feat(integrations): Stripe native integration + general integration framework #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, development] | |
| pull_request: | |
| branches: [main, development] | |
| workflow_call: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Least privilege for GITHUB_TOKEN: every job here only checks out code and runs | |
| # tests/builds — none push, comment, or release. Set at the workflow level so all | |
| # jobs (and any workflow_call consumer) inherit read-only access. | |
| permissions: | |
| contents: read | |
| env: | |
| NODE_VERSION: "24" | |
| PNPM_VERSION: "10.26.1" | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm lint | |
| type-check: | |
| name: Type Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm type-check | |
| # Fast web unit tests — the `unit` vitest project carries NO DB setup, so it | |
| # skips the per-file PGLite migrate that the `db` project pays. Sharded across | |
| # parallel runners (the suite is ~427 files); see apps/web/vitest.config.mts | |
| # for the unit/db partition. | |
| test-unit: | |
| name: Unit Tests (shard ${{ matrix.shard }}/4) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3, 4] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Run web unit tests (no DB) — shard ${{ matrix.shard }}/4 | |
| run: pnpm --filter @burnless/web exec vitest run --project=unit --shard=${{ matrix.shard }}/4 | |
| # DB-backed integration tests (the ~30 web `db`-project files that spin up | |
| # PGLite) plus the pure-TS engine suite. Kept off the unit shards so the | |
| # PGLite-migrate cost is paid by these files only. | |
| test-integration: | |
| name: Integration Tests (engine + web DB) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Run engine tests | |
| run: pnpm --filter @burnless/engine test | |
| - name: Run web DB-integration tests | |
| run: pnpm --filter @burnless/web exec vitest run --project=db | |
| npm-package: | |
| name: NPM Package Smoke | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| # `burnless` is the only public npm package and is fully tsup-bundled, so it must | |
| # ship with zero runtime deps. This packs it and clean-installs the tarball outside | |
| # the workspace — catching any reintroduced workspace:/file: dep before publish. | |
| # (burnless@0.1.0 shipped broken this way; verify-fat-artifact covers only the | |
| # curl|sh / GitHub-Releases path, not the npm-package path.) | |
| - name: Verify burnless npm package installs cleanly | |
| run: bash scripts/verify-npm-package.sh | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| needs: [lint, type-check, test-unit, test-integration] | |
| env: | |
| # Stub env vars required by Next.js build (not real secrets) | |
| DATABASE_URL: "postgresql://stub:stub@localhost:5432/stub" | |
| NEXTAUTH_SECRET: "ci-build-stub-secret-not-real" | |
| NEXTAUTH_URL: "http://localhost:3000" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| # NOTE: E2E tests are NOT part of CI (the full suite runs ~1h). They live in a | |
| # separate manual workflow — .github/workflows/e2e.yml (workflow_dispatch) — run | |
| # it on demand against a chosen branch. | |
| db-migrate-check: | |
| name: DB Migration Check | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: burnless_migrate_check | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| env: | |
| DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/burnless_migrate_check" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Verify schema push succeeds | |
| run: pnpm db:push | |
| - name: Check for uncommitted schema changes | |
| run: | | |
| pnpm --filter @burnless/db db:generate | |
| if [ -n "$(git status --porcelain packages/db)" ]; then | |
| echo "::error::Uncommitted schema changes detected. Run 'pnpm db:generate' locally and commit the results." | |
| git diff packages/db | |
| exit 1 | |
| fi |