# CI: every pull request and every push to main must pass these checks
# (ADR 0014). The deploy pipeline (CD) lives in cd.yml and only runs on
# main after this workflow's quality bar.
#
# Runner requirements: an act_runner with the `ubuntu-latest` label and
# Docker access (see deploy/stages.md, issue #9).

name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  checks:
    name: Lint, typecheck, test
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17.5-alpine
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: test
    env:
      # Enables the database-backed test suites (vitest.global-setup.ts).
      TEST_DATABASE_URL: postgresql://test:test@postgres:5432/test
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Build first: package type checks resolve @dorfteich/shared through
      # its built dist, and i18n:check imports the built helpers.
      - name: Build all packages
        run: pnpm build

      - name: Lint (ESLint + Prettier)
        run: pnpm lint

      - name: Typecheck
        run: pnpm typecheck

      - name: Unit and integration tests
        run: pnpm test

      - name: Translation key parity (de/en)
        run: pnpm i18n:check

  auth-e2e:
    name: Auth e2e pack
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17.5-alpine
        env:
          POSTGRES_USER: e2e
          POSTGRES_PASSWORD: e2e
          POSTGRES_DB: e2e
      mailpit:
        image: axllent/mailpit:latest
    env:
      DATABASE_URL: postgresql://e2e:e2e@postgres:5432/e2e
      APP_BASE_URL: http://localhost:5173
      SMTP_HOST: mailpit
      SMTP_PORT: '1025'
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build packages
        run: pnpm build

      - name: Apply migrations
        run: pnpm --filter @dorfteich/api exec prisma migrate deploy

      - name: Seed fixtures
        run: pnpm --filter @dorfteich/api db:seed

      - name: Start api and web dev server
        run: |
          (cd apps/api && PORT=3001 node dist/main.js &)
          (pnpm --filter @dorfteich/web dev -- --host --port 5173 --strictPort &)
          for i in $(seq 1 30); do
            curl -sf http://localhost:3001/api/v1/readyz >/dev/null && break
            sleep 2
          done
          curl -sf http://localhost:5173/ >/dev/null

      - name: Install Playwright browser
        run: pnpm --filter @dorfteich/web exec playwright install --with-deps chromium

      - name: Run auth pack
        run: |
          E2E_BASE_URL=http://localhost:5173 E2E_MAILPIT_URL=http://mailpit:8025 \
            pnpm --filter @dorfteich/web exec playwright test e2e/auth.spec.ts

  images:
    name: Build container images
    # PR-only: on main the CD workflow builds and pushes the same images —
    # building twice would waste the runner (ADR 0014: build once, promote).
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      # PRs prove the Dockerfiles still build; pushing happens in cd.yml.
      - name: Build web image
        run: docker build -f apps/web/Dockerfile --build-arg APP_VERSION=${{ github.sha }} -t dorfteich-web:ci .

      - name: Build api image
        run: docker build -f apps/api/Dockerfile --build-arg APP_VERSION=${{ github.sha }} -t dorfteich-api:ci .