ci.yml

# This workflow runs CI checks including building, typechecking, and testing the codebase
# Tests are parallelized to run faster by splitting them into separate jobs that run concurrently
#
# See the workflow visualization in knowledge file

name: CI

on:
  push:
    branches: ['main']
  pull_request:
    branches: ['main']

# Define reusable job template
jobs:
  # Build and check
  build-and-check:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: '1.3.5'

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            node_modules
            */node_modules
            packages/*/node_modules
          key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock*') }}
          restore-keys: |
            ${{ runner.os }}-deps-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Set environment variables
        env:
          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
        run: |
          VAR_NAMES=$(bun scripts/generate-ci-env.ts)
          echo "$SECRETS_CONTEXT" | jq -r --argjson vars "$VAR_NAMES" '
            to_entries | .[] | select(.key as $k | $vars | index($k)) | .key + "=" + .value
          ' >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_ACTIONS=true" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_CB_ENVIRONMENT=test" >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_TOKEN=${{ secrets.CODEBUFF_GITHUB_TOKEN }}" >> $GITHUB_ENV

      - name: Typecheck and Build web in parallel
        run: |
          bun -e "
          const { spawn } = require('child_process');
          function runCommand(command, args, options = {}) {
            return new Promise((resolve, reject) => {
              const child = spawn(command, args, { stdio: 'inherit', ...options });
              child.on('close', (code) => code === 0 ? resolve() : reject(new Error('Command failed with exit code ' + code)));
              child.on('error', reject);
            });
          }
          Promise.all([
            runCommand('bun', ['run', 'typecheck']),
            runCommand('bun', ['run', 'build'], { cwd: 'web' })
          ]).then(() => console.log('✅ Both typecheck and web build completed successfully!'))
          .catch(error => { console.error('❌ One or more commands failed:', error.message); process.exit(1); });
          "

      # - name: Build npm-app
      #   run: cd npm-app && bun run build

      # - name: Open interactive debug shell
      #   if: ${{ failure() }}
      #   uses: mxschmitt/action-tmate@v3
      #   timeout-minutes: 15 # optional guard

  # Template for test jobs
  test:
    needs: [build-and-check]
    strategy:
      fail-fast: false
      matrix:
        package:
          [
            .agents,
            cli,
            common,
            packages/agent-runtime,
            packages/billing,
            packages/internal,
            sdk,
            web,
          ]
    name: test-${{ matrix.package }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: '1.3.5'

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            node_modules
            */node_modules
            packages/*/node_modules
          key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock*') }}
          restore-keys: |
            ${{ runner.os }}-deps-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Set environment variables
        env:
          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
        run: |
          VAR_NAMES=$(bun scripts/generate-ci-env.ts)
          echo "$SECRETS_CONTEXT" | jq -r --argjson vars "$VAR_NAMES" '
            to_entries | .[] | select(.key as $k | $vars | index($k)) | .key + "=" + .value
          ' >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_ACTIONS=true" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_CB_ENVIRONMENT=test" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_INFISICAL_UP=true" >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_TOKEN=${{ secrets.CODEBUFF_GITHUB_TOKEN }}" >> $GITHUB_ENV

      - name: Build SDK before tests
        run: cd sdk && bun run build

      - name: Run ${{ matrix.package }} tests
        uses: nick-fields/retry@v3
        with:
          timeout_minutes: 10
          max_attempts: 3
          command: |
            cd ${{ matrix.package }}
            if [ "${{ matrix.package }}" = ".agents" ]; then
              TEST_FILES=$(find __tests__ -name '*.test.ts' ! -name '*.integration.test.ts' 2>/dev/null | sort | tr '\n' ' ')
              if [ -n "$TEST_FILES" ]; then
                bun test $TEST_FILES
              else
                echo "No regular tests found in .agents"
              fi
            elif [ "${{ matrix.package }}" = "web" ]; then
              # Use bun test directly to pick up bunfig.toml preloads for Request global
              TEST_FILES=$(find src -name '*.test.ts' ! -name '*.integration.test.ts' ! -path 'src/__tests__/e2e/*' 2>/dev/null | sort | tr '\n' ' ')
              if [ -n "$TEST_FILES" ]; then
                bun test $TEST_FILES
              else
                echo "No tests found in web"
              fi
            else
              # Run all non-integration tests in a single bun test invocation
              # This avoids xargs exit code issues with orphaned child processes
              TEST_FILES=$(find src -name '*.test.ts' ! -name '*.integration.test.ts' 2>/dev/null | sort | tr '\n' ' ')
              if [ -n "$TEST_FILES" ]; then
                bun test $TEST_FILES
              else
                echo "No tests found in ${{ matrix.package }}"
              fi
            fi

      # - name: Open interactive debug shell
      #   if: ${{ failure() }}
      #   uses: mxschmitt/action-tmate@v3
      #   timeout-minutes: 15 # optional guard

  # Integration tests job (packages that don't need a database)
  test-integration:
    needs: [build-and-check]
    strategy:
      fail-fast: false
      matrix:
        package:
          [
            cli,
            common,
            packages/agent-runtime,
            sdk,
            web,
          ]
    name: test-integration-${{ matrix.package }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: '1.3.5'

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            node_modules
            */node_modules
            packages/*/node_modules
          key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock*') }}
          restore-keys: |
            ${{ runner.os }}-deps-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Set environment variables
        env:
          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
        run: |
          VAR_NAMES=$(bun scripts/generate-ci-env.ts)
          echo "$SECRETS_CONTEXT" | jq -r --argjson vars "$VAR_NAMES" '
            to_entries | .[] | select(.key as $k | $vars | index($k)) | .key + "=" + .value
          ' >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_ACTIONS=true" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_CB_ENVIRONMENT=test" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_INFISICAL_UP=true" >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_TOKEN=${{ secrets.CODEBUFF_GITHUB_TOKEN }}" >> $GITHUB_ENV

      - name: Build SDK before integration tests
        run: cd sdk && bun run build

      - name: Run ${{ matrix.package }} integration tests
        uses: nick-fields/retry@v3
        with:
          timeout_minutes: 15
          max_attempts: 3
          command: |
            cd ${{ matrix.package }}
            TEST_FILES=$(find src -name '*.integration.test.ts' 2>/dev/null | sort | tr '\n' ' ')
            if [ -n "$TEST_FILES" ]; then
              bun test --timeout=60000 $TEST_FILES
            else
              echo "No integration tests found in ${{ matrix.package }}"
            fi

  # Billing integration tests (requires PostgreSQL)
  # DATABASE_URL is set at job level to override any secrets injection
  test-billing-integration:
    needs: [build-and-check]
    name: test-integration-packages/billing
    runs-on: ubuntu-latest
    env:
      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/testdb
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: testdb
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: '1.3.5'

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            node_modules
            */node_modules
            packages/*/node_modules
          key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock*') }}
          restore-keys: |
            ${{ runner.os }}-deps-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Set environment variables
        env:
          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
        run: |
          VAR_NAMES=$(bun scripts/generate-ci-env.ts)
          echo "$SECRETS_CONTEXT" | jq -r --argjson vars "$VAR_NAMES" '
            to_entries | .[] | select(.key as $k | $vars | index($k)) | .key + "=" + .value
          ' >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_ACTIONS=true" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_CB_ENVIRONMENT=test" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_INFISICAL_UP=true" >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_TOKEN=${{ secrets.CODEBUFF_GITHUB_TOKEN }}" >> $GITHUB_ENV

      - name: Build SDK before integration tests
        run: cd sdk && bun run build

      # Override any DATABASE_URL injected from secrets with our test container URL
      - name: Override DATABASE_URL for test container
        run: echo "DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:5432/testdb" >> $GITHUB_ENV

      - name: Setup database schema
        uses: nick-fields/retry@v3
        env:
          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/testdb
        with:
          timeout_minutes: 2
          max_attempts: 3
          command: cd packages/internal && bun run db:migrate

      - name: Run billing integration tests
        uses: nick-fields/retry@v3
        with:
          timeout_minutes: 15
          max_attempts: 3
          command: |
            cd packages/billing
            TEST_FILES=$(find src -name '*.integration.test.ts' 2>/dev/null | sort | tr '\n' ' ')
            if [ -n "$TEST_FILES" ]; then
              bun test --timeout=60000 $TEST_FILES
            else
              echo "No integration tests found in packages/billing"
            fi

  # Internal package integration tests (requires PostgreSQL for advisory lock tests)
  # DATABASE_URL is set at job level to override any secrets injection
  test-internal-integration:
    needs: [build-and-check]
    name: test-integration-packages/internal
    runs-on: ubuntu-latest
    env:
      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/testdb
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: testdb
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: '1.3.5'

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            node_modules
            */node_modules
            packages/*/node_modules
          key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock*') }}
          restore-keys: |
            ${{ runner.os }}-deps-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Set environment variables
        env:
          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
        run: |
          VAR_NAMES=$(bun scripts/generate-ci-env.ts)
          echo "$SECRETS_CONTEXT" | jq -r --argjson vars "$VAR_NAMES" '
            to_entries | .[] | select(.key as $k | $vars | index($k)) | .key + "=" + .value
          ' >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_ACTIONS=true" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_CB_ENVIRONMENT=test" >> $GITHUB_ENV
          echo "NEXT_PUBLIC_INFISICAL_UP=true" >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_TOKEN=${{ secrets.CODEBUFF_GITHUB_TOKEN }}" >> $GITHUB_ENV

      - name: Build SDK before integration tests
        run: cd sdk && bun run build

      # Override any DATABASE_URL injected from secrets with our test container URL
      - name: Override DATABASE_URL for test container
        run: echo "DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:5432/testdb" >> $GITHUB_ENV

      - name: Setup database schema
        uses: nick-fields/retry@v3
        env:
          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/testdb
        with:
          timeout_minutes: 2
          max_attempts: 3
          command: cd packages/internal && bun run db:migrate

      - name: Run internal integration tests
        uses: nick-fields/retry@v3
        with:
          timeout_minutes: 15
          max_attempts: 3
          command: |
            cd packages/internal
            TEST_FILES=$(find src -name '*.integration.test.ts' 2>/dev/null | sort | tr '\n' ' ')
            if [ -n "$TEST_FILES" ]; then
              bun test --timeout=60000 $TEST_FILES
            else
              echo "No integration tests found in packages/internal"
            fi

  # E2E tests for web intentionally omitted for now.