ci-pr-checks.yml

name: PR Checks

on:
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

# Disable Bun's automatic bunfig.toml loading from CWD. `bun run` invocations
# in this workflow run after checkout; without this, a malicious bunfig.toml
# at the checkout root would have its preload array execute arbitrary code
# before the intended script (RCE with workflow secrets).
env:
  BUN_CONFIG_FILE: /dev/null

jobs:
  # Pre-check job to detect automated PRs
  check-automated:
    name: Check Automated PR
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      is_automated: ${{ steps.check.outputs.is_automated }}
      category: ${{ steps.check.outputs.category }}
      skip_reason: ${{ steps.check.outputs.skip_reason }}
      # Skip CI for release/sync/action-update PRs, but NOT for dependency updates (which need testing)
      should_skip_ci: ${{ steps.check.outputs.is_automated == 'true' && steps.check.outputs.category != 'deps' }}
    steps:
      - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

      - name: Checkout repository (for composite action)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
          sparse-checkout-cone-mode: false

      - name: Check for automated PR
        id: check
        uses: ./.github/actions/check-automated-pr
        with:
          branch_name: ${{ github.head_ref }}
          pr_title: ${{ github.event.pull_request.title }}

  validate:
    name: Validate Installation & Build
    needs: check-automated
    # Skip for automated PRs except dependency updates (which should still run tests)
    if: ${{ needs.check-automated.outputs.should_skip_ci != 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      # Override nx.json defaultBase for PR target branch
      NX_BASE: origin/${{ github.base_ref }}
      NX_HEAD: HEAD

    steps:
      - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: ${{ vars.NODE_VERSION || '24' }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.3.12"

      - name: Verify bun.lock
        run: |
          echo "Checking if bun.lock is up to date..."
          bun install --frozen-lockfile
          if ! git diff --exit-code bun.lock; then
            echo "❌ bun.lock is out of sync!"
            echo "Please run 'bun install' and commit the updated bun.lock"
            exit 1
          fi
          echo "✅ bun.lock is up to date"

      - name: Clean install dependencies
        run: |
          echo "Running bun install to validate clean installation..."
          bun install --frozen-lockfile
          echo "✅ bun install completed successfully"

      - name: Build changed packages
        run: |
          echo "Building changed packages..."
          bunx nx affected --target=build --verbose
          echo "✅ Build(s) completed successfully"

      - name: Run linting
        run: |
          echo "Running linters..."
          bunx nx affected --target=lint --verbose
          echo "✅ Linting passed"

      - name: Check formatting
        run: |
          echo "Checking code formatting..."
          bunx nx affected --target=format --verbose
          echo "✅ Formatting check passed"

      - name: Run tests
        run: |
          echo "Running tests..."
          bunx nx affected --target=test --parallel=3 --coverage --verbose
          echo "✅ Tests passed"

  validate-plugins:
    name: Validate Plugins
    needs: check-automated
    # Skip for automated PRs except dependency updates (which should still run tests)
    if: ${{ needs.check-automated.outputs.should_skip_ci != 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: ${{ vars.NODE_VERSION || '24' }}

      - name: Validate all plugins
        uses: ./.github/actions/validate-plugins
        with:
          marketplace-path: '.claude-plugin/marketplace.json'
          fail-on-warning: 'false'

  # Summary job for automated PRs that were skipped
  skipped-summary:
    name: CI Skipped (Automated PR)
    needs: check-automated
    if: ${{ needs.check-automated.outputs.should_skip_ci == 'true' }}
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

      - name: Report skipped status
        env:
          SKIP_REASON: ${{ needs.check-automated.outputs.skip_reason }}
        run: |
          echo "::notice::CI checks skipped for automated PR: $SKIP_REASON"
          echo "✅ Automated PR detected - CI checks are not required for this PR type."