ci.yml

name: PR & Branch CI

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  regression:
    name: Lint, typecheck, regression
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Setup Node.js 22
        uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install deps
        run: npm ci

      - name: Check for UTF-8 BOMs
        # Git's eol normalisation does not strip BOMs and Biome does not flag
        # them; this guard fails the build on any BOM in a tracked text file.
        # See scripts/check-no-bom.sh and .editorconfig (charset = utf-8).
        run: npm run check:no-bom

      - name: Read pinned spec ref
        id: pin
        # The bundled-spec invariants are evaluated against a specific
        # upstream spec content. We fetch that ref so unrelated upstream
        # changes don't randomly fail PRs. See configs/camunda-oca/spec-pin.json
        # for the bump procedure (or configs/<config>/spec-pin.json once
        # the CONFIG matrix lands — see #128).
        run: |
          spec_ref=$(node -e "console.log(JSON.parse(require('fs').readFileSync('configs/camunda-oca/spec-pin.json','utf8')).specRef)")
          echo "spec_ref=${spec_ref}" >> "$GITHUB_OUTPUT"
          echo "Pinned spec ref: ${spec_ref}"

      - name: Lint (Biome)
        run: npm run lint

      - name: Typecheck (semantic-graph-extractor)
        run: npx tsc --noEmit -p semantic-graph-extractor/tsconfig.json

      - name: Typecheck (path-analyser)
        run: npx tsc --noEmit -p path-analyser/tsconfig.json

      - name: Build path-analyser (emit .d.ts for emitter-sdk + materializer typecheck)
        run: npm run build:analyser

      - name: Typecheck (emitter-sdk)
        run: npx tsc --noEmit -p emitter-sdk/tsconfig.json

      - name: Build emitter-sdk (emit .d.ts for materializer typecheck)
        run: npm run build -w @camunda8/emitter-sdk

      - name: Typecheck (materializer)
        run: npx tsc --noEmit -p materializer/tsconfig.json

      - name: Typecheck (request-validation)
        run: npx tsc --noEmit -p request-validation/tsconfig.json

      - name: Typecheck (tests)
        # The workspace tsconfigs only include `src` (and `scripts`),
        # so test files are not type-checked by them. Without this gate
        # bugs like the one in PR #114 — passing `{ maxPerField: 4 }`
        # to `generateConstraintViolations` whose Opts only accepts
        # `{ onlyOperations, capPerOperation }` — silently slip through
        # to review. (`maxPerField` is a valid key on a *different*
        # analyser, `generateBodyTypeMismatch`, which is what made the
        # mistake easy to miss in code review.) See tests/tsconfig.json
        # for the include set.
        run: npx tsc --noEmit -p tests/tsconfig.json

      - name: Fetch pinned OpenAPI spec
        env:
          SPEC_REF: ${{ steps.pin.outputs.spec_ref }}
        run: npm run fetch-spec:ref

      - name: Regenerate pipeline outputs
        env:
          # Match the seed used to capture the baseline so any pseudo-random
          # ordering / sampling in the generators is reproducible in CI.
          TEST_SEED: snapshot-baseline
        run: |
          npm run testsuite:generate
          npm run generate:request-validation

      - name: Lint generated test suites (Biome)
        # The generation pipeline runs biome --write --unsafe on the
        # emitted suites before this step (see biome:fix-generated). This
        # gate verifies that no diagnostics survived the autofix — any
        # residual error means the emitter regressed and produced output
        # biome cannot mechanically clean. See biome.generated.json for
        # the rules applied to generated output.
        run: npm run lint:generated

      - name: Run regression + unit tests
        run: npm test

      - name: Upload pipeline outputs on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: pipeline-outputs
          path: |
            generated
            spec
          if-no-files-found: warn
          retention-days: 7