ci.yml

# Layer 3 — reusable workflow. References Layer 2b (setup-and-install)
# + Layer 1 (run-script). When this file bumps, the merge SHA becomes
# the PROPAGATION SHA: Layer 4 (`_local-not-for-reuse-ci.yml`) pins to
# it, and external repos pin their `uses: ...ci.yml@<sha>` refs to it.
# See updating-workflows skill at .claude/skills/updating-workflows/.

name: 🔗 CI

# CI orchestrator that runs checks and tests.
#
# By default runs `pnpm run check --all` (lint + type) as a single job.
# Set `run-check: false` and enable `run-lint`/`run-type-check` to split them.
#
# Dependencies:
#   - SocketDev/socket-registry/.github/actions/setup-and-install
#   - SocketDev/socket-registry/.github/actions/run-script

on:
  workflow_call:
    inputs:
      check-node-version:
        description: 'Node.js version for checks'
        required: false
        type: string
        default: '26.3.0'
      check-script:
        description: 'Check command — runs lint + type checks (e.g., "pnpm run check --all")'
        required: false
        type: string
        default: 'pnpm run check --all'
      check-setup-script:
        description: 'Setup script before checks'
        required: false
        type: string
        default: ''
      check-timeout-minutes:
        description: 'Timeout for check job in minutes'
        required: false
        type: number
        default: 10
      debug:
        description: 'Enable debug output (e.g., "1" for verbose logging)'
        required: false
        type: string
        default: '0'
      fail-fast:
        description: 'Cancel all matrix jobs if one fails'
        required: false
        type: boolean
        default: false
      lint-node-version:
        description: 'Node.js version for linting'
        required: false
        type: string
        default: '26.3.0'
      lint-script:
        description: 'Lint command (e.g., "pnpm run lint --all")'
        required: false
        type: string
        default: 'pnpm run lint --all'
      lint-setup-script:
        description: 'Setup script before linting'
        required: false
        type: string
        default: ''
      lint-timeout-minutes:
        description: 'Timeout for lint job in minutes'
        required: false
        type: number
        default: 10
      max-parallel:
        description: 'Maximum parallel test jobs'
        required: false
        type: number
        default: 4
      node-versions:
        description: 'Node.js versions for testing (e.g., ''["22", "24"]'')'
        required: false
        type: string
        default: '["26.3.0"]'
      os-versions:
        description: 'Operating systems for testing (e.g., ''["ubuntu-latest", "windows-latest"]'')'
        required: false
        type: string
        default: '["ubuntu-latest", "macos-latest", "windows-latest"]'
      run-check:
        description: 'Include combined check job (lint + type)'
        required: false
        type: boolean
        default: true
      run-lint:
        description: 'Include standalone lint job'
        required: false
        type: boolean
        default: false
      run-test:
        description: 'Include test matrix job'
        required: false
        type: boolean
        default: true
      setup-go:
        description: |
          Run setup-go-toolchain after install. Required for repos whose
          test/build steps invoke `go` on macOS/Windows (where the
          toolcache go is not always on PATH after sfw setup).
        required: false
        type: boolean
        default: false
      setup-go-version:
        description: 'Major.minor Go version to ensure when setup-go is true'
        required: false
        type: string
        default: ''
      run-type-check:
        description: 'Include standalone type check job'
        required: false
        type: boolean
        default: false
      test-script:
        description: 'Test command (e.g., "pnpm test")'
        required: false
        type: string
        default: 'pnpm test'
      test-setup-script:
        description: 'Setup script before tests (e.g., "pnpm run build")'
        required: false
        type: string
        default: 'pnpm run build'
      test-timeout-minutes:
        description: 'Timeout for test jobs in minutes'
        required: false
        type: number
        default: 15
      type-check-node-version:
        description: 'Node.js version for type checking'
        required: false
        type: string
        default: '26.3.0'
      type-check-script:
        description: 'Type check command (e.g., "pnpm run type")'
        required: false
        type: string
        default: 'pnpm run type'
      type-check-setup-script:
        description: 'Setup script before type checking'
        required: false
        type: string
        default: ''
      type-check-timeout-minutes:
        description: 'Timeout for type check job in minutes'
        required: false
        type: number
        default: 10
      working-directory:
        description: 'Working directory (e.g., "packages/core" for monorepos)'
        required: false
        type: string
        default: '.'
    secrets:
      SOCKET_API_TOKEN:
        description: 'Socket API token — when provided, uses sfw-enterprise instead of sfw-free'
        required: false
      SOCKET_API_KEY:
        description: 'DEPRECATED alias of SOCKET_API_TOKEN. Pass `SOCKET_API_TOKEN:` instead. Tracked for one cycle so existing callers keep working.'
        required: false

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  check:
    if: inputs.run-check
    name: 🔎 Check
    runs-on: ubuntu-latest
    timeout-minutes: ${{ inputs.check-timeout-minutes }}
    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b3f42a5f19c0a3854a67a8387c97ed0bb77caa00 # main (2026-06-09)
        with:
          debug: ${{ inputs.debug }}
          node-version: ${{ inputs.check-node-version }}
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN || secrets.SOCKET_API_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - uses: SocketDev/socket-registry/.github/actions/run-script@22a88d13cd3f33072db2b9ce948e9d9f137a7e88 # main (2026-05-28)
        with:
          main-script: ${{ inputs.check-script }}
          setup-script: ${{ inputs.check-setup-script }}
          working-directory: ${{ inputs.working-directory }}

  lint:
    if: inputs.run-lint
    name: 🧹 Lint
    runs-on: ubuntu-latest
    timeout-minutes: ${{ inputs.lint-timeout-minutes }}
    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b3f42a5f19c0a3854a67a8387c97ed0bb77caa00 # main (2026-06-09)
        with:
          debug: ${{ inputs.debug }}
          node-version: ${{ inputs.lint-node-version }}
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN || secrets.SOCKET_API_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - uses: SocketDev/socket-registry/.github/actions/run-script@22a88d13cd3f33072db2b9ce948e9d9f137a7e88 # main (2026-05-28)
        with:
          main-script: ${{ inputs.lint-script }}
          setup-script: ${{ inputs.lint-setup-script }}
          working-directory: ${{ inputs.working-directory }}

  type-check:
    if: inputs.run-type-check
    name: 🏷️ Type Check
    runs-on: ubuntu-latest
    timeout-minutes: ${{ inputs.type-check-timeout-minutes }}
    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b3f42a5f19c0a3854a67a8387c97ed0bb77caa00 # main (2026-06-09)
        with:
          debug: ${{ inputs.debug }}
          node-version: ${{ inputs.type-check-node-version }}
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN || secrets.SOCKET_API_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - uses: SocketDev/socket-registry/.github/actions/run-script@22a88d13cd3f33072db2b9ce948e9d9f137a7e88 # main (2026-05-28)
        with:
          main-script: ${{ inputs.type-check-script }}
          setup-script: ${{ inputs.type-check-setup-script }}
          working-directory: ${{ inputs.working-directory }}

  test:
    if: inputs.run-test
    name: 🧪 Test Matrix
    strategy:
      fail-fast: ${{ inputs.fail-fast }}
      max-parallel: ${{ inputs.max-parallel }}
      matrix:
        node-version: ${{ fromJson(inputs.node-versions) }}
        os: ${{ fromJson(inputs.os-versions) }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: ${{ inputs.test-timeout-minutes }}
    steps:
      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b3f42a5f19c0a3854a67a8387c97ed0bb77caa00 # main (2026-06-09)
        with:
          debug: ${{ inputs.debug }}
          node-version: ${{ matrix.node-version }}
          setup-go: ${{ inputs.setup-go && 'true' || 'false' }}
          setup-go-version: ${{ inputs.setup-go-version }}
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN || secrets.SOCKET_API_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - uses: SocketDev/socket-registry/.github/actions/run-script@22a88d13cd3f33072db2b9ce948e9d9f137a7e88 # main (2026-05-28)
        with:
          main-script: ${{ inputs.test-script }}
          setup-script: ${{ inputs.test-setup-script }}
          working-directory: ${{ inputs.working-directory }}