ci.yml

name: ci

on:
  pull_request:
  merge_group:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  full-pr:
    # Fork PRs execute untrusted repository code. Keep them off Depot runners,
    # which inject DEPOT_CACHE_TOKEN independently of GitHub secret filtering.
    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || 'depot-ubuntu-24.04-16' }}
    timeout-minutes: 120
    permissions:
      contents: read
      # Required to mint the OIDC token for Workload Identity Federation when
      # authenticating to the Spanner test instance (trusted runs only).
      id-token: write
    env:
      # Moon marks failed tasks by color alone, so a failed `moon ci` can end at
      # "Tasks: 1 failed" with no named target. The summary names them in plain
      # text and replays each failed task's own output. Green runs pay only a
      # pass/fail list; the replay section is empty when nothing failed.
      MOON_SUMMARY: detailed
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: moonrepo/setup-toolchain@v0

      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - uses: pnpm/action-setup@v5
        with:
          run_install: false

      - uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          cache: pnpm

      - name: Install dependencies
        run: corepack pnpm install --frozen-lockfile

      - name: Detect CI mode
        id: ci-mode
        run: node scripts/ci-mode.mjs "${{ github.event.pull_request.base.sha || 'origin/main' }}"

      - name: Check Go generated files
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: moon run server:check-generate

      - name: Cache Playwright browsers
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        uses: actions/cache@v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install Playwright Chromium
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: corepack pnpm --filter @zitadel/components exec playwright install chromium

      - name: Run Moon build and test graph
        id: moon-ci
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: moon ci :lint :typecheck :build :test :test-browser

      - name: Report Moon CI failures
        if: ${{ failure() && steps.moon-ci.conclusion == 'failure' }}
        run: node scripts/report-moon-failures.mjs

      - name: Run Go tests
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: moon run server:test

      - name: Run Go integration tests (postgres)
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: moon run server:test-postgres

      # Auth when SPANNER_TEST_INSTANCE is set (trusted runs). Vars are safe in
      # if:; secrets stay only in with:. Unset var / forks → emulator step.
      # Auth hard-fails if the var is set but WIF is broken (no silent fallback).
      - name: Authenticate to Google Cloud (Spanner test instance)
        id: spanner-auth
        if: ${{ steps.ci-mode.outputs.mode == 'full' && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) && vars.SPANNER_TEST_INSTANCE != '' }}
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Run Go integration tests (spanner emulator)
        if: ${{ steps.ci-mode.outputs.mode == 'full' && steps.spanner-auth.outcome != 'success' }}
        run: moon run server:test-spanner

      - name: Run Go integration tests (spanner test instance)
        if: ${{ steps.ci-mode.outputs.mode == 'full' && steps.spanner-auth.outcome == 'success' }}
        env:
          ZITADEL_TEST_SPANNER_INSTANCE: ${{ vars.SPANNER_TEST_INSTANCE }}
        run: moon run server:test-spanner

      - name: Build release snapshot without container
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: env -u CI -u GITHUB_ACTIONS moon run release:snapshot -- --skip-container

      - name: Run binary fresh-app journey
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: |
          version="$(node -p "require('./apps/server/package.json').version")"
          env -u CI -u GITHUB_ACTIONS moon run cli-journey-e2e:e2e-local -- \
            --runtime binary \
            --concurrency 5 \
            --work-dir "${RUNNER_TEMP}/ci-journey" \
            --tarballs-dir "dist/release/${version}/npm"

      # One framework is enough here: the preset decides the scaffolded
      # flow shape, not the SDK — the matrix above already covers SDKs.
      - name: Run passkey-first preset journey
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: |
          version="$(node -p "require('./apps/server/package.json').version")"
          env -u CI -u GITHUB_ACTIONS moon run cli-journey-e2e:e2e-local -- \
            --runtime binary \
            --framework next \
            --preset passkey-first \
            --work-dir "${RUNNER_TEMP}/ci-journey-passkey-first" \
            --tarballs-dir "dist/release/${version}/npm"

      # Gates the test-kit's central promise: boot a real seeded instance,
      # then drive the real browser login with per-test users. Reuses the Go
      # build cache and Playwright Chromium installed above.
      - name: Run @zitadel/testing real-instance suites
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: env -u CI -u GITHUB_ACTIONS moon run testing:test-integration demo-next-e2e:e2e-real

      # Dogfoods @zitadel/testing through a second consumer. Keep this separate
      # from the demo suite so two embedded-Postgres instances do not contend.
      - name: Run console real-instance suite
        if: ${{ steps.ci-mode.outputs.mode == 'full' }}
        run: env -u CI -u GITHUB_ACTIONS moon run console-e2e:e2e-real

      - name: Validate version PR
        if: ${{ steps.ci-mode.outputs.mode == 'version-only' }}
        run: env -u CI -u GITHUB_ACTIONS moon run release:version

      - name: Pack version PR artifacts
        if: ${{ steps.ci-mode.outputs.mode == 'version-only' }}
        run: env -u CI -u GITHUB_ACTIONS moon run release:pack

      - name: Verify version PR tarballs
        if: ${{ steps.ci-mode.outputs.mode == 'version-only' }}
        run: |
          version="$(node -p "require('./apps/server/package.json').version")"
          node apps/cli-journey-e2e/scripts/verify-tarballs.mjs "dist/release/${version}/npm"

      - name: Upload release snapshot
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: release-snapshot
          path: dist/release
          if-no-files-found: ignore
          retention-days: 7

      - name: Upload journey diagnostics
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: journey-diagnostics
          path: |
            ${{ runner.temp }}/ci-journey/diagnostics
            ${{ runner.temp }}/ci-journey-passkey-first/diagnostics
          if-no-files-found: ignore
          retention-days: 7

      # The handshake is deliberately excluded: it carries the project secret.
      - name: Upload console e2e diagnostics
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: console-e2e-diagnostics
          path: |
            apps/console-e2e/test-results
            apps/console-e2e/playwright-report
          if-no-files-found: ignore
          retention-days: 7