ci.yml

# Copyright (C) 2026 Dyne.org foundation
# Designed by Denis Roio <jaromil@dyne.org>
# SPDX-License-Identifier: AGPL-3.0-or-later

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  verify:
    name: Verify
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: npm
      - name: Install dependencies
        run: npm ci
      - name: Check formatting
        run: npm run format:check
      - name: Audit production dependencies
        run: npm run audit:prod
      - name: Install Playwright Chromium
        run: npx playwright install --with-deps chromium
      - name: Check source licenses
        run: npm run license:check
      - name: Check types and Svelte
        run: npm run check
      - name: Run tests
        run: npm test
      - name: Lint
        run: npm run lint
      - name: Build production application
        run: npm run build
      - name: Run browser tests
        run: npm run test:e2e
      - name: Upload failed Playwright traces
        if: failure() && hashFiles('test-results/**') != ''
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-traces
          path: test-results/
          retention-days: 3

  package-smoke:
    name: Package smoke
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: npm
      - name: Install dependencies
        run: npm ci
      - name: Test packed executable
        run: npm run test:package

  release:
    name: Release
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'dyne/gestalt-mobile'
    needs: [verify, package-smoke]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    concurrency:
      group: gestalt-mobile-main-release
      cancel-in-progress: false
    permissions:
      contents: write
      id-token: write
    env:
      GITHUB_TOKEN: ${{ github.token }}
    steps:
      - name: Check out verified main commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: Set up Node.js for npm
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: npm
          registry-url: https://registry.npmjs.org
      - name: Install dependencies
        run: npm ci
      - name: Verify package identity
        run: test "$(node --print "require('./package.json').name")" = "gestalt-mobile"
      - name: Inspect bootstrap state
        id: bootstrap
        run: node scripts/inspect-release.mjs bootstrap
      - name: Calculate conventional semantic version
        id: semver
        if: steps.bootstrap.outputs.mode == 'semver'
        uses: ietf-tools/semver-action@c90370b2958652d71c06a3484129a4d423a6d8a8 # v1.11.0
        with:
          token: ${{ github.token }}
          branch: main
          noNewCommitBehavior: silent
          noVersionBumpBehavior: silent
      - name: Find partial release repair target
        id: repair
        if: steps.bootstrap.outputs.target == '' && steps.semver.outputs.nextStrict == ''
        run: node scripts/inspect-release.mjs repair-target
      - name: Select target version
        id: target
        env:
          BOOTSTRAP_TARGET: ${{ steps.bootstrap.outputs.target }}
          SEMVER_TARGET: ${{ steps.semver.outputs.nextStrict }}
          REPAIR_TARGET: ${{ steps.repair.outputs.target }}
        run: |
          target="${BOOTSTRAP_TARGET:-${SEMVER_TARGET:-$REPAIR_TARGET}}"
          echo "version=$target" >> "$GITHUB_OUTPUT"
      - name: Apply release version
        if: steps.target.outputs.version != ''
        run: npm version "${{ steps.target.outputs.version }}" --no-git-tag-version --allow-same-version
      - name: Verify release payload
        if: steps.target.outputs.version != ''
        run: |
          npm run prepack
          npm pack --dry-run --json --ignore-scripts > "$RUNNER_TEMP/package-contents.json"
          node scripts/check-package-contents.mjs "$RUNNER_TEMP/package-contents.json"
          npm run test:package
      - name: Inspect target release state
        id: state
        if: steps.target.outputs.version != ''
        run: node scripts/inspect-release.mjs target "${{ steps.target.outputs.version }}"
      - name: Publish npm package
        if: steps.state.outputs.publish == 'true'
        run: |
          npm install -g npm@latest
          npm publish . --tag latest
      - name: Create and push exact release tag
        if: steps.state.outputs.tag == 'true'
        env:
          VERSION: ${{ steps.target.outputs.version }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag --annotate "v$VERSION" "$GITHUB_SHA" --message "Gestalt Mobile v$VERSION"
          git push origin "refs/tags/v$VERSION"
      - name: Create GitHub Release
        if: steps.state.outputs.release == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.target.outputs.version }}
        run: gh release create "v$VERSION" --target "$GITHUB_SHA" --generate-notes --latest