apps-api-ci.yml

name: CI

on:
  push:
    branches: [main]
    paths:
      - "apps/api/**"
      - ".github/workflows/apps-api-ci.yml"
  pull_request:
    branches: [main]

# Cancel in-flight runs of the same ref on a new push.
concurrency:
  group: apps-api-ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  validate:
    name: typecheck + lint + test
    defaults:
      run:
        working-directory: apps/api
    runs-on: ubuntu-24.04
    timeout-minutes: 10

    services:
      # Mirrors `docker-compose.yml` so the integration tests under
      # tests/api/** can hit a real Postgres rather than skipping. The
      # password matches `.env.example` for parity with local dev.
      postgres:
        image: postgres:17-alpine@sha256:979c4379dd698aba0b890599a6104e082035f98ef31d9b9291ec22f2b13059ca
        env:
          POSTGRES_DB: app
          POSTGRES_USER: app
          POSTGRES_PASSWORD: app_dev_password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U app -d app"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10

      valkey:
        image: valkey/valkey:8-alpine@sha256:77643d152547b446fc15cbafaff22004545663fcd40c6b28038ad283837baa75
        ports:
          - 6379:6379
        options: >-
          --health-cmd "valkey-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10

    env:
      # Same values used by the test runtime locally. JWT_SECRET is the
      # 32+ char placeholder env.ts already accepts in test mode; never
      # commit a real secret here.
      NODE_ENV: test
      DATABASE_URL: postgresql://app:app_dev_password@localhost:5432/app
      JWT_SECRET: ci-only-jwt-secret-padded-to-thirty-two-chars
      FRONTEND_URL: http://localhost:7331
      ALLOWED_ORIGINS: http://localhost:7331
      APP_NAME: API Template
      LOG_LEVEL: error
      # Use `resend` without a key so `buildEmailService()` picks
      # `NoopEmailService` (see email.service.utils). A non-empty fake key
      # would construct `ResendEmailService` and call the real API, which
      # fails and breaks notification email-channel tests that expect `sent`.
      EMAIL_PROVIDER: resend
      RESEND_API_KEY: ""
      EMAIL_FROM: noreply@example.com
      VALKEY_HOST: localhost
      VALKEY_PORT: "6379"

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Detect relevant changes
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            code:
              - 'apps/api/**'
              - '.github/workflows/apps-api-ci.yml'

      - name: Set up Bun
        if: steps.filter.outputs.code == 'true'
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Cache bun install
        if: steps.filter.outputs.code == 'true'
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('apps/api/bun.lock') }}
          restore-keys: |
            bun-${{ runner.os }}-

      - name: Install dependencies
        if: steps.filter.outputs.code == 'true'
        run: bun install --frozen-lockfile

      - name: Apply DB migrations
        if: steps.filter.outputs.code == 'true'
        # `db:migrate` applies the committed migrations in drizzle/ —
        # non-interactive, deterministic, and creates every schema
        # (auth / billing / app / audit) the test suite expects.
        # `db:push` is dev-only and prompts on a TTY, which CI doesn't have.
        run: bun run db:migrate

      - name: Build email templates
        if: steps.filter.outputs.code == 'true'
        run: bun run build:templates

      - name: Typecheck + lint
        if: steps.filter.outputs.code == 'true'
        run: bun run check

      - name: Tests
        if: steps.filter.outputs.code == 'true'
        env:
          REQUIRE_INTEGRATION_DB: "true"
        run: bun run test

      - name: Test coverage report
        if: steps.filter.outputs.code == 'true'
        env:
          REQUIRE_INTEGRATION_DB: "true"
        run: bun run test:coverage

      - name: Upload coverage to Codecov
        if: steps.filter.outputs.code == 'true'
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          files: apps/api/coverage/lcov.info
          flags: api
          name: api-coverage
          fail_ci_if_error: false
          # CODECOV_TOKEN is required for private repos; for public repos
          # uploads work tokenless.
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Production bundle
        if: steps.filter.outputs.code == 'true'
        run: bun build src/index.ts --outdir dist --target bun