ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

# Public repository -> GitHub-hosted ubuntu-latest runners (free, unlimited Actions minutes) deploying to GitHub Pages. No self-hosted fleet needed.

jobs:
  commitlint:
    name: Commitlint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Validate the last commit with commitlint
        if: github.event_name == 'push'
        run: pnpm exec commitlint --last --verbose
      - name: Validate every PR commit with commitlint
        if: github.event_name == 'pull_request'
        run: pnpm exec commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-and-run
        with:
          task: lint
          command: pnpm lint

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-and-run
        with:
          task: typecheck
          command: pnpm typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-and-run
        with:
          task: test
          command: pnpm test:coverage
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage-report
          path: coverage/

  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-and-run
        with:
          task: build
          command: pnpm build

  release:
    name: Release
    needs: [commitlint, lint, typecheck, test, build]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
      issues: write
    steps:
      # main requires status checks to merge, and the default GITHUB_TOKEN has no bypass for that -- @semantic-release/git's own push of the release commit is a direct push to main, so it needs a token from an actor the branch ruleset explicitly allows to bypass (see ExaDev/.github and each repo's own ruleset). Everything else in this job (release notes, GitHub Release creation) keeps using secrets.GITHUB_TOKEN below, unaffected -- only checkout's own git credentials need the elevated token, since that's what the later `git push` inherits.
      - name: Generate a token for the release push
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: "4473709"
          private-key: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}
      - uses: actions/checkout@v7
        with:
          # semantic-release analyses the full commit history since the last release.
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}
      - uses: ./.github/actions/setup-and-run
        with:
          task: release
          # HUSKY=0 so local git hooks never fire during the CI release commit.
          command: HUSKY=0 pnpm release
          github-token: ${{ secrets.GITHUB_TOKEN }}

  build-and-deploy:
    name: Build and deploy to Pages
    # Build AFTER release so the deploy is built from the tagged release commit (semantic-release bumps package.json + tags on the chore(release) commit). For non-releasing commits release creates no new tag and the build just uses the latest commit on main.
    needs: [commitlint, lint, typecheck, test, build, release]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    concurrency:
      group: deploy-pages
      cancel-in-progress: false
    permissions:
      contents: read
      pages: write
      id-token: write
      actions: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 0
      - uses: ./.github/actions/setup-and-run
        with:
          task: build
          command: pnpm build
      - uses: actions/configure-pages@v6
        with:
          enablement: true
      # A failed deploy-pages step leaves this run's uploaded github-pages artifact behind; re-running would then try to upload a second one and fail ("Multiple artifacts named github-pages"). Clean up first.
      - name: Remove prior github-pages artifacts from this run
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
            --jq '.artifacts[] | select(.name=="github-pages") | .id' |
          while read -r id; do
            [ -z "$id" ] && continue
            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id"
          done
      - uses: actions/upload-pages-artifact@v5
        with:
          path: dist
      - id: deployment
        uses: actions/deploy-pages@v5