ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test-api:
    name: Go tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.25"
          cache-dependency-path: api/go.sum

      - name: Run tests
        run: cd api && go test ./... -v -race

  test-web:
    name: Frontend tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Install dependencies
        run: cd web && npm ci

      - name: Run tests
        run: cd web && npm test

      - name: Build
        run: cd web && npm run build

  test-e2e:
    name: E2E tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run E2E tests
        run: make test-e2e

      - name: Upload report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: e2e/playwright-report/
          retention-days: 7

  publish:
    name: Publish Docker images
    needs: [test-api, test-web, test-e2e]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push images
        run: touch .env && IMAGE_TAG=latest docker compose build --build-arg COMMIT_SHA=${{ github.sha }} api web worker && IMAGE_TAG=latest docker compose push api web worker
        env:
          POSTGRES_USER: build
          POSTGRES_PASSWORD: build
          JWT_SECRET: build
          MINIO_ROOT_USER: build
          MINIO_ROOT_PASSWORD: build

  smoke-test:
    name: Smoke test
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - name: Wait for new version deployment
        run: |
          for i in $(seq 1 30); do
            COMMIT=$(curl -sf ${{ secrets.STAGING_URL }}/healthz | jq -r '.commit // empty')
            if [ "$COMMIT" = "${{ github.sha }}" ]; then
              echo "New version deployed: $COMMIT"
              # Verify readiness too
              curl -sf ${{ secrets.STAGING_URL }}/readyz > /dev/null
              echo "Readiness check passed"
              exit 0
            fi
            echo "Attempt $i/30 - got '$COMMIT', waiting for ${{ github.sha }}..."
            sleep 10
          done
          echo "New version not deployed after 300s"
          exit 1