ci.yaml

name: test
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
  ci:
    name: Continuous Integration
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.27.1"
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24.21.0'
          cache: 'npm'
          cache-dependency-path: |
            ui/shared/package-lock.json
            ui/dashboard/package-lock.json
            ui/extension/package-lock.json
            ui/components-lib/package-lock.json
      - name: Install UI dependencies and build
        run: |
          make build-dashboard
          make build-extension
        env:
          # If this is a build for a push to main, set the codecov token.
          CODECOV_TOKEN: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && secrets.CODECOV_TOKEN || '' }}
      - name: UI Checks
        run: make lint-ui
      - name: Set up Python and venv for docs
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.14'
      - name: Create venv and install MkDocs requirements
        run: |
          python3 -m venv .venv
          . .venv/bin/activate
          pip install -r docs/requirements-hashed.txt --require-hashes
      - name: Lint Docs
        run: . .venv/bin/activate && make lint-docs
      - name: Get dependencies
        run: go mod download
      - name: Restore build output from cache
        id: cache-build
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: bin/manager
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/*.go', 'go.sum') }}
      - name: Verify web/static exists
        run: |
          if [ ! -d "ui/web/static" ]; then
            echo "Error: ui/web/static directory does not exist!"
            ls -la ui/web/
            exit 1
          fi
          echo "ui/web/static directory exists ✓"
      - name: Build
        if: steps.cache-build.outputs.cache-hit != 'true'
        run: make
      - name: Frontend Extension Unit Tests
        run: make test-unit-test-extension
      - name: Frontend Dashboard Unit Tests
        run: make test-ui-test-dashboard
      - name: Run Integration Tests
        run: make test-parallel
      - name: Fuzz replay (seeds f.Add + testdata/fuzz corpus; no exploratory fuzz)
        run: make fuzz-replay
      - name: Generate code coverage artifacts
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: code-coverage
          path: |
            cover.out
            ui/dashboard/coverage/lcov.info
            ui/extension/coverage/lcov.info
      - name: Upload code coverage information to codecov.io
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0
        with:
          # cover.out: Ginkgo (after make test-parallel). UI: Vitest lcov (repo-root SF: via lcov projectRoot).
          files: cover.out,ui/dashboard/coverage/lcov.info,ui/extension/coverage/lcov.info
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      - name: Upload test results to codecov.io
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0
        with:
          report_type: test_results
          token: ${{ secrets.CODECOV_TOKEN }}
  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.27.1"
      - name: Lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.14.0
          args: --timeout=5m
          skip-cache: false
          cache-invalidation-interval: 1 # day, default 7
  codegen:
    name: Check Codegen
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.27.1"
      - name: go mod tidy
        run: |
          go mod tidy
          for file in go.mod go.sum; do
            if ! diff=$(git diff --exit-code --unified=0 -- "$file"); then
              line=$(echo "$diff" | sed -nr 's/^@@ -([0-9]+).*/\1/p' | head -n 1 | tr -d '\n')
              echo "::error file=$file,line=$line::$file is out of date. Run 'go mod tidy' and commit the changes."
              exit 1
            fi
          done
      - name: make mockery-gen
        run: |
          make mockery-gen
          if ! git diff --exit-code -- internal/scms/mock/; then
            echo "::error ::Mocks are out of date. Run 'make mockery-gen' and commit the changes."
            exit 1
          fi
      - name: make build-installer
        run: |
          make build-installer
          if ! git diff --exit-code; then
            echo "::error ::Generated files are out of date. Run 'make build-installer' and commit the changes (CRDs, applyconfiguration, deepcopy, extension icon styles, hack/celcost/report.md, dist/ install bundles)."
            exit 1
          fi
      - name: make generate-apiserver
        run: |
          make generate-apiserver
          if ! git diff --exit-code -- api/view/v1alpha1/zz_generated.openapi.go api/view/v1alpha1/zz_generated.deepcopy.go api/view/v1alpha1/zz_generated.model_name.go; then
            echo "::error ::View APIService codegen is out of date. Run 'make generate-apiserver' and commit api/view/v1alpha1/zz_generated.*.go."
            exit 1
          fi
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: |
            ui/codegen/package-lock.json
            ui/shared/package-lock.json
      - name: make generate-ui-types
        run: |
          make generate-ui-types
          if ! git diff --exit-code -- ui/shared/src/types/generated/view.gen.ts; then
            echo "::error ::UI view API types are out of date. Run 'make generate-apiserver && make generate-ui-types' and commit ui/shared/src/types/generated/view.gen.ts."
            exit 1
          fi
  nilaway:
    name: Nilaway Static Analysis
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.27.1"
      - name: Run Nilaway
        run: make nilaway-no-test
  deadcode:
    name: Dead Code Analysis
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.27.1"
      - name: Run deadcode
        run: make deadcode