ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  secret-scan:
    name: Secret scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  backend-test:
    name: Backend tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: package-lock.json
      - run: npm ci
      - run: npm --workspace backend run check
      - run: npm --workspace backend run test:run
      - run: npm --workspace backend run test:migration-sql

  frontend-test:
    name: Frontend tests + build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: package-lock.json
      - run: npm ci
      - run: npm --workspace web run lint
      - run: npm --workspace web run test:run
      - run: npm --workspace web run build
        env:
          NEXT_PUBLIC_API_URL: http://localhost:8787
          NEXT_PUBLIC_CHAT_WORKER_URL: http://localhost:8788
          NEXT_PUBLIC_DEFAULT_LOCALE: it

  e2e-test:
    name: E2E tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: package-lock.json
      - run: npm ci
      - run: npx playwright install --with-deps chromium
      - name: Migrate local D1
        run: |
          rm -rf backend/.wrangler/e2e
          cat > backend/wrangler.toml <<'EOF'
          name = "menu-backend-e2e"
          main = "src/index.ts"
          compatibility_date = "2025-04-11"

          [vars]
          APP_ENV = "development"
          API_VERSION = "v1"
          SERVICE_NAME = "menu-backend"
          DEMO_MODE = "true"
          E2E_MODE = "true"

          [[d1_databases]]
          binding = "DB"
          database_name = "menu-db"
          database_id = "00000000-0000-0000-0000-000000000000"
          migrations_dir = "drizzle"
          EOF
          cd backend
          npx wrangler d1 migrations apply menu-db --local --persist-to .wrangler/e2e
      - name: Start backend and seed demo data
        run: |
          cd backend
          npx wrangler dev --port 8787 --persist-to .wrangler/e2e > ../backend-e2e.log 2>&1 &
          echo $! > ../backend-e2e.pid
          for i in {1..60}; do
            curl -fsS http://localhost:8787/ready && break
            sleep 1
          done
          curl -fsS -X POST http://localhost:8787/admin/demo/reset
          curl -fsS http://localhost:8787/catalog | node -e "let s='';process.stdin.on('data',c=>s+=c).on('end',()=>{const c=JSON.parse(s); const entries=c.categories.flatMap(x=>x.entries); if (!entries.length) throw new Error('seed produced no entries'); console.log(`seeded ${entries.length} entries`)})"
      - name: Run Playwright E2E (full non-live suite)
        # Mocked chat worker specs live outside web/e2e. The non-live e2e suite
        # runs against the real DEMO_MODE backend only; chat-live covers the real
        # chat worker path separately.
        run: npm --workspace web run test:e2e -- --project=chromium --workers=1
        env:
          NEXT_PUBLIC_API_URL: http://localhost:8787
          NEXT_PUBLIC_CHAT_WORKER_URL: http://localhost:8788
          NEXT_PUBLIC_DEFAULT_LOCALE: it
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: playwright-report
          path: web/playwright-report/
          if-no-files-found: ignore
      - name: Show backend log on failure
        if: failure()
        run: cat backend-e2e.log || true

  demo-frontend-build:
    name: Demo frontend build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: package-lock.json
      - run: npm ci
      - run: npm --workspace web run build:cf
        env:
          NEXT_PUBLIC_API_URL: https://api.tonymenu.app
          NEXT_PUBLIC_CHAT_WORKER_URL: https://risto-menu-demo-chat.vekexasia.workers.dev
          NEXT_PUBLIC_DEFAULT_LOCALE: en
      - name: Assert demo build has Tony and no private chat URL
        run: |
          grep -R "https://risto-menu-demo-chat.vekexasia.workers.dev" web/out/_next/static
          ! grep -R "http://localhost\|http://127\.0\.0\.1\|:8787\|:8788" web/out/_next/static
          grep -R "Tony" web/out/_next/static

  chat-test:
    name: Chat worker tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web/workers/chat
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: web/workers/chat/package-lock.json
      - run: npm ci
      - run: npm run test:run

  website-build:
    name: Website build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: website
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: website/package-lock.json
      - run: npm ci
      - run: npm run build