ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_call:

# Cancel an older CI run on the same ref when a newer one is pushed.
# `release.yml` keeps cancel-in-progress: false because it must finish, but
# CI-only runs are safe (and helpful) to cancel — otherwise stale runs hold
# runner slots and an `aube ci` from a previous commit can race with the new
# install that just landed in the fresh checkout.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint-and-format:
    name: Lint and Format Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup mise
        uses: jdx/mise-action@v2
        with:
          experimental: true

      - name: Resolve aube store path
        shell: bash
        run: echo "AUBE_STORE=$(aube store path 2>/dev/null || echo $HOME/.local/share/aube/store)" >> "$GITHUB_ENV"

      - name: Setup aube cache
        uses: actions/cache@v4
        with:
          path: ${{ env.AUBE_STORE }}
          key: ${{ runner.os }}-aube-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-aube-store-

      - name: Install dependencies
        run: aube ci

      - name: Run Biome check
        # Use `aube run check` explicitly: bare `aube check` resolves to aube's
        # built-in dependency-tree verifier (`Verify that every installed package
        # can resolve its declared deps...`), not our biome script.
        run: aube run check

  type-check:
    name: TypeScript Type Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup mise
        uses: jdx/mise-action@v2
        with:
          experimental: true

      - name: Resolve aube store path
        shell: bash
        run: echo "AUBE_STORE=$(aube store path 2>/dev/null || echo $HOME/.local/share/aube/store)" >> "$GITHUB_ENV"

      - name: Setup aube cache
        uses: actions/cache@v4
        with:
          path: ${{ env.AUBE_STORE }}
          key: ${{ runner.os }}-aube-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-aube-store-

      - name: Install dependencies
        run: aube ci

      - name: Type check
        run: aube type-check

  test:
    name: Unit and Integration Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
          extensions: pdo, pdo_pgsql, curl
          coverage: none

      - name: Setup mise
        uses: jdx/mise-action@v2
        with:
          experimental: true

      - name: Resolve aube store path
        shell: bash
        run: echo "AUBE_STORE=$(aube store path 2>/dev/null || echo $HOME/.local/share/aube/store)" >> "$GITHUB_ENV"

      - name: Setup aube cache
        uses: actions/cache@v4
        with:
          path: ${{ env.AUBE_STORE }}
          key: ${{ runner.os }}-aube-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-aube-store-

      - name: Install dependencies
        run: aube ci

      - name: Install PHP dependencies
        run: composer install --no-interaction --prefer-dist --no-progress
        working-directory: apps/sabredav

      - name: Run unit and integration tests
        env:
          NODE_ENV: test
        run: aube test

  danger:
    name: Danger PR Checks
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      statuses: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup mise
        uses: jdx/mise-action@v2
        with:
          experimental: true

      - name: Resolve aube store path
        shell: bash
        run: echo "AUBE_STORE=$(aube store path 2>/dev/null || echo $HOME/.local/share/aube/store)" >> "$GITHUB_ENV"

      - name: Setup aube cache
        uses: actions/cache@v4
        with:
          path: ${{ env.AUBE_STORE }}
          key: ${{ runner.os }}-aube-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-aube-store-

      - name: Install dependencies
        run: aube ci

      - name: Run Danger
        run: npx danger ci
        env:
          DANGER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build:
    name: Build Verification
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup mise
        uses: jdx/mise-action@v2
        with:
          experimental: true

      - name: Resolve aube store path
        shell: bash
        run: echo "AUBE_STORE=$(aube store path 2>/dev/null || echo $HOME/.local/share/aube/store)" >> "$GITHUB_ENV"

      - name: Setup aube cache
        uses: actions/cache@v4
        with:
          path: ${{ env.AUBE_STORE }}
          key: ${{ runner.os }}-aube-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-aube-store-

      - name: Install dependencies
        run: aube ci

      - name: Build all workspaces
        run: aube build

  docker-smoke:
    name: Docker Build Smoke Test
    # PR-only: pushes to main go through the release workflow, which builds and
    # publishes the real multi-arch images. This is a fast amd64 build that
    # catches Dockerfile/toolchain breakage (e.g. the aube/mise install) before
    # merge, then verifies native modules actually load at runtime.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build backend image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.backend.prod
          target: backend
          load: true
          tags: freundebuch-backend:ci
          platforms: linux/amd64
          cache-from: type=gha,scope=ci-backend-prod
          cache-to: type=gha,mode=max,scope=ci-backend-prod

      - name: Build mcp-server image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.backend.prod
          target: mcp-server
          load: true
          tags: freundebuch-mcp-server:ci
          platforms: linux/amd64
          # Shares the builder layers with the backend build above.
          cache-from: type=gha,scope=ci-backend-prod
          cache-to: type=gha,mode=max,scope=ci-backend-prod

      - name: Build nginx image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.nginx.prod
          load: true
          tags: freundebuch-nginx:ci
          platforms: linux/amd64
          cache-from: type=gha,scope=ci-nginx
          cache-to: type=gha,mode=max,scope=ci-nginx

      - name: Smoke test images
        run: |
          # Resolve modules from each app's own directory: in the pnpm/aube
          # workspace layout a package's deps live under apps/<name>/node_modules
          # (symlinked to the virtual store), not the repo-root node_modules. This
          # matches how the real CMD (node apps/<name>/dist/index.js) resolves them.
          docker run --rm -w /app/apps/backend freundebuch-backend:ci node -e "require('bcrypt'); require('sharp');"
          docker run --rm -w /app/apps/mcp-server freundebuch-mcp-server:ci node -e "require('bcrypt');"
          # Frontend build produced static assets served by nginx.
          docker run --rm freundebuch-nginx:ci test -f /app/frontend/index.html
          echo "Docker smoke tests passed"