ci.yml

name: CI
on:
  push:
    branches:
      # Runs on merge to main only
      - main
  pull_request:

# Needed for nx-set-shas when run on the main branch
permissions:
  actions: read
  contents: read

jobs:
  main:
    runs-on: ubuntu-latest
    # Pushes to `main` get the read-write Nx Cloud token so the remote
    # cache is populated; everything else (PRs, other branches) gets the
    # read-only token, which is safe to expose. Both tokens live as
    # repository secrets — we intentionally avoid GitHub Environments
    # here because they register every run as a "deployment" in the UI.
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') && secrets.NX_CLOUD_ACCESS_TOKEN_RW || secrets.NX_CLOUD_ACCESS_TOKEN_RO }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          # For pull_request events, check out the PR head (not GitHub's auto-created
          # merge commit). This prevents 3-way merge from re-introducing deps that
          # the PR is supposed to remove. nrwl/nx-set-shas still computes the correct
          # affected range from git history. Falls back to github.sha for push events.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.2.9
      # This line enables distribution
      # The "--stop-agents-after" is optional, but allows idle agents to shut down once the "e2e-ci" targets have been requested
      # - run: npx nx-cloud start-ci-run --distribute-on="3 linux-medium-js" --stop-agents-after="e2e-ci"
      - run: bun install

      - uses: nrwl/nx-set-shas@v4

      - name: Test tool-call hook scripts
        run: bash .github/hooks/scripts/test-hooks.sh
        shell: bash
      - name: Print Environment Info
        run: npx nx report
        shell: bash
      - run: npx nx format:check
      - run: npx nx affected -t lint test build e2e-ci --verbose=false --parallel=3
      - run: npx nx-cloud fix-ci
        if: always()