ci.yml

name: CI
on: [push, pull_request]

permissions:
  contents: read

jobs:
  build-test:
    name: Workspace compatibility plus Rust product smoke
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
        with:
          egress-policy: audit
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          submodules: recursive
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093
      - name: Verify pnpm version
        run: |
          echo "pnpm: $(pnpm --version)"
          node -v
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with: { node-version: 22, cache: 'pnpm' }
      - run: pnpm install --frozen-lockfile
      - name: Verify lockfile unchanged
        run: git diff --exit-code -- pnpm-lock.yaml

      # Install Bats for CLI tests executed in this workflow
      - name: Install Bats
        uses: ./.github/actions/install-bats

      - run: pnpm -w test

      # Rust product and repo-level Bats checks cover the retained front door.

      - name: Rust product native schema lower smoke
        run: |
          cargo run --bin wesley -- schema lower \
            --schema test/fixtures/examples/ecommerce.graphql \
            --json > "$RUNNER_TEMP/ecommerce-l1.json"

      - name: Detect changes for repo Bats tests (no servers)
        id: changelog
        env:
          EVENT: ${{ github.event_name }}
          BASE_REF: ${{ github.event.pull_request.base.sha }}
          BEFORE: ${{ github.event.before }}
          SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          RANGE="${BEFORE}..${SHA}"
          if [ "$EVENT" = "pull_request" ] && [ -n "${BASE_REF}" ]; then
            RANGE="${BASE_REF}..${SHA}"
          fi
          echo "Diff range: $RANGE"
          CHANGED=$(git diff --name-only "$RANGE" || true)
          echo "$CHANGED" | sed 's/^/ - /'
          NEED=false
          # Trigger only on unit/serverless tests; exclude browser-contracts and serve-static e2e
          echo "$CHANGED" | grep -E -q '^(scripts/serve-static\.mjs|test/serve-static-(unit|relative-unit)\.bats|scripts/compute-progress\.mjs|scripts/generate-ir-fixtures\.mjs|test/progress-|test/ir-fixtures\.bats|test/ci-|test/deno-host-webcrypto-guard\.bats)' && NEED=true || true
          echo "RUN_BATS=$NEED" >> $GITHUB_ENV

      - name: Repo Bats tests (unit/progress/ci checks only)
        if: ${{ env.RUN_BATS == 'true' }}
        env:
          BATS_LIB_PATH: test
          TERM: xterm
          BATS_NO_COLOR: '1'
        run: |
          # Ensure tests that use `load 'bats-plugins/…'` from the repo-level
          # `test/` directory can resolve plugins.
          timeout 2m bash scripts/setup-bats-plugins.sh
          rm -rf test/hosts/bats-plugins || true
          ln -sfn "$PWD/test/bats-plugins" test/hosts/bats-plugins
          set -euo pipefail
          files=(
            test/serve-static-unit.bats
            test/serve-static-relative-unit.bats
            test/progress-dry-run.bats
            test/ir-fixtures.bats
            test/progress-safety.bats
            test/ci-browser-smoke.bats
            test/ci-pkg-host-bun.bats
            test/ci-workflows.bats
            test/deno-host-webcrypto-guard.bats
          )
          for f in "${files[@]}"; do
            echo "Running Bats: $f"
            timeout 3m bats -t "$f"
          done