNT_EMAIL }}
          E2E_ACCOUNT_PASSWORD: ${{ secrets.E2E_ACCOUNT_PASSWORD }}
          E2E_ORG_ID: ${{ secrets.E2E_ORG_ID }}
          E2E_LOADTEST_HEADER: ${{ secrets.E2E_LOADTEST_HEADER }}
        run: |
          RUN_TOKEN=$(node -e "process.stdout.write(BigInt(process.env.GITHUB_RUN_ID).toString(36))")
          pnpm --filter e2e exec tsx scripts/cleanup-stores.ts --pattern "r${RUN_TOKEN}"

  type-diff:
    if: github.event.pull_request.head.repo.full_name == github.repository
    name: 'Type-diff'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
        name: Checkout [main]
        with:
          fetch-depth: 1
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: Build
        run: pnpm nx run-many --all --target=build --output-style=stream
      - name: Type-diff
        working-directory: workspace
        id: type-diff
        run: pnpm nx run type-diff
      - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
        if: steps.type-diff.outputs.report != ''
        with:
          header: Type-diff
          message: ${{ steps.type-diff.outputs.report }}
          recreate: true

  major-change-check:
    if: github.event.pull_request.head.repo.full_name == github.repository
    name: 'Breaking change detection'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    outputs:
      has_breaking_changes: ${{ steps.check.outputs.has_breaking_changes }}
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
          # Full history so `git merge-base origin/<base> HEAD` (used by
          # major-change-check.js) can reach the divergence point.
          fetch-depth: 0
      - name: Setup deps
        uses: ./.github/actions/setup-cli-deps
        with:
          node-version: ${{ env.DEFAULT_NODE_VERSION }}
      - name: Build
        run: pnpm nx run-many --all --target=build --output-style=stream
      - name: Check for breaking changes
        id: check
        run: node workspace/src/major-change-check.js
      - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
        if: steps.check.outputs.has_breaking_changes == 'true'
        with:
          header: Breaking-change-detection
          message: ${{ steps.check.outputs.report }}
          recreate: true
      - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
        if: steps.check.outputs.has_breaking_changes != 'true'
        with:
          header: Breaking-change-detection
          delete: true
      - name: Fail if breaking changes detected
        if: steps.check.outputs.has_breaking_changes == 'true'
        run: |
          echo '::error::Breaking changes detected. See the sticky comment on the PR for details.'
          exit 1